3

We've got a new 2012 Server that a company needs to remotely install software on. Their user is a local administrator but cannot install software to the server. I'd rather not give them domain admin access.

The local administrator account is able to do so without problems. I'm trying to figure out what is preventing the installation. It specifically complains that there's no access to C:\Program Files, however the permissions are identical.

gpresult /v shows that the Local Administrator has some "Security Privileges" that the user account doesn't, however the local security policies show those rights explicitly assigned to the local admin group but they don't show in gpresult for their user.

It seems as though I'm missing some fundamental knowledge here.

Thanks for your advice.

4

I blame UAC!

In a default install, the local admin account is exempt from UAC elevation requirements, while administrator accounts via group membership aren't.

Try launching the installer with admin permissions

runas

or temporarily disable UAC on the system completely, and see if that helps.

  • I disabled UAC and tried, but it made no difference. It definitely appears that the Local Admin account is getting special treatment though. – s-twig Nov 7 '14 at 6:10
  • I'll also mention, the installer is an MSI package and has no "Run as administrator" option. – s-twig Nov 7 '14 at 6:13
  • So, turns out you're correct. I had to disable UAC through the registry. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\EnableLUA Not sure if that requirement is due to a deficiency in the MSI or something else. Thanks! :) – s-twig Nov 10 '14 at 2:15
0

Some times the files have a "unlock" option if came from internet or another device, just click on file properties and click "unlock" option.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.