Admins cannot install software when PC is in one OU but can in another??!!

[Chris Pratt]

Sorry for the long subject!!

When a computer is in our restrictive OU (with a nice and tight GP), if an
admin logs in (Domain Admin or Local Admin) and try to run an MSI - it pops
up with "The administrator has set policies to prevent this"!!

But when the PC is moved into an OU with a zero restrictive OU it can have
MSI's installed and settings changed.

I have checked the security on the GP and Admins do not have it applied.
PLEASE HELP!! I don't want to have to move the PC's into a different OU
everytime I want to make a setting change.

Thanks in advance

Chris Pratt - MCP

 

[Tim Hines [MSFT]]

Take a look at the group policies that are applied to that OU and check the
following location

Local Computer Policy\Computer configuration\Administrative
templates\windows components\window installer

do you have anything set there?


--
Tim Hines, MCSE, MCSA
Windows 2000 Directory Services

=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Jimmy Andersson]

Take a look at inheritance on the GPO security. You can set Deny for the
Admin group and the GPO won't apply to admins.
In order for a GPO to affect objects, the objects must have both Read and
Apply permissions.

Regards,
/Jimmy

 

[Chris Pratt]

Thanks for replying Jimmy, but as i stated the security is set to stop it
applying to admins.

Thanks

Chris

 

[Chris Pratt]

I'll check this when i get to work on Tuesday. If it is set to disable -
stopping installer (which is what we want to stop students installing
software) then how do we ensure admins can install but not normal users?

Thanks

Chris