Re: Assign user for full previledge for software installation

From: Lillian (anonymous_at_discussions.microsoft.com)
Date: 07/15/04 

Date: Thu, 15 Jul 2004 16:29:18 -0700

Tim:

I try it your way created an GPO, I created an username:
test, he is only domain users, after I created GPO, I run
gpupdate, then login as test, then password, then try to
install one of our software call VNC, it say " Setup was
unable to create the directory "c:\program files\ReakVNC"
Error5: Access is denied.

   What should I do.

thanks.

Lillian
>-----Original Message-----
>Have you tried configuring "always install with elevated
priveleges". This
>setting can be configured in a GPO. I've pasted
information about it below.
>
>Always install with elevated privileges
>Computer Configuration\Administrative Templates\Windows
Components\Windows
>Installer
>
>Description
>Directs Windows Installer to use system permissions when
it installs any
>program on the system.
>
>This policy extends elevated privileges to all programs.
These privileges
>are usually reserved for programs that have been
assigned to the user
>(offered on the desktop), assigned to the computer
(installed
>automatically), or made available in Add/Remove Programs
in Control Panel.
>This policy lets users install programs which require
access to directories
>that the user might not have permission to view or
change, including
>directories on highly restricted computers.
>
>If you disable this policy or do not configure it, the
system applies the
>current user's permissions when it installs programs
that a system
>administrator does not distribute or offer.
>
> Caution
>
>Skilled users can take advantage of the permissions this
policy grants to
>change their privileges and gain permanent access to
restricted files and
>folders. Note that the User Configuration version of
this policy is not
>guaranteed to be secure.
>
> Important
>
>This policy appears both in the Computer Configuration
and User
>Configuration folders. To make this policy effective,
you must enable the
>policy in both folders.
>
>
>--
>Tim Hines, MCSE, MCSA
> Windows 2000 Directory Services
>
>=====================================================
>When responding to posts, please "Reply to Group" via
>your newsreader so that others may learn and benefit
>from your issue.
>=====================================================
>This posting is provided "AS IS" with no warranties, and
confers no rights.
>
>
>
>"Lillian" <anonymous@discussions.microsoft.com> wrote in
message
>news:2c10b01c46927$ac8f73e0$a501280a@phx.gbl...
>> I try to created an user using GPO and gave him or her
>> with full previledge just to install software, not
doing
>> any administrator's job, but not give him the
>> administrator's right, I know if assign the power user
>> right, he can not install MS office, is anyway we can
do
>> it in GPO?
>>
>> Thanks.
>>
>> Lillian
>
>
>

Relevant Pages

  • Re: More than one GPO on the same OU
    ... How does the Group Policy 'No Override' and 'Block Inheritance' work? ... NO OVERRIDE option of a GPO ... > COMPUTER CONFIGURATION ... [Christoffer Andersson] ...
    (microsoft.public.win2000.group_policy)
  • Re: Complex GPO Configuration Issue
    ... I have read a lot of posts and articles on loopback processing and have used ... If you enforce a policy then it will override all other polices in the path ... to the user/computer unless another GPO closer to the user/computer is also ... What I'm getting for user configuration is ...
    (microsoft.public.windows.group_policy)
  • Re: GPO Problems
    ... The computer configuration part belongs to computers and the user configuration part to the user, so depending on the settings you must have the accounts located there. ... If rsop.msc or gpresult /v logged on with a user account doesn't give any output there can be additional problems with GPO applying belomging to DNS confgiruration or slow links between sites. ... Only the password policy an account lockout policy have to bet set on ...
    (microsoft.public.windows.server.active_directory)
  • Re: Complex GPO Configuration Issue
    ... The user settings are definitely enabled on the policy in question. ... pushing GPO to do something it was never intended to do. ... > Loopback processing is computer configuration. ...
    (microsoft.public.windows.group_policy)
  • Re: Log Off, Disconnect, but no Shutdown
    ... Block Policy Inheritance on the OU. ... Move the Terminal Server Computer Objects into the OU. ... Create a GPO called “TS Machine Policy” linked to the OU ... Check “Disable Computer Configuration settings” on these GPO ...
    (microsoft.public.windows.terminal_services)
Loading