Solved

AD Group Policy software restrictions but need to install software in user profile

Posted on 2013-11-12
6
318 Views
Last Modified: 2013-12-10
I had a question come up from a technician here that is having a problem with some installations that he needs to install remotely.  We have an AD in place where the Group Policy is set to software installation restricted.  What he has been doing is creating an OU without that restriction and moving the users effected to that "temp" OU then install while logged in as them.  He told me this software needs to be loaded while in the user profile in order to work within their account.  It is time consuming and disruptive since we are using VNC to remote log in to these places across the state.  Is there anyway to install software at the user level, while logged in remotely as the user, install, without going the route of getting into the server, and moving users into a different OU?

Thanks for any help.
0
Comment
6 Comments
 
LVL 9

Expert Comment

by:MHMAdmins
ID: 39642288
he can login while they are on and shift+right click the executable and run as other user or as administrator and do the install without all that other mess.
0
 
LVL 4
ID: 39642349
He said that he tried that and it still didn't work...
0
 
LVL 24

Assisted Solution

by:Sandeshdubey
Sandeshdubey earned 250 total points
ID: 39643514
You need to first verify are the policy of s/w restriction still applied on client compter.Is this policy userbased or computer.If it is computer based then this will not work as still machine as s/w restriction policy applied moving the user to temp ou will not work.

Yo deploy s/w you can refer this GPO:http://www.advancedinstaller.com/user-guide/tutorial-gpo.html
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 53

Accepted Solution

by:
McKnife earned 250 total points
ID: 39647666
Has to be user based, Sandeshdubey, otherwise his move would not succeed - but it does.
netcepter, you could only deny the "apply group policy" entry in the ACL of the group policy for that very user and do a gpupdate.

But that's not much better. Please give some more info on the following:
-are your users admins or why can they install software unless restricted?
-why is there software in use that can only run under your account when installed by you? Ask the manufacturer about that crappy behavior. He should be able to avoid it
-what particular setting is being used for restriction?
0
 
LVL 4
ID: 39709175
I am so sorry for being late on this.  I have started a new job, and when asking this question, I tried to get a quick solution as I thought that it was a priority.  However, my boss is great and gave me time to learn the system.  I am splitting the reward points as you were both right in the questions you asked and GP.   The solution is Additional path rules.  I set up a directory on the server to allow certain executables run for the help desk dept when they are VNC'd to different computers.   The software needed were small programs that helped the desktop team solve issue.  In this case, they wanted to install PFBackup.exe on machines to backup certain users Outlook Email.  I placed the .exe in the additional rule directory and it worked like a charm for the help desk people.   Again sorry for the tardiness.  I am not usually late.  And actually help out with Access questions, etc.   BUT its a new job!   lol...

Thanks again!
0
 
LVL 4

Author Closing Comment

by:get-ADuser -F ($_.Name -eq "Todd")
ID: 39709180
Additional Path Rule in Group Policy did the trick
0

Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Hide local printer for some users (GPO) 2 21
If user is in "Standard Users" Group run..... 5 51
AD LDAP LDS 3 47
ADFS Redirection 4 31
As network administrators; we know how hard it is to track user’s login/logout using security event log (BTW it is harder now in windows 2008 because user name is always “N/A” in the grid), and most of us either get 3rd party tools, or just make our…
Companies that have implemented Microsoft’s Active Directory need to ensure that the Active Directory is configured and operating properly. If there are issues found and not resolved, it eventually leads the components to fail or stop working and fi…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

930 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now