What rights for installing apps via Group Policy?

[outonalimb]

As a test, I am trying to install AdminPak.msi to a Windows XP Pro machine using Group Policy.

I have created a user, put them in an OU and linked a GP to the OU. I created a share on the server called APPS, put AdminPak.msi in this share and assigned the AdminPak.msi application.

When I log on to the XP Pro machine, AdminPak doesn't get installed. It appears in Add/Remove Programs but not on the Programs menu. The user is a member of the Domain Users group at this point.

If I make the user a member of the Domain Admins group, AdminPak gets installed.

My question is, what rights does a user need to have for an application to be installed on a PC via Group Policy? If I want to install Office 2003 for example, do all my users need to be in the Domain Admins group to get Office installed?

Any guidance on this would be really helpful.

 

[TheLad]

If you say that it gets put into Add/Remove, are you sure that it is not your GP settings that are removing it from the Start Menu? Do you have any GP settings that relate to the content of the Start Menu?

--------------------------------------
"Insert funny comment in here!"
--------------------------------------

 

[outonalimb]

Don't think so. Once the user has Domain Admin rights, the tools appear on the Start menu.

Any further advice?

 

[Dublin73]

personally I think it's best to avoid installing apps by user, as it can introduce a lot of problems, particularly when trying to remove the apps. Having said that, if you're still going down the user route...

Have you tried enabling "Always install with elevated privileges" here...

User Configuration\Administrative Templates\Windows Components\Windows Installer

 

[TheLad]

Your AdminPak is obviously getting installed for the standard users otherwise it would not appear in Add/Remove. You need to examine your group policies further because it does sound like some policy setting is affecting what the user sees on the Start Menu.

Adding the users to Domain Admins is very extreme and you have to bear in mind that members of Domain Admins are usually excluded from having Group Policies applied (if this is how it has been configured) so that may be a reason why the tools can be seen on the Start Menu when the users have the elevated rights.

As it is the Admin Pak you are installing, what are you expecting to see on the Start Menu?

--------------------------------------
"Insert funny comment in here!"
--------------------------------------

 

[ForumKB]

Installing via a GPO should give the user the required privelages, changing . . .

User Configuration\Administrative Templates\Windows Components\Windows Installer

will mean your users can install anything they want

Are you publishing or advertising the app? If it is advertised it will appear in add remove program and the user can install it from there if they want to but it won't appear in the start menu, if you publish the app it should automatically install (the msi needs to be on a network share that the user has access to, e.g. netlogon folder


Adrian Paris

Paris Engineering Ltd

http://www.ForumKB.com

Google search of just tech forums & articles
(very useful, honest!)

 

[outonalimb]

I'm still having the problem. I cannot get the Adminpak.msi installed while the user is part of the Domain Users group. As soon as the user is made part of the Domain Admins group, it installs once I press CTRL-ALT-DEL. It appears on the Programs menu and I see all the W2k3 tools.

I have tried the changing:

User Configuration\Administrative Templates\Windows Components\Windows Installer

but this doesn't help either.

Any more advice...?

 

[ForumKB]

Hi, did get it the wrong way around, if it is published it will appear in the add / remove programs, if it is assigned it will install itself . . .

do the standard users definatley have full access to the share where adminpak.msi is?


Adrian Paris

Paris Engineering Ltd

http://www.ForumKB.com

Google search of just tech forums & articles
(very useful, honest!)

 

[markdmac]

There are a number of things for you to check.

First verify the rights to the GPO. Do users have read access to the policy?

By default the local machine will hide Administrative Tools from Non Admins. Have you changed that behavior?

If you install the applications from the computer section of the GPO, then the application will be installed upon a reboot independent of the users. Are you using a transform for the MSI?

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.