0

We are using a Samba "Domain" to manage our PC's (all our XP). We are just rolling out McAfee ePO - this needs to install the framepkg.exe on every machine and then update whatever version of McAfee AV that is present to he latest.

However we have the "Disable Windows Installer - Always" group policy set. Since framepkg.exe and the McAfee push updater uses the windows installer it won't install.

Is there anyway to sign/bless certain applications so that they will bypass this GP setting?

2 Answers 2

2

I'm not so sure that this setting is wise. Windows installer is used for much more than just installations; for example, it also provides (some) patching, application self-healing, and a few other things. The setting will also not be effective for any package that doesn't use MSI for installing. As you've discovered, it also interferes with any GPO-based or other admin-triggered installations you might wish to do. In a nutshell, you're shooting yourself in the foot with it.

If your objective in enabling this setting was to lock down PCs, you would be better off just not giving users Admin rights and perhaps implementing some software Restriction Policies. Remember - security is about letting the good guys in as well as keeping the bad guys out.

1

AFAIK this policy setting completely disables Windows Installer. Microsoft's own updates that are MSI-based won't even install when this setting is configured for "Always" (see http://support.microsoft.com/kb/278295).

I'd turn off the setting temporarily, perform the installation, and then turn it back on.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .