Using a GPO I've tried to deploy (in this case) Chrome to a series of locked down workstations with limited usage. This is on a server 2008 R2 installation, with the clients running Windows 7 Professional.
So, what I've done is:
- Setup a shared folder where the users in question only have read rights on the files (MSI-files), but not on the directory.
- Created a GPO where I assign the MSI-file in question. Updated: It's within the computer configuration, with "Install application at login" activated.
- Certain other GPOs are affecting the rights and settings affecting the users rights.
- Windows Installer is set to be disabled, except for managed applications.
- The two applications called "cmd.exe" and "setup.exe" are also disabled. (Not sure why the latter is - users don't have write rights anyhow).
- Executables that aren't in %PROGRAMFILES% or %WINDIR% aren't allowed to run with path rules enforcing this.
- The setting for always installing with elevated rights is enabled.
Whenever I logon onto a domain workstation, nothing happens application-wise. I've tried publishing the application, and it does show up in "Add/remove applications".
Within the application-section of the event logs, there's an error for application GPO with the error code %%1603 (I think, I'll double check.) As far as I'm aware, that's an error code for a "fatal installation" when it comes to Windows Installer. Sadly, I haven't found this to be a very descriptive error code.
I am of the belief that it's related to rights, as I can install it with my network admin user - from "Add/remove applications" - but not with my "restricted" user. The installation completes and Chrome is available for all users, but I'd rather not do this on every workstation. However, it won't automatically install at login regardless of which user.
Now I'm at a standstill and my Google-fu has not aided me further in finding the cause for my havoc.
More information: It is the standalone version of Chrome from their enterprise page.