Re: Can not install applications using any admin account

I've no idea, since I don't know what this particular script is
doing.

You could try if it works without those restrictive policy
settings, or download FileMon and RegMon from
http://www.sysinternals.com/. Run them as administrator (when no
user is connected), start a TS session as a normal user and try to
run the application.
FileMon and RegMon will show you all "access denied" errors that
occur, so that you can give your users the necessary permissions on
a file-to file or Registry subkey basis.

Note: making your users Power Users is nearly as bad as making them
Administrators. Make them normal Users as soon as the migration is
completed (if that is the reason why you made them Power Users).

_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

=?Utf-8?B?SGFzdGluZ3M=?= <Hastings@xxxxxxxxxxxxxxxxxxxxxxxxx>
wrote on 18 aug 2006 in
microsoft.public.windows.terminal_services:

Vera , thank you the second article solved my issue.
I also have a vbscript running at logon (login script not GPO)
to help with an Exchange migration that is failing.
(emwprof.vbs) The script runs under user context, the users of
this instance of Terminal Servers have "Power User" rights and
it sends the script into debug mode. If I give the users
Administrative Rights the script runs fine. Any ideas? I do have
these Computer Policy Settings:
Prohibit non-administrators from applying vendor signed updates
Enabled Prohibit patching Enabled
Prohibit User Installs Enabled



"Vera Noest [MVP]" wrote:

Software Restriction Policies?
Windows Installer policies?
Are you sure that you are actually *seeing* all policy
settings? Maybe you use an outdated version of the adm template
on the computer which you use to look at the policies? Check
this:

816662 - Recommendations for Managing Group Policy
Administrative Template (.adm) files
http://support.microsoft.com/?kbid=816662

What you should do is to make sure that any GPO which contains
restrictions is *not* applied to Administrators.

816100 - How To Prevent Domain Group Policies from Applying to
Administrator Accounts and Selected Users in Windows Server
2003 http://support.microsoft.com/?kbid=816100
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

=?Utf-8?B?SGFzdGluZ3M=?= <Hastings@xxxxxxxxxxxxxxxxxxxxxxxxx>
wrote on 17 aug 2006 in
microsoft.public.windows.terminal_services:

We have a terminal server farm that is load balanced and uses
session directory. I am having issues adding applications
using either the Add/Remove function or by using the change
user /install. I keep getting denied access to install them.
The only way that I can install them is if I remove the
Terminal Server from its associated GPO. Can anyone think of
a GPO setting that would deny any user including
administrators from installing software. I have checked
countless times to no avail. Any advice is needed!
.

Relevant Pages

  • Re: scripted logon
    ... Why can't you launch all the scripts from a Group Policy based Logon script. ... Here's the policy settings (I sure hope word wrap doesn't mess it up too ... Windows Components/Windows Installer ...
    (microsoft.public.windows.terminal_services)
  • Re: Startup Bat File
    ... Link the policy at/above where their accounts reside in the AD tree. ... So it looks like it needs to be moved to the logon script within the ... registry settings and such for mapping drives, ... Domain Admins - Read, Write, Create All Child Objects, Delete All ...
    (microsoft.public.windows.group_policy)
  • Re: Startup Bat File
    ... So it looks like it needs to be moved to the logon script within the user ... registry settings and such for mapping drives, ... I have tested the bat file and it works outside of group policy but I ... Domain Admins - Read, Write, Create All Child Objects, Delete All Child ...
    (microsoft.public.windows.group_policy)
  • Re: Group Policy to secure DFS Share
    ... I have tested and there is NO policy at all that can restrict an individual ... with administrative rights on a computer from taking ownership; ... policy refresh, the file settings are changed back, but the file changes ... I agree that they should be trusted or not be administrators, ...
    (microsoft.public.win2000.group_policy)
  • XP Policies (like PolEdit)
    ... Administrators (or whoever you want the policy to NOT ... >seem to be machine settings. ... my admin account also has it gone. ...
    (microsoft.public.windowsxp.security_admin)