Using a GPO I've tried to deploy (in this case) Chrome to a series of locked down workstations with limited usage. This is on a server 2008 R2 installation, with the clients running Windows 7 Professional.

So, what I've done is:

  1. Setup a shared folder where the users in question only have read rights on the files (MSI-files), but not on the directory.
  2. Created a GPO where I assign the MSI-file in question. Updated: It's within the computer configuration, with "Install application at login" activated.


  • Certain other GPOs are affecting the rights and settings affecting the users rights.
  • Windows Installer is set to be disabled, except for managed applications.
  • The two applications called "cmd.exe" and "setup.exe" are also disabled. (Not sure why the latter is - users don't have write rights anyhow).
  • Executables that aren't in %PROGRAMFILES% or %WINDIR% aren't allowed to run with path rules enforcing this.
  • The setting for always installing with elevated rights is enabled.

Whenever I logon onto a domain workstation, nothing happens application-wise. I've tried publishing the application, and it does show up in "Add/remove applications".

Within the application-section of the event logs, there's an error for application GPO with the error code %%1603 (I think, I'll double check.) As far as I'm aware, that's an error code for a "fatal installation" when it comes to Windows Installer. Sadly, I haven't found this to be a very descriptive error code.

I am of the belief that it's related to rights, as I can install it with my network admin user - from "Add/remove applications" - but not with my "restricted" user. The installation completes and Chrome is available for all users, but I'd rather not do this on every workstation. However, it won't automatically install at login regardless of which user.

Now I'm at a standstill and my Google-fu has not aided me further in finding the cause for my havoc.

More information: It is the standalone version of Chrome from their enterprise page.

  • Did you assign the application in the computer or user portion of the GPO? – Zoredache Jan 18 '12 at 16:28
  • @Zoredache: It was assigned in the computer configuration, assigned and with "Install this application at login" enabled. – Thor Jan 18 '12 at 17:15

Did you use the standalone version? (the one that installs to c:\program files\ rather than to an indivdual user's profile)

I believe this link should have the standalone version in .msi format https://www.google.com/chrome/eula.html?msi=true

  • Yup, it's ChromeStandaloneEnterprise.msi that I'm using. Updating original post with that information. I got it from their "Chrome for enterprise" site. Thanks for the reply! – Thor Jan 18 '12 at 17:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.