error installing msi published in group policy

I am trying to publish an msi via group policy so my users can selectively choose to install it.  When theyclick the add button they receive , insufficent access to install. I attempted with a different msi, adminpak.msi (just one that i know should work), and have the same problem.  I have reluctantly added the run with elevated privaleges in group policy, but this did not help.  

Any thoughts, this is really fustrating...
glennjbrownAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Mister_SpockCommented:
In my experiance, to run this on GP the user has to be the admin on the PC. Even though you set the permissions higher in the advertisement, the settings on the PC will over-ride it. This is why alot of administrators have gone to SMS instead of GP. You might try these  though

http://technet.microsoft.com/en-us/library/bb727155.aspx

Or this
http://community.macrovision.com/archive/index.php?t-19315.html

Or try this

When does Windows Installer uses elevated privileges?
A Web Exclusive from FAQ for Windows
November 06, 2003
John Savill
Installation
InstantDoc #40693
FAQ for Windows
      
A. You can use a tool such as Group Policy to perform a managed installation of a Windows Installer file or you can manually install a Windows Installer file. Some applications that you install with a Windows Installer file require elevated privileges to access file system areas or registry keys. When you use a tool such as Group Policy to install a Windows Installer file that deploys an application to a user's system, the application runs with elevated privileges (e.g., system permissions) that bypass the user's limited permissions. However, when a user uses a Windows Installer file to install an application manually, the installation is limited by that user's current privilege level, which might cause some installations to fail.
You can configure a system to run all Windows Installer  installations, including manual installations, with elevated privileges. However, doing so carries the risk that a skilled user could use the elevated privileges to access areas of the system that would otherwise be protected. For information on how to configure all Windows Installer installations to use elevated privileges, see the FAQ "How can I configure all Windows Installer installations to run with elevated privileges?" below.
If you enable a Group Policy Object (GPO) to let all installations run with elevated privileges, be aware that if you install an application on a per-machine basis (i.e., all users on that machine can use it), any repair operations performed for that application will run with elevated privileges, even if you remove the GPO. If, however, you install an application on a per-user basis, then remove the GPO, any attempts to repair that application might fail because the elevated privileges no longer apply.

0
glennjbrownAuthor Commented:
thank you for the response.  I do know about using the elevated privalege and was reluctant to use it, but it didn't work for me.  I still receive the access denied.

Glenn
0
pcandlerCommented:
Do the users have sufficient permissions where the msi file is located?

"Set permissions on the shared network folder to permit access to the distribution package. Give access permissions to the following: administrators, authenticated users, and domain users."
0
Cloud Class® Course: Python 3 Fundamentals

This course will teach participants about installing and configuring Python, syntax, importing, statements, types, strings, booleans, files, lists, tuples, comprehensions, functions, and classes.

glennjbrownAuthor Commented:
yes, the users have read access to the network folder the msi resides in.
thank you
0
Mister_SpockCommented:
Have you tried instaiing the MSI locally (sitting at the PC in question) and running this command?

MSIEXEC.EXE /i [MSI file name]

This will let you know if an error is bieng generated other than insuffecient permissions.
0
glennjbrownAuthor Commented:
now we are getting somewhere.. I get "The system administrator has set policies to prevent this installation"

Any thoughts on what group policies would be set that would block this?

Thanks Mister Spock
0
pcandlerCommented:
Is this a policy based on user or computer?

If based on computer have you given "Domain Computers" sufficient permissions.  I think read/execute should be sufficient.
0
Mister_SpockCommented:
I would agree with dcandler, that would be most logical.
0
glennjbrownAuthor Commented:
this is a user policy as I am trying to publish the msi.  The  group has read, and execute permissions to the folder
0
pcandlerCommented:
Use GPMC (you can download it from http://www.microsoft.com/downloads/details.aspx?FamilyId=0A6D4C24-8CBD-4B35-9272-DD3CBFC81887&displaylang=en)  and obtain a Result Set of Policies using RSoP in logging mode.

This will reveal which policy is preventing the installation.

