[gptalk] Re: Permissions for software installation

  • From: "Andrew McHale" <Andrew.McHale@xxxxxxxxxxxxxx>
  • To: <gptalk@xxxxxxxxxxxxx>
  • Date: Tue, 5 Aug 2008 10:45:20 +0100

Hi all,

 

Thanks for the pointer.

 

It was a per-computer GPO (sorry for missing this out in my original
post) and I didn't even think about adding Domain Computers instead of
Everyone. Interestingly, the Authenticated Users group has no rights on
this folder which could add to the fact it wouldn't run.

 

I used a full computer path, not an IP, so this wasn't the issue, but
thanks for the suggestion.

 

What I still don't understand though, is why the Java installation would
work fine but the Acrobat one wouldn't. They are both per-computer GPO's
and have files in the same folder structure with exactly the same
permissions. The only differences are the Acrobat install uses a
Transform file and the GPO has the User Configuration Settings disabled,
where as the Java GPO doesn't.

 

Any idea's or should I just chalk this up to 'one of those things'?

 

Many thanks

 

Andrew

 

 

From: Nelson, Jamie [mailto:Jamie.Nelson@xxxxxxx] 
Sent: 04 August 2008 23:58
To: gptalk@xxxxxxxxxxxxx
Subject: [gptalk] Re: Permissions for software installation

 

Don't know why you would use an IP, but in this case it shouldn't make a
difference. It usually comes down to permissions.

 

From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx]
On Behalf Of Greg
Sent: Monday, August 04, 2008 5:50 PM
To: gptalk@xxxxxxxxxxxxx
Subject: [gptalk] Re: Permissions for software installation

 

When you set up the deployment, did you point it to an IP address or a
server name?  I had this issue once in the past when I used an ip
address and found out it will cause you to get access denied.

 

        ----- Original Message ----- 

        From: Nelson, Jamie <mailto:Jamie.Nelson@xxxxxxx>  

        To: gptalk@xxxxxxxxxxxxx 

        Sent: Monday, August 04, 2008 1:29 PM

        Subject: [gptalk] Re: Permissions for software installation

         

        Yep, I've always made it a point to grant explicit rights to
Domain Computers if it is a per-computer assigned installation.

         

        From: gptalk-bounce@xxxxxxxxxxxxx
[mailto:gptalk-bounce@xxxxxxxxxxxxx] On Behalf Of Darren Mar-Elia
        Sent: Monday, August 04, 2008 11:41 AM
        To: gptalk@xxxxxxxxxxxxx
        Subject: [gptalk] Re: Permissions for software installation

         

        Andrew-

        Was this a per-computer deployment? If so, then the installation
happens in the context of the machine's domain account. In the past I've
noticed that Authenticated Users was not sufficient to solve this
problem, even though it should have been. I'm not clear why this is, but
perhaps setting up some auditing on the server sided would have pointed
the way. What I've seen, as a solution, is to grant either Domain
Computers or Everyone explicit access to the files. 

         

        Darren

         

        From: gptalk-bounce@xxxxxxxxxxxxx
[mailto:gptalk-bounce@xxxxxxxxxxxxx] On Behalf Of Andrew McHale
        Sent: Monday, August 04, 2008 9:33 AM
        To: gptalk@xxxxxxxxxxxxx
        Subject: [gptalk] Permissions for software installation

         

        Hi all,

         

        I've just created a GPO for deploying Acrobat 9 using the
standard policy software installation (not GPP) and added a transform
file to get around things like desktop shortcuts and EULA agreements.

         

        However, when I came to deploy it I got errors about not being
able to access the files.

         

        On Friday I also created a GPO to deploy Java. This had exactly
the same access rights as the Acrobat files but worked first time.

         

        I managed to get the Acrobat installation to work by giving
'Everyone' read, list and execute permissions to the folder containing
the files but am confused as to why I had to do this.

         

        I thought the software installation used elevated privileges to
install software? Can anyone explain to me (to help my GP understanding)
why this is the case? In case you need to know, our environment is 100%
Server 2003 SP2 and I was deploying to a XP SP3 machine.

         

        Thanks

         

        Andrew

        
________________________________


        Confidentiality Warning: This message and any attachments are
intended only for the use of the intended recipient(s), are
confidential, and may be privileged. If you are not the intended
recipient, you are hereby notified that any review, retransmission,
conversion to hard copy, copying, circulation or other use of all or any
portion of this message and any attachments is strictly prohibited. If
you are not the intended recipient, please notify the sender immediately
by return e-mail, and delete this message and any attachments from your
system. 

Other related posts: