Assign user for full previledge for software installation

Archived from groups: microsoft.public.win2000.group_policy (More info?)

I try to created an user using GPO and gave him or her
with full previledge just to install software, not doing
any administrator's job, but not give him the
administrator's right, I know if assign the power user
right, he can not install MS office, is anyway we can do
it in GPO?

Thanks.

Lillian
3 answers Last reply
More about assign user full previledge software installation
  1. Archived from groups: microsoft.public.win2000.group_policy (More info?)

    Have you tried configuring "always install with elevated priveleges". This
    setting can be configured in a GPO. I've pasted information about it below.

    Always install with elevated privileges
    Computer Configuration\Administrative Templates\Windows Components\Windows
    Installer

    Description
    Directs Windows Installer to use system permissions when it installs any
    program on the system.

    This policy extends elevated privileges to all programs. These privileges
    are usually reserved for programs that have been assigned to the user
    (offered on the desktop), assigned to the computer (installed
    automatically), or made available in Add/Remove Programs in Control Panel.
    This policy lets users install programs which require access to directories
    that the user might not have permission to view or change, including
    directories on highly restricted computers.

    If you disable this policy or do not configure it, the system applies the
    current user's permissions when it installs programs that a system
    administrator does not distribute or offer.

    Caution

    Skilled users can take advantage of the permissions this policy grants to
    change their privileges and gain permanent access to restricted files and
    folders. Note that the User Configuration version of this policy is not
    guaranteed to be secure.

    Important

    This policy appears both in the Computer Configuration and User
    Configuration folders. To make this policy effective, you must enable the
    policy in both folders.


    --
    Tim Hines, MCSE, MCSA
    Windows 2000 Directory Services

    =====================================================
    When responding to posts, please "Reply to Group" via
    your newsreader so that others may learn and benefit
    from your issue.
    =====================================================
    This posting is provided "AS IS" with no warranties, and confers no rights.


    "Lillian" <anonymous@discussions.microsoft.com> wrote in message
    news:2c10b01c46927$ac8f73e0$a501280a@phx.gbl...
    > I try to created an user using GPO and gave him or her
    > with full previledge just to install software, not doing
    > any administrator's job, but not give him the
    > administrator's right, I know if assign the power user
    > right, he can not install MS office, is anyway we can do
    > it in GPO?
    >
    > Thanks.
    >
    > Lillian


    begin 666 caution.gif
    M1TE&.#EA"@`*`)'_`,# P/\``'\``````"'Y! $`````+ `````*``H```(:
    <W "&.&$AC&H"BL@L/(NJE3@@R(V,2:(G6 ``.P``
    `
    end

    begin 666 important.gif
    M1TE&.#EA"@`*`)'_````_P``@,# P)F9F2'Y! $```(`+ `````*``H```(=
    ?E!6G"+D!1%-PB#$9L'A"$('9)P:6`4GFTYR/*Q0`.P``
    `
    end
  2. Archived from groups: microsoft.public.win2000.group_policy (More info?)

    Tim:

    I try it your way created an GPO, I created an username:
    test, he is only domain users, after I created GPO, I run
    gpupdate, then login as test, then password, then try to
    install one of our software call VNC, it say " Setup was
    unable to create the directory "c:\program files\ReakVNC"
    Error5: Access is denied.

    What should I do.

    thanks.

