Elevated privilege for software install with GPO

[klh456]

Here is the scenario:

I need to modify the c:\windows\system32\drivers\etc\services file and copy a new ini file into c:\windows. One of our developers has created an MSI file to do both of these things. I have created a User/Software/Installation GPO for this.

I am now trying to deploy using Group Policy. I have found that it works perfectly if the user is an ADMIN on their box (not many of these). I believe it has to be a User GPO because I have to install 2 different versions. One is for a group called Key Users and the other is for everyone else. I am using Delegation to prevent installation to one or the other. So, I actually have 2 policies for this.

My question, how can I deploy this using the local admin account?

 

[markdmac]

There is a GPO setting called "Always Run with Elevated Priviledges"

I hope you find this post helpful.

Regards,

Mark

 

[Seaspray0]

If elevating the priviledges doesn't help (it should solve your problem) you can use these troubleshooting tools:


You can use Group Policy to enable logging for Windows Installer by using the Logging policy setting in the Computer Configuration\Administrative Templates\Windows Components\Windows Installer node of Group Policy Object Editor.

You can use the Software Installation Diagnostics tool (addiag.exe) to gather additional diagnostic information. You can run addiag.exe /? from a command prompt for information about the syntax.

A+/MCP/MCSE/MCDBA

 

[klh456]

Thanks.

Elevating the privileges didn't help. Here are the error messages I get:

The install of application SAP Router Removal Update for Key Users from policy NH SAP KEY failed. The error was : The installation source for this product is not available. Verify that the source exists and that you can access it.

I am now trying to install it by a Computer Assigned software but that is not working either. I'm beginning to think it is something in the code.

 

[markdmac]

Sounds like you may be referencing a file without using a UNC path.

I hope you find this post helpful.

Regards,

Mark

 

[klh456]

Mark

I am definitely referencing it using a UNC path....

Thanks

 

[markdmac]

OK, then be sure your users have NTFS rights to the files and rights to the share.

I hope you find this post helpful.

Regards,

Mark

 

[klh456]

Mark

Thanks.

I have finally been successful by using a Computer Policy instead of User. This causes a little more work because I then need to use the logon script to copy the correct ini file for the user based on a group.

It works but some computers will not install it properly. I'm using the RSOP and Event viewer to try to determine why it is not working on these machines. So far nothing is jumping out.

The message I get is Event ID 102: The install of application SAP Router Removal Update for Regular Users from policy SAP COMPUTER failed. The error was : Fatal error during installation.

Obviously doesn't say much. I cannot see anything different in the RSOP that should cause this. Any ideas?

 

[markdmac]

Instead of copying an ini file, how about editing it with script?

I hope you find this post helpful.

Regards,

Mark

 

[klh456]

Thanks

I found the problem on these machines. They do not have Net Framework installed. So now that I have the problem I am trying to find the fix. My developer is now checking for Net Framework, but we haven't been able to get the msi to install. I'm assuming it is stopping at the point where it displays the EULA and needs acceptance. Is there a way to pass that acceptance through so that it will install silently? Right now I am so close....

Thanks again for all you helpful info.