Office XP through GPO Software deployment policy

[dandl]

Not quite sure if this should be in windows 2000 server or win xp desktop support. so sorry if in wrong area.

Here is the problem..
We have a gpo in place and it is working for our win2000 desktops installs the software not a problem,
Recently however we have purchased our first batch of xp pro machines.
They are on the domain and have the correct user rights but when it tries to install any of the applications from office xp it stops with the error
"In order to install office, you must either be an administrator or have Office approved by an administrator"
if we log on to the machine with an account that has administrator rights it installs ok but clearly that is not an option (giving users admin rights!)
I have search the and can find one microsoft work around, to use the "run as" from the local machine. These defeats the object of trying to install it using gpo's.

Any help would be greatly apprieciated before my senior and I do our selves some damage hitting our heads against a brick wall!

Thanks
Lee

 

[markdmac]

I would double check how you have your GPO set up. Take a look at my FAQ faq96-4996 on the subject.

I hope you find this post helpful. Please let me know if it was.

Regards,

Mark

 

[dandl]

Hi Mark,

We are just going through the gpo setup again, will let you know if it is that

Thanks
Lee

 

[dandl]

We have sort of narrowed this down to a permissions on the user account but still working on it.
The users that have the problem are not a member of Users although everyone is a member of domain user which should give them the rights.

If anyone has any Ideas or clarification on this issue please let me know

Thanks
Lee

 

[ITPangaeaArchitect]

sounds like you are assigning it to users...which runs under the context of the user logging on

you need to assign it sto computers instead so it applies to the machine using the system account instead.

that will resolve your issue

-Brandon Wilson
MCSE00/03, MCSA:Messaging, MCSA03, A+
almost got a paragraph there

 

[dandl]

The users have roaming profiles and often swap desks. some users have different software packages and we need to restrict these because of licensing.
If I apply them to the machine using the system account then it will be on the machine for everyone. is that correct?

Thanks for your help
Lee

 

[ITPangaeaArchitect]

well yes and no. You still have a certain amoutn of control over the policy. All you need to do is make a security group for the computer accounts they all use, and then give teh read and apply group policy perm to that particular group of computers.

-Brandon Wilson
MCSE00/03, MCSA:Messaging, MCSA03, A+
almost got a paragraph there

 

[ITPangaeaArchitect]

yes your licensing could be a problem.

what kind of install is it? proprietary app or well known? is it installed with a .msi?

-Brandon Wilson
MCSE00/03, MCSA:Messaging, MCSA03, A+
almost got a paragraph there

 

[dandl]

Yes it is MS product with a .msi
So if I understand you correctly.
You are saying apply the software to the machine policy but only give the relevant users permision to use it??

Thanks for you help.

Lee

 

[markdmac]

If applied to the machine policy (which is the corect place to do it) the software will get installed on each machine in that OU. You will need to lock down the NTFS permissions to prevent users from accessing the software. You could also use custom Start Menus through the Folder Redirection policy to prevent them from seeing the icons.

I hope you find this post helpful. Please let me know if it was.

Regards,

Mark