Sign in with
Sign up | Sign in
Your question

Assign user for full previledge for software installation

Tags:
  • Policy
  • Microsoft
  • Software
  • Windows
Last response: in Windows 2000/NT
Share
Anonymous
July 13, 2004 7:20:59 PM

Archived from groups: microsoft.public.win2000.group_policy (More info?)

I try to created an user using GPO and gave him or her
with full previledge just to install software, not doing
any administrator's job, but not give him the
administrator's right, I know if assign the power user
right, he can not install MS office, is anyway we can do
it in GPO?

Thanks.

Lillian

More about : assign user full previledge software installation

Anonymous
July 14, 2004 2:05:13 PM

Archived from groups: microsoft.public.win2000.group_policy (More info?)

Have you tried configuring "always install with elevated priveleges". This
setting can be configured in a GPO. I've pasted information about it below.

Always install with elevated privileges
Computer Configuration\Administrative Templates\Windows Components\Windows
Installer

Description
Directs Windows Installer to use system permissions when it installs any
program on the system.

This policy extends elevated privileges to all programs. These privileges
are usually reserved for programs that have been assigned to the user
(offered on the desktop), assigned to the computer (installed
automatically), or made available in Add/Remove Programs in Control Panel.
This policy lets users install programs which require access to directories
that the user might not have permission to view or change, including
directories on highly restricted computers.

If you disable this policy or do not configure it, the system applies the
current user's permissions when it installs programs that a system
administrator does not distribute or offer.

Caution

Skilled users can take advantage of the permissions this policy grants to
change their privileges and gain permanent access to restricted files and
folders. Note that the User Configuration version of this policy is not
guaranteed to be secure.

Important

This policy appears both in the Computer Configuration and User
Configuration folders. To make this policy effective, you must enable the
policy in both folders.


--
Tim Hines, MCSE, MCSA
Windows 2000 Directory Services

=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.



"Lillian" <anonymous@discussions.microsoft.com> wrote in message
news:2c10b01c46927$ac8f73e0$a501280a@phx.gbl...
> I try to created an user using GPO and gave him or her
> with full previledge just to install software, not doing
> any administrator's job, but not give him the
> administrator's right, I know if assign the power user
> right, he can not install MS office, is anyway we can do
> it in GPO?
>
> Thanks.
>
> Lillian


begin 666 caution.gif
M1TE&.#EA"@`*`)'_`,# P/\``'\``````"'Y! $`````+ `````*``H```(:
<W "&.&$AC&H"BL@L/(NJE3@@R(V,2:( G6 ``.P``
`
end

begin 666 important.gif
M1TE&.#EA"@`*`)'_````_P``@,# P)F9F2'Y! $```(`+ `````*``H```(=
?E!6G"+D!1%-PB#$9L'A"$('9)P:6`4GFTYR/*Q0`.P``
`
end
Anonymous
July 15, 2004 8:29:18 PM

Archived from groups: microsoft.public.win2000.group_policy (More info?)

Tim:

I try it your way created an GPO, I created an username:
test, he is only domain users, after I created GPO, I run
gpupdate, then login as test, then password, then try to
install one of our software call VNC, it say " Setup was
unable to create the directory "c:\program files\ReakVNC"
Error5: Access is denied.

What should I do.

thanks.

