Sign in with
Sign up | Sign in
Your question

GPO package assign permissions

Tags:
  • Policy
  • Permissions
  • Windows
Last response: in Windows 2000/NT
Share
Anonymous
November 22, 2004 11:57:07 PM

Archived from groups: microsoft.public.win2000.group_policy (More info?)

Hello,

I've been working on trying to get a certain application installed via
GPO
and can't seem to get it right.

Basically, the manual way to get it working is as follows:

1) Install the application as administrator (uses standard window
installer).

2) Set permissions on c:\program files\ngi to give user write
permissions (we usually just give everyone write to this folder).
Without these permissions, the user, not having local admin rights,
cannot even open the application.

So, using the old Veritas WinInstall LE, we created an .msi package,
and then moved the entire folder structure to a share on a file server
that gives full read rights to everyone. This all goes well, and when
double-clicking on the .msi package (as administrator) the install
goes through fine with no user intervention.

Now the problem.

We create a group policy that does the following:

1) Assigns the package via user (not computer) settings.

2) Make the login synchronous via a policy (don't remember the exact
one off hand) so that the explorer interface waits for all scripts to
run. This is done in user settings.

3) Give the directory c:\program files\ngi everyone write permissions
via computer settings.

Next we place both the computer account and user account in the OU
that has this GPO applied.

What happens is that after login by the user, you can see that the
application is installing, then when the user gets to the desktop, the
icon for the application is there, and the start menu shows that a new
application is installed. When the user double clicks on the icon,
then it goes through another install process and finally fails. It
fails because of the fact that the user does not have local admin and
the write permissions have not been assigned to the program directory
(c:\program files\ngi).

I've determined that the reason the policy could not assign the write
permissios at this point, is because the directory did not exist.

Anyway, if you reboot once or twice it seems like sometimes the
program folder gets the appropriate write permissions, but then if you
click on the program icon, it starts the install and keeps going
through the install a few times until it finally states that you must
reboot. After reboot, and clicking on the icon, you get the same
install process in an endless loop, asking to reboot. If you click
cancel 5 to10 times, the application actually comes up and runs!! But
if you close it, the next time you open you go through the same
routine.

If I give the user local admin rights then the GPO and package work
perfectly! It seems when it's done this way, the application just
comes up when double-clicked, rather than going through another
install process. Unfortunately, we cannot give everyone local admin
rights.

So here are my questions to any GPO gurus:

1) Could this application be writing something to the registry?

2) Based on question 1, I actually thought that the package is being
installed using administrators rights since it is being assigned? And
if it shows to be installing during the login process, why does it
then install again when double-clicking the program icon?

3) How can I get this to work?? There must be a way.

Thanks,
Max

More about : gpo package assign permissions

Anonymous
November 23, 2004 3:29:19 PM

Archived from groups: microsoft.public.win2000.group_policy (More info?)

Your problems relate to software packaging and Windows Installer rather than
Group Policy. Take the GPO out of the loop and make sure your application
installs correctly and works when a _user_ logs on. I think your WinInstall
package is faulty.
Anthony




"Marv" <marv@mister.com> wrote in message
news:kck4q01be72dopnqdvsrll2gmct4b78t2q@4ax.com...
> Hello,
>
> I've been working on trying to get a certain application installed via
> GPO
> and can't seem to get it right.
>
> Basically, the manual way to get it working is as follows:
>
> 1) Install the application as administrator (uses standard window
> installer).
>
> 2) Set permissions on c:\program files\ngi to give user write
> permissions (we usually just give everyone write to this folder).
> Without these permissions, the user, not having local admin rights,
> cannot even open the application.
>
> So, using the old Veritas WinInstall LE, we created an .msi package,
> and then moved the entire folder structure to a share on a file server
> that gives full read rights to everyone. This all goes well, and when
> double-clicking on the .msi package (as administrator) the install
> goes through fine with no user intervention.
>
> Now the problem.
>
> We create a group policy that does the following:
>
> 1) Assigns the package via user (not computer) settings.
>
> 2) Make the login synchronous via a policy (don't remember the exact
> one off hand) so that the explorer interface waits for all scripts to
> run. This is done in user settings.
>
> 3) Give the directory c:\program files\ngi everyone write permissions
> via computer settings.
>
> Next we place both the computer account and user account in the OU
> that has this GPO applied.
>
> What happens is that after login by the user, you can see that the
> application is installing, then when the user gets to the desktop, the
> icon for the application is there, and the start menu shows that a new
> application is installed. When the user double clicks on the icon,
> then it goes through another install process and finally fails. It
> fails because of the fact that the user does not have local admin and
> the write permissions have not been assigned to the program directory
> (c:\program files\ngi).
>
> I've determined that the reason the policy could not assign the write
> permissios at this point, is because the directory did not exist.
>
> Anyway, if you reboot once or twice it seems like sometimes the
> program folder gets the appropriate write permissions, but then if you
> click on the program icon, it starts the install and keeps going
> through the install a few times until it finally states that you must
> reboot. After reboot, and clicking on the icon, you get the same
> install process in an endless loop, asking to reboot. If you click
> cancel 5 to10 times, the application actually comes up and runs!! But
> if you close it, the next time you open you go through the same
> routine.
>
> If I give the user local admin rights then the GPO and package work
> perfectly! It seems when it's done this way, the application just
> comes up when double-clicked, rather than going through another
> install process. Unfortunately, we cannot give everyone local admin
> rights.
>
> So here are my questions to any GPO gurus:
>
> 1) Could this application be writing something to the registry?
>
> 2) Based on question 1, I actually thought that the package is being
> installed using administrators rights since it is being assigned? And
> if it shows to be installing during the login process, why does it
> then install again when double-clicking the program icon?
>
> 3) How can I get this to work?? There must be a way.
>
> Thanks,
> Max
>
>
>
Anonymous
November 23, 2004 4:35:26 PM

Archived from groups: microsoft.public.win2000.group_policy (More info?)

Anthony,

Thanks for the suggestion, I will do some more testing.

The problem may be that the package WILL NOT install as a normal user.
However it WILL run as a normal user, if it was installed by an admin, and
the program files dir that it resides in is given write permissions for the
normal user.

So shouldn't the assigned package install with administrator rights?

Thanks,
Marv


"Anthony Yates" <anthonyDINGyates@airDONGdesk.com> wrote in message
news:eRnIQgV0EHA.2196@TK2MSFTNGP14.phx.gbl...
> Your problems relate to software packaging and Windows Installer rather
than
> Group Policy. Take the GPO out of the loop and make sure your application
> installs correctly and works when a _user_ logs on. I think your
WinInstall
> package is faulty.
> Anthony
>
>
>
>
> "Marv" <marv@mister.com> wrote in message
> news:kck4q01be72dopnqdvsrll2gmct4b78t2q@4ax.com...
> > Hello,
> >
> > I've been working on trying to get a certain application installed via
> > GPO
> > and can't seem to get it right.
> >
> > Basically, the manual way to get it working is as follows:
> >
> > 1) Install the application as administrator (uses standard window
> > installer).
> >
> > 2) Set permissions on c:\program files\ngi to give user write
> > permissions (we usually just give everyone write to this folder).
> > Without these permissions, the user, not having local admin rights,
> > cannot even open the application.
> >
> > So, using the old Veritas WinInstall LE, we created an .msi package,
> > and then moved the entire folder structure to a share on a file server
> > that gives full read rights to everyone. This all goes well, and when
> > double-clicking on the .msi package (as administrator) the install
> > goes through fine with no user intervention.
> >
> > Now the problem.
> >
> > We create a group policy that does the following:
> >
> > 1) Assigns the package via user (not computer) settings.
> >
> > 2) Make the login synchronous via a policy (don't remember the exact
> > one off hand) so that the explorer interface waits for all scripts to
> > run. This is done in user settings.
> >
> > 3) Give the directory c:\program files\ngi everyone write permissions
> > via computer settings.
> >
> > Next we place both the computer account and user account in the OU
> > that has this GPO applied.
> >
> > What happens is that after login by the user, you can see that the
> > application is installing, then when the user gets to the desktop, the
> > icon for the application is there, and the start menu shows that a new
> > application is installed. When the user double clicks on the icon,
> > then it goes through another install process and finally fails. It
> > fails because of the fact that the user does not have local admin and
> > the write permissions have not been assigned to the program directory
> > (c:\program files\ngi).
> >
> > I've determined that the reason the policy could not assign the write
> > permissios at this point, is because the directory did not exist.
> >
> > Anyway, if you reboot once or twice it seems like sometimes the
> > program folder gets the appropriate write permissions, but then if you
> > click on the program icon, it starts the install and keeps going
> > through the install a few times until it finally states that you must
> > reboot. After reboot, and clicking on the icon, you get the same
> > install process in an endless loop, asking to reboot. If you click
> > cancel 5 to10 times, the application actually comes up and runs!! But
> > if you close it, the next time you open you go through the same
> > routine.
> >
> > If I give the user local admin rights then the GPO and package work
> > perfectly! It seems when it's done this way, the application just
> > comes up when double-clicked, rather than going through another
> > install process. Unfortunately, we cannot give everyone local admin
> > rights.
> >
> > So here are my questions to any GPO gurus:
> >
> > 1) Could this application be writing something to the registry?
> >
> > 2) Based on question 1, I actually thought that the package is being
> > installed using administrators rights since it is being assigned? And
> > if it shows to be installing during the login process, why does it
> > then install again when double-clicking the program icon?
> >
> > 3) How can I get this to work?? There must be a way.
> >
> > Thanks,
> > Max
> >
> >
> >
>
>
Anonymous
November 23, 2004 5:00:01 PM

Archived from groups: microsoft.public.win2000.group_policy (More info?)