    Lillian
    >-----Original Message-----
    >Have you tried configuring "always install with elevated
    priveleges". This
    >setting can be configured in a GPO. I've pasted
    information about it below.
    >
    >Always install with elevated privileges
    >Computer Configuration\Administrative Templates\Windows
    Components\Windows
    >Installer
    >
    >Description
    >Directs Windows Installer to use system permissions when
    it installs any
    >program on the system.
    >
    >This policy extends elevated privileges to all programs.
    These privileges
    >are usually reserved for programs that have been
    assigned to the user
    >(offered on the desktop), assigned to the computer
    (installed
    >automatically), or made available in Add/Remove Programs
    in Control Panel.
    >This policy lets users install programs which require
    access to directories
    >that the user might not have permission to view or
    change, including
    >directories on highly restricted computers.
    >
    >If you disable this policy or do not configure it, the
    system applies the
    >current user's permissions when it installs programs
    that a system
    >administrator does not distribute or offer.
    >
    > Caution
    >
    >Skilled users can take advantage of the permissions this
    policy grants to
    >change their privileges and gain permanent access to
    restricted files and
    >folders. Note that the User Configuration version of
    this policy is not
    >guaranteed to be secure.
    >
    > Important
    >
    >This policy appears both in the Computer Configuration
    and User
    >Configuration folders. To make this policy effective,
    you must enable the
    >policy in both folders.
    >
    >
    >--
    >Tim Hines, MCSE, MCSA
    > Windows 2000 Directory Services
    >
    >=====================================================
    >When responding to posts, please "Reply to Group" via
    >your newsreader so that others may learn and benefit
    >from your issue.
    >=====================================================
    >This posting is provided "AS IS" with no warranties, and
    confers no rights.
    >
    >
    >
    >"Lillian" <anonymous@discussions.microsoft.com> wrote in
    message
    >news:2c10b01c46927$ac8f73e0$a501280a@phx.gbl...
    >> I try to created an user using GPO and gave him or her
    >> with full previledge just to install software, not
    doing
    >> any administrator's job, but not give him the
    >> administrator's right, I know if assign the power user
    >> right, he can not install MS office, is anyway we can
    do
    >> it in GPO?
    >>
    >> Thanks.
    >>
    >> Lillian
    >
    >
    >
  3. Archived from groups: microsoft.public.win2000.group_policy (More info?)

    Guess this policy covers only programs distributed as msi packages. Could be
    wrong here though...

    Al.

    "Lillian" <anonymous@discussions.microsoft.com> wrote in message
    news:2e64101c46ac3$8ca3ab80$a301280a@phx.gbl...
    > Tim:
    >
    > I try it your way created an GPO, I created an username:
    > test, he is only domain users, after I created GPO, I run
    > gpupdate, then login as test, then password, then try to
    > install one of our software call VNC, it say " Setup was
    > unable to create the directory "c:\program files\ReakVNC"
    > Error5: Access is denied.
    >
    > What should I do.
    >
    > thanks.
    >
    > Lillian
    > >-----Original Message-----
    > >Have you tried configuring "always install with elevated
    > priveleges". This
    > >setting can be configured in a GPO. I've pasted
    > information about it below.
    > >
    > >Always install with elevated privileges
    > >Computer Configuration\Administrative Templates\Windows
    > Components\Windows
    > >Installer
    > >
    > >Description
    > >Directs Windows Installer to use system permissions when
    > it installs any
    > >program on the system.
    > >
    > >This policy extends elevated privileges to all programs.
    > These privileges
    > >are usually reserved for programs that have been
    > assigned to the user
    > >(offered on the desktop), assigned to the computer
    > (installed
    > >automatically), or made available in Add/Remove Programs
    > in Control Panel.
    > >This policy lets users install programs which require
    > access to directories
    > >that the user might not have permission to view or
    > change, including
    > >directories on highly restricted computers.
    > >
    > >If you disable this policy or do not configure it, the
    > system applies the
    > >current user's permissions when it installs programs
    > that a system
    > >administrator does not distribute or offer.
    > >
    > > Caution
    > >
    > >Skilled users can take advantage of the permissions this
    > policy grants to
    > >change their privileges and gain permanent access to
    > restricted files and
    > >folders. Note that the User Configuration version of
    > this policy is not
    > >guaranteed to be secure.
    > >
    > > Important
    > >
    > >This policy appears both in the Computer Configuration
    > and User
    > >Configuration folders. To make this policy effective,
    > you must enable the
    > >policy in both folders.
    > >
    > >
    > >--
    > >Tim Hines, MCSE, MCSA
    > > Windows 2000 Directory Services
    > >
    > >=====================================================
    > >When responding to posts, please "Reply to Group" via
    > >your newsreader so that others may learn and benefit
    > >from your issue.
    > >=====================================================
    > >This posting is provided "AS IS" with no warranties, and
    > confers no rights.
    > >
    > >
    > >
    > >"Lillian" <anonymous@discussions.microsoft.com> wrote in
    > message
    > >news:2c10b01c46927$ac8f73e0$a501280a@phx.gbl...
    > >> I try to created an user using GPO and gave him or her
    > >> with full previledge just to install software, not
    > doing
    > >> any administrator's job, but not give him the
    > >> administrator's right, I know if assign the power user
    > >> right, he can not install MS office, is anyway we can
    > do
    > >> it in GPO?
    > >>
    > >> Thanks.
    > >>
    > >> Lillian
    > >
    > >
    > >
Ask a new question

Read More

Policy Microsoft Software Windows