Lillian
>-----Original Message-----
>Have you tried configuring "always install with elevated
priveleges". This
>setting can be configured in a GPO. I've pasted
information about it below.
>
>Always install with elevated privileges
>Computer Configuration\Administrative Templates\Windows
Components\Windows
>Installer
>
>Description
>Directs Windows Installer to use system permissions when
it installs any
>program on the system.
>
>This policy extends elevated privileges to all programs.
These privileges
>are usually reserved for programs that have been
assigned to the user
>(offered on the desktop), assigned to the computer
(installed
>automatically), or made available in Add/Remove Programs
in Control Panel.
>This policy lets users install programs which require
access to directories
>that the user might not have permission to view or
change, including
>directories on highly restricted computers.
>
>If you disable this policy or do not configure it, the
system applies the
>current user's permissions when it installs programs
that a system
>administrator does not distribute or offer.
>
> Caution
>
>Skilled users can take advantage of the permissions this
policy grants to
>change their privileges and gain permanent access to
restricted files and
>folders. Note that the User Configuration version of
this policy is not
>guaranteed to be secure.
>
> Important
>
>This policy appears both in the Computer Configuration
and User
>Configuration folders. To make this policy effective,
you must enable the
>policy in both folders.
>
>
>--
>Tim Hines, MCSE, MCSA
> Windows 2000 Directory Services
>
>=====================================================
>When responding to posts, please "Reply to Group" via
>your newsreader so that others may learn and benefit
>from your issue.
>=====================================================
>This posting is provided "AS IS" with no warranties, and
confers no rights.
>
>
>
>"Lillian" <anonymous@discussions.microsoft.com> wrote in
message
>news:2c10b01c46927$ac8f73e0$a501280a@phx.gbl...
>> I try to created an user using GPO and gave him or her
>> with full previledge just to install software, not
doing
>> any administrator's job, but not give him the
>> administrator's right, I know if assign the power user
>> right, he can not install MS office, is anyway we can
do
>> it in GPO?
>>
>> Thanks.
>>
>> Lillian
>
>
>
Anonymous
July 17, 2004 5:48:24 AM

Archived from groups: microsoft.public.win2000.group_policy (More info?)

Guess this policy covers only programs distributed as msi packages. Could be
wrong here though...

Al.

"Lillian" <anonymous@discussions.microsoft.com> wrote in message
news:2e64101c46ac3$8ca3ab80$a301280a@phx.gbl...
> Tim:
>
> I try it your way created an GPO, I created an username:
> test, he is only domain users, after I created GPO, I run
> gpupdate, then login as test, then password, then try to
> install one of our software call VNC, it say " Setup was
> unable to create the directory "c:\program files\ReakVNC"
> Error5: Access is denied.
>
> What should I do.
>
> thanks.
>
> Lillian
> >-----Original Message-----
> >Have you tried configuring "always install with elevated
> priveleges". This
> >setting can be configured in a GPO. I've pasted
> information about it below.
> >
> >Always install with elevated privileges
> >Computer Configuration\Administrative Templates\Windows
> Components\Windows
> >Installer
> >
> >Description
> >Directs Windows Installer to use system permissions when
> it installs any
> >program on the system.
> >
> >This policy extends elevated privileges to all programs.
> These privileges
> >are usually reserved for programs that have been
> assigned to the user
> >(offered on the desktop), assigned to the computer
> (installed
> >automatically), or made available in Add/Remove Programs
> in Control Panel.
> >This policy lets users install programs which require
> access to directories
> >that the user might not have permission to view or
> change, including
> >directories on highly restricted computers.
> >
> >If you disable this policy or do not configure it, the
> system applies the
> >current user's permissions when it installs programs
> that a system
> >administrator does not distribute or offer.
> >
> > Caution
> >
> >Skilled users can take advantage of the permissions this
> policy grants to
> >change their privileges and gain permanent access to
> restricted files and
> >folders. Note that the User Configuration version of
> this policy is not
> >guaranteed to be secure.
> >
> > Important
> >
> >This policy appears both in the Computer Configuration
> and User
> >Configuration folders. To make this policy effective,
> you must enable the
> >policy in both folders.
> >
> >
> >--
> >Tim Hines, MCSE, MCSA
> > Windows 2000 Directory Services
> >
> >=====================================================
> >When responding to posts, please "Reply to Group" via
> >your newsreader so that others may learn and benefit
> >from your issue.
> >=====================================================
> >This posting is provided "AS IS" with no warranties, and
> confers no rights.
> >
> >
> >
> >"Lillian" <anonymous@discussions.microsoft.com> wrote in
> message
> >news:2c10b01c46927$ac8f73e0$a501280a@phx.gbl...
> >> I try to created an user using GPO and gave him or her
> >> with full previledge just to install software, not
> doing
> >> any administrator's job, but not give him the
> >> administrator's right, I know if assign the power user
> >> right, he can not install MS office, is anyway we can
> do
> >> it in GPO?
> >>
> >> Thanks.
> >>
> >> Lillian
> >
> >
> >
!