You can give Modify permissions to users on the installation directory with
a custom action in the package.
Anthony



"Marv" <marv@mister.com> wrote in message
news:y0Hod.23482$Rf1.19791@newssvr19.news.prodigy.com...
> Anthony,
>
> Thanks for the suggestion, I will do some more testing.
>
> The problem may be that the package WILL NOT install as a normal user.
> However it WILL run as a normal user, if it was installed by an admin, and
> the program files dir that it resides in is given write permissions for
the
> normal user.
>
> So shouldn't the assigned package install with administrator rights?
>
> Thanks,
> Marv
>
>
> "Anthony Yates" <anthonyDINGyates@airDONGdesk.com> wrote in message
> news:eRnIQgV0EHA.2196@TK2MSFTNGP14.phx.gbl...
> > Your problems relate to software packaging and Windows Installer rather
> than
> > Group Policy. Take the GPO out of the loop and make sure your
application
> > installs correctly and works when a _user_ logs on. I think your
> WinInstall
> > package is faulty.
> > Anthony
> >
> >
> >
> >
> > "Marv" <marv@mister.com> wrote in message
> > news:kck4q01be72dopnqdvsrll2gmct4b78t2q@4ax.com...
> > > Hello,
> > >
> > > I've been working on trying to get a certain application installed via
> > > GPO
> > > and can't seem to get it right.
> > >
> > > Basically, the manual way to get it working is as follows:
> > >
> > > 1) Install the application as administrator (uses standard window
> > > installer).
> > >
> > > 2) Set permissions on c:\program files\ngi to give user write
> > > permissions (we usually just give everyone write to this folder).
> > > Without these permissions, the user, not having local admin rights,
> > > cannot even open the application.
> > >
> > > So, using the old Veritas WinInstall LE, we created an .msi package,
> > > and then moved the entire folder structure to a share on a file server
> > > that gives full read rights to everyone. This all goes well, and when
> > > double-clicking on the .msi package (as administrator) the install
> > > goes through fine with no user intervention.
> > >
> > > Now the problem.
> > >
> > > We create a group policy that does the following:
> > >
> > > 1) Assigns the package via user (not computer) settings.
> > >
> > > 2) Make the login synchronous via a policy (don't remember the exact
> > > one off hand) so that the explorer interface waits for all scripts to
> > > run. This is done in user settings.
> > >
> > > 3) Give the directory c:\program files\ngi everyone write permissions
> > > via computer settings.
> > >
> > > Next we place both the computer account and user account in the OU
> > > that has this GPO applied.
> > >
> > > What happens is that after login by the user, you can see that the
> > > application is installing, then when the user gets to the desktop, the
> > > icon for the application is there, and the start menu shows that a new
> > > application is installed. When the user double clicks on the icon,
> > > then it goes through another install process and finally fails. It
> > > fails because of the fact that the user does not have local admin and
> > > the write permissions have not been assigned to the program directory
> > > (c:\program files\ngi).
> > >
> > > I've determined that the reason the policy could not assign the write
> > > permissios at this point, is because the directory did not exist.
> > >
> > > Anyway, if you reboot once or twice it seems like sometimes the
> > > program folder gets the appropriate write permissions, but then if you
> > > click on the program icon, it starts the install and keeps going
> > > through the install a few times until it finally states that you must
> > > reboot. After reboot, and clicking on the icon, you get the same
> > > install process in an endless loop, asking to reboot. If you click
> > > cancel 5 to10 times, the application actually comes up and runs!! But
> > > if you close it, the next time you open you go through the same
> > > routine.
> > >
> > > If I give the user local admin rights then the GPO and package work
> > > perfectly! It seems when it's done this way, the application just
> > > comes up when double-clicked, rather than going through another
> > > install process. Unfortunately, we cannot give everyone local admin
> > > rights.
> > >
> > > So here are my questions to any GPO gurus:
> > >
> > > 1) Could this application be writing something to the registry?
> > >
> > > 2) Based on question 1, I actually thought that the package is being
> > > installed using administrators rights since it is being assigned? And
> > > if it shows to be installing during the login process, why does it
> > > then install again when double-clicking the program icon?
> > >
> > > 3) How can I get this to work?? There must be a way.
> > >
> > > Thanks,
> > > Max
> > >
> > >
> > >
> >
> >
>
>
!