Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to deploy software on our domain using group policy, but I am only able to do so if the user is a member of a group with administrative privileges. We do not want to allow users to install programs generally, but do want to be able to assign/publish.

The test program I'm using is originally a .msi file, and it installs fine for users in the administrators group. How can we assign/publish to normal users without opening up the ability to install whatever?

Also, from what I've read, I believe I have correct permissions on the folder/share where the .msi files are stored. This is on Win2008R2 with Win7Pro clients.

share|improve this question

2 Answers 2

up vote 1 down vote accepted

User-level GPO installation uses the users' privileges as its own. So, if a user is not an administrator on the machine, Group Policy is not able to install the software and will fail silently.

Now, with that said, Computer Policies DO run in an administrator context. If you want to install software on a workstation without administrator interaction, you need to assign it as a Computer policy. The caveat is that a software installation assigned to a computer-level policy will only run at startup, so a reboot event will be required.

There are other ways of getting around this (e.g. third party tools like SCCM, software deployment using a logon script that has impersonation credentials), but these either require $$ or some work on your end (and maybe a security risk or two)...

share|improve this answer
    
Thanks, that answers my question directly. I think for most of our needs, computer policies will be adequate. For other cases, I guess I'll do some scripting. –  labyrinth Nov 22 '11 at 1:38

You can't as far as I know. Either the user can or cannot install applications. GPOs can't change that

If you want to install an application to a pc you will have to install it as a user with privs. This means applying the policy to the machine and not the user.

Anyone know of a way around this?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.