We help IT Professionals succeed at work.

We've partnered with Certified Experts, Carl Webster and Richard Faulkner, to bring you two Citrix podcasts. Learn about 2020 trends and get answers to your biggest Citrix questions!Listen Now


The system administrator has set policies to prevent this installation

drotkopf asked
Medium Priority
Last Modified: 2010-05-18

I'm logged in with an account that is a local admin in a Windows 2003 R2 SP1 server that is part of a SBS 2003 domain.

I'm running a .exe file that is an InstaShield Wizard to install an upgrade to a product. It extracts a few files, and then the Windows Installer window says "Preparing to install... " and after a minute or so we get this error window:

        The system administrator has set policies to prevent this installation

Now, I have been able to install other products here, particularly the previous version of the product which I am upgrading.

Any ideas?

Watch Question


try to refresh your GPO settings like this

start --> run
gpoupdate /force

It could also be so that the upgrade is trying to install files on new placeses where u dont have the rights for.

Have u asked admin if he changed your credntials?

If your administrator is pushing Group Policy to networked pc's that hold installation restrictions the administrator will have to alter policy in order for you to install the software.


I am the administrator...

The event log is showing:

The installation of C:\DOCUME~1\icadmin\LOCALS~1\Temp\1\pft37.tmp\ServiceUpdate.msi is not permitted due to an error in software restriction policy processing. The object cannot be trusted.

As said before, I'm logging in with an account tht has local admin rights.
Also, I have installed SW before, but I don't know if using MSI.

This issue could have happened due to antivirus upgrade from old to new version or this can happen if your system is infected by virus :

Please check the URL mentioned below:


Please let me know if this helped you.


No antivirus running on that server.

try this:
make sure your software is on local drive (c:\)
logon with local administrator (not domain admin)
try to run the software.
worked for me once in similar situation.
Check if you have an admin rights for the user who has logged in. I feel that this is the issue. If you do not have the admin permission please provide the admin permission and then restart the computer and check. you would be succesed.

good luck

Gopal Krishna K


haim96 - the software is on the local drive

haim96 and gopal krishna - I am running this while logged in with a domain account that is a local admin to the server. I also tried it with the local administrator account.

If the admin is making use of restricted groups and has the local admin account in a restricted group he could effect a policy that disallows you from installing software. There is nothing you could do really but convince him/her to relax it.
I would remove that computer from the domain and add it to the workgroup, try running the install, if it works, you know for a fact group policies are being pushed down. After joining the domain again, run gpudate as mentioned above and look through the output given to see what polices are associated with that user/device
Chris GralikeSpecialist

check the settings either @

Start > Administrative tools > Local security Policy || Security policies > Software Policies

Or install the policy manager at the domain controller and generate an effective policy overview while having the OU selected in wich the computer objects reside..

Group policy management can be downloaded here >>



view the policies that have been applied to your server you are logging on. I know there is a command to do so in command prompt but i dont remember it on top of my tong. I know you can also do this through windows 2003 server in active directory users and computers but I do not know about small business server though.

Move the .exe out of the temp folder and then rerun the installer.


Sorry guys, but None of the Above.

This is how it was solved:

1. Opened Local Security Policy
2. In Local Security Setting MSC, Click on Software Restriction Policies, the were "No Software Restriction Policies Defined".
 3. Right-click the Software Restriction Policies, and selected New Software Restriction Policies  
 4. Double-clicked on the Enforcement entry, to open Enforcement Properties dialog  
 5. Under "Apply software restriction policies to the following:" section, kept "All software files except libraries (such as DLLs)" options checked.
 6. Under "Apply software restriction polices to the following users:" section, changed to "All users except local administrators".  
 7. Rebooted the server.

Jeffrey Kane - TechSoEasyPrincipal Consultant
Most Valuable Expert 2016
Top Expert 2014

That really wasn't necessary.  Had you logged onto your computer with a DOMAIN Admin Account it would have overridden your local policy.



I had answered the question myself
Comment from drotkopf
Date: 10/24/2006 02:10PM PDT
I'll go now to http://www.experts-exchange.com/help.jsp#hs5 to have it properly closed.
Thats perfect solution drotkopf  as provided. this is applicable for Windows Vista to. If any users who have installed vista and facing this issues, please gohead and follow the same steps you would be able to resolve it and install the applications. This I faced yesterday when I addedd the test machine in my domain and try to install MSoffice and other applications.

drotkopf, Thanks for your solution, which helped me a lot in my bitter situtuation..........

Gopal Krishna K


I'm happy that the same way that I could benefit from someone else's solution, other people can benefit from me passing the solution on.
Most Valuable Expert 2015

OK, so please accept the answer(s) that gave you the solution and close the Q.



Rindi, I answered the question!

Comment from drotkopf
Date: 11/15/2006 12:23PM PST

Comment from drotkopf
Date: 10/24/2006 02:10PM PDT
Most Valuable Expert 2015

Actually you could have asked for a PAQ/Refund, the "PAQ" as opposed to a "Delete" will stay in the EE Database for future references. But anyway, since you posted in the Support TA, the moderator will post a query here shortly asking whether the other experts are OK with a refund, and then we can ask for a PAQ. Anyway, you followed the official way which is good...
PAQd, 500 points refunded.

CS Moderator

Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts
Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.


Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.