Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are using a Samba "Domain" to manage our PC's (all our XP). We are just rolling out McAfee ePO - this needs to install the framepkg.exe on every machine and then update whatever version of McAfee AV that is present to he latest.

However we have the "Disable Windows Installer - Always" group policy set. Since framepkg.exe and the McAfee push updater uses the windows installer it won't install.

Is there anyway to sign/bless certain applications so that they will bypass this GP setting?

share|improve this question
up vote 2 down vote accepted

I'm not so sure that this setting is wise. Windows installer is used for much more than just installations; for example, it also provides (some) patching, application self-healing, and a few other things. The setting will also not be effective for any package that doesn't use MSI for installing. As you've discovered, it also interferes with any GPO-based or other admin-triggered installations you might wish to do. In a nutshell, you're shooting yourself in the foot with it.

If your objective in enabling this setting was to lock down PCs, you would be better off just not giving users Admin rights and perhaps implementing some software Restriction Policies. Remember - security is about letting the good guys in as well as keeping the bad guys out.

share|improve this answer

AFAIK this policy setting completely disables Windows Installer. Microsoft's own updates that are MSI-based won't even install when this setting is configured for "Always" (see

I'd turn off the setting temporarily, perform the installation, and then turn it back on.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.