See following article chapter X for step by step instructions for using it

http://calnetad.berkeley.edu/documentation/technical/gpmc/
0
glennjbrownAuthor Commented:
I run this and don't see anything that stands out.  attached is the results... which i'm uploading as a doc, but it is really an htm so you will have to rename, due to restrictions.

thank you all for helping...
File removed by Netminder 5 May 2009

Open in new window

0
Vadim RappCommented:
in your policy you have

Windows Components/Windows Installer
Disable Windows Installer: Enabled

that's why.
0
glennjbrownAuthor Commented:
it's set to enable, Never, so basically windows installer should work.   I only changed this setting after having this issue.  to no availe.
0
Vadim RappCommented:
have you restarted the computer? it's per-computer setting, so applied when it starts.
0
Vadim RappCommented:
also see http://www.appdeploy.com/messageboards/tm.asp?m=8872&mpage=1 . Do you have installer 2 or 3.1?
0
glennjbrownAuthor Commented:
yes, I've restarted many times.  I've made the gp change which is what sets the reg change to the one in the link and.  I am using windows installer 3.01
0
pcandlerCommented:
Brainstorming.  Problem appears to be permissions.

Looking at the deployment source, $ indicates a hidden administrative share used (correct me if I'm wrong)

gbrown an non admin

What are the NTFS Folder Permissions for the user (and file if different)?
Do they had read & execute?
0
Vadim RappCommented:
anything interesting in the log file if you run it with verbose logging?

msiexec /l*v c:\install.log /i <package.msi>
0
Vadim RappCommented:
also, does it depend on the user who is running the installation? does it still fail for computer administrator?
0
Vadim RappCommented:
also, please go through installer/products in the registry and delete any traces of prior installation. Most posts on the net about this message are indicating this as the reason.
0
glennjbrownAuthor Commented:
the user gbrown is just a user but has domain rights to read/execute where these msi file resides. Any administrator that can see the folder on the domain can go through the add/remove and install with no issues.  attached is the log, indicating insufficient access, which we already see.
0
glennjbrownAuthor Commented:
doh, forgot to attach
install.txt
0
Vadim RappCommented:
Look in the launch conditions of the installation package. It was the last action before it bombed out.

Those conditions are in the msi itself, you need some tool to look at them - wise, installshield, orca... If you don't have any, post the msi for download, and I'll look inside.
0
glennjbrownAuthor Commented:
I intially had the problem with a smartboard software si,so I switched to adminpak from the MS website, figuring it would at least be a fairly good package to play with for testing.  its 13mb so I can't post, but like I said its just the windows 2003 admin pak tools
0
pcandlerCommented:
What errors are in the event log of the PC?
0
glennjbrownAuthor Commented:
from oldest to newest, but nothing that we didn't already know...



Description:
Product: Windows Server 2003 Service Pack 1 Administration Tools Pack -- You do not have sufficient privileges to complete this installation.  Log on as an administrator and try again.


Description:
The install of application Windows Server 2003 Service Pack 1 Administration Tools Pack from policy GPO-UC-US-WES-SoftwareInstallation failed.  The error was : Fatal error during installation.


Description:
The removal of the assignment of application Windows Server 2003 Service Pack 1 Administration Tools Pack from policy GPO-UC-US-WES-SoftwareInstallation succeeded.

0
Vadim RappCommented:
This package does the condition that the user must be administrator. Otherwise, "You do not have sufficient privileges to complete this installation.  Log on as an administrator and try again."

Other conditions: language=1033, and not 64-bit system.
0
pcandlerCommented:
What security/permissions is on the group policy?
0
Vadim RappCommented:
...I'm really curious, why you want non-administrators to have access to administrative tools. Most if not all of them won't work anyways, but if some suddenly do, do you really want everyone to manage your dns servers? lol.
0
glennjbrownAuthor Commented:
I can't find where you see the permissions on the group policy.

For the package, as I said before I was using a different package but afraid some customizations were in it that was preventing the install, so I moved to a package that I was pretty sure had fairly nuetral settings.
0
Vadim RappCommented:
you don't have to look at the permissions. If they were not sufficient, the package wouldn't launch at all. The requirement that the user has to be an administrator is within the package itself. The only way to bypass it is by editing the package itself.
0
glennjbrownAuthor Commented:
ok, so I tried a third package microsoft shadow copy client and that works succefully.  so it's definetly something in the msi that prevents it,  The original package I am trying to work with is,....smartboard software,  which can be found here  (110mb).  since its thrid party,  suggestions on how I can repackage?
http://www2.smarttech.com/st/en-US/Support/Downloads/SBS/Windows/SBSv97Win.htm
0
Vadim RappCommented:
there are tools that allow repackaging - wise packaging studio, installshield... I often repackage various packages for deploying on my network, and it's quite a bit of work.
0
pcandlerCommented:
Before considering repacking, try vadimrapp1 earlier suggestion of verbose logging, but this time using the smartboard software.

msiexec /l*v c:\install.log /i <package.msi>

BTW. Personally I install the the smartboard s/w manually as the essentials for educators is 500 MB
0
glennjbrownAuthor Commented:
thanks will try, I actually only need the notebook software, but need more than the reader so I have to use the whole package.
0
glennjbrownAuthor Commented:
I downloade installshiekd and you are correct the require admin privaleges was set to yes.  I changed it to No. save the msi, and replaced the existing install on the network, but stil lno luck.  Same problem.  one thing I notice in install shield is the comment below..

"If you set this to No, InstallShield sets bit 3 in the Word Count Summary property to indicate that elevated privileges are not required to install the .msi package. Note that if you select No but your .msi package tries to perform a task for which it does not have adequate privileges, Windows Installer may display a run-time error.

This setting applies to installations that are run with Windows Installer 4.0 on Windows Vista systems. Earlier versions of Windows Installer ignore this setting."


So does this mean it will not work to change this setting as I am installing on XP with Win installer 3.?
is their some other place I should look to make a change in the applciation?
0
Vadim RappCommented:
Look in the table LaunchCondition.

(if you don't have direct editor component, it means that you have Light version of installshield).

Depending on your situation, you may also research a little the question of legality of these modifications. The words "reverse engineering" do come to mind.

I still don't understand how you expect non-admin users to use administrative tools once it's finally installed for them, but it's certainly your choice.
0
glennjbrownAuthor Commented:
vadim, thanks I will, again the ultimate goal is to install smartboard software but I was using Admin pak as a test package.
0
Vadim RappCommented:
LOL. Microsoft installations are not very good candidates for test packages to deploy. Some are missing administrative sequence at all. Plus they have tons of custom actions as workarounds for all kinds of bugs in everything, so their validation always returns tons of errors.

Take this trivial installation and use for testing, it took 1 minute to create. Will put a shortcut on the desktop.

http://psisps.polyscience.com/vrcrm/test.msi
0
glennjbrownAuthor Commented:
The launch condition shows the error messages that are displayed to a non-admin trying to run the install, but what can I change to make the install work... Other than the "require admin privaleges was set to yes." which I changed to no availe.
0
Vadim RappCommented:
Open table LaunchCondition and delete the row with the condition that has the familiar message.

I think we will save much time if we concentrate on what you _really_ need to do. If you need to try group policy deployment of _some_ package, then please take mine, the one I posted above, and try. If you need to deploy smartboard, why not to try deploying smartboard. The problems you encounter in this administrative tools package have nothing to do at all with the problems you might encounter with smartboard. I don't think it's very productive to troubleshoot deployment of the allegedly non-compliant package that you in fact don't need.
0
glennjbrownAuthor Commented:
vadmin, lets clarify what I need so neither of us waste our time, i do appreciate your time and help.

I NEED to install the smartboad application, via group policy.

I do NOT need admin pak deployed.
0
glennjbrownAuthor Commented:
also to download your test package, I am prompted for credentials.
0
Vadim RappCommented:
> also to download your test package, I am prompted for credentials.

sorry. This is fixed now, please re-try.
0
glennjbrownAuthor Commented:
ok, so I download and published your test file.  then I installed as a non-admin correctly and have a file on my desktop aaa.log   so it's not the method of deployment, but the package itself.
0
Vadim RappCommented:
> so it's not the method of deployment, but the package itself.

so after all, you still did not believe me when I found it by looking into adminpack package, lol.
0
glennjbrownAuthor Commented:
I do believe its the package, its just a matter of how to adjust the package to make it work for me... arg so annoying for something so miniscule...
0
Vadim RappCommented:
> so annoying for something so miniscule

believe me, even if you resolve this problem there would be many more, for the reasons I posted above.

Usually, if Microsoft does not explicitly state that the package can be deployed by group policy, it's safe bet to assume that it can't.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
glennjbrownAuthor Commented:
We worked to resolve the reason for the error, but we can not fix the problem. Due to it being a third party app.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Installation

From novice to tech pro — start learning today.