rights to install msi packages

  • Thread starter Thread starter Andy Svendsen
  • Start date Start date
A

Andy Svendsen

Is there any easy way to create msi applications from Component Services so
non-administrative users can install them? I'd like to distribute a msi
package to users who don't have local admin rights on their workstations.
 
All users have access to thier user profile folder and HKEY_CURRENT_USER
sections of the registry. You can author the package to perform a per-user
installation.

Or as an administrator you can allow the Window installer alone to run in
elevated privileges (under Local System Account).

To enable elevated privileges by policy (Windows 2000)
1. On the Start menu, point to Programs, point to Administrative Tools, and
then click Active Directory Users and Computers.
2. In the console tree, right-click the domain or organizational unit for
which you want to set the policy.
3. Click Properties, and then click the Group Policy tab.
4. Select a Group Policy Object in the Group Policy Objects Links box and
click Edit.
5. Open the Local Computer Policy\Administrative Templates\Windows Installer
folder.
6. In the details pane, double-click the Always install with elevated
privileges policy.
7. In the Group Policy Property dialog box, enable the policy, select the
check box to turn the setting on, and then click OK.
8. Open the User Configuration\Administrative Templates\Windows Installer
folder and repeat Steps 6 and 7.
Under Windows NT 4.0, you can use the System Policy Editor and Windows
Installer policy template file (Instlr11.adm) to set the Always install with
elevated privileges policy. You must set the policy for the computer and for
each user. For more information about setting system policies in Office XP,
see Understanding System Policies.

If you choose not to use the Group Policy Editor or the System Policy
Editor, you can specify the same setting on each computer by changing a
value in the Windows registry.
To enable elevated privileges in the Windows registry
1. On the Start menu, click Run and type regedit to open the Registry
Editor.
2. Find or add the following subkey in the Windows registry:
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer
3. In the Installer subkey, insert AlwaysInstallElevated as a REG_DWORD and
its value to 1.
4. Find or add the following subkey in the Windows registry:
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Installer
5. In the Installer subkey, insert AlwaysInstallElevated as a REG_DWORD and
its value to 1.
6. Repeat Steps 5 and 6 for each user of the computer.


This would let the users install applications even if they do not have
administrative privileges.
 
Don't forget that enabling AlwaysInstallElevated would also allow viruses
and trojans to install themselves with administrator privileges, without the
user even knowing about it. AlwaysInstallElevated is a SERIOUS security
risk, so no system administrator worth his salt would enable it.

Regards,
Aaron Queenan.
 
Back
Top