Flash Install needs Administrator Rights

[Scot Welker]

Now that I'm tired of banging my head against the wall, I wanted to
post this question:

I am trying to allow users to install Macromedia Flash on their local
workstation. Our Group Policies give users non admin rights but I
have made the users both Domain Admins and Administrator rights from
AD without effect on the install. It still tells me I have to be an
admin user to install the software. Do I actually have to physically
add these people at the workstation to be administrative users on the
domain? I tried adding them at the computer level in AD with
administrative rights...again no effect. I thought by making them an
administrative user at the server level would allow them admin rights
to the workstation. I'd rather not have to walk around to every user
and hear about the latest story about their kids. Can I not handle
this on a server level or am I screwed?

Thanks in advance

 

[Oli Restorick [MVP]]

Hi

Placing the user in the administrators group on the DC will make them an
administrators of the DCs for that domain. Placing them in the Domain
Admins group will make the users administrators of their workstations
provided the computers are in the same domain, although doing that is the
craziest thing I've ever heard.

When you say you Group Policies give users non-admin rights, what do you
mean? The default settings don't give users admin rights, so what did you
change? Which GPO settings have you touched? What's the exact error
message you get?

The restricted groups feature allows you to replace the membership of the
local administrators group on the PCs with members of your choice. However,
beware. It will remove anyone who's already present in the local
administrators group and, if you apply it to the wrong OU, you can make a
real mess.

Since you're contemplating walking around yourself, it sounds like you are
probably too small a company to consider some sort of systems management
solution (like Microsoft Systems Management Server), but this is a solution.

If the Flash installer was an MSI file, it would take two seconds to deploy
using a GPO.

Hope this helps

Oli

 

[Lanwench [MVP - Exchange]]

In addition to Oli's sage reply - I haven't seen this with Macromedia, but I
have often run into software that wants to be installed as "administrator"
itself - the local admin account. Have you tried copying the install files
to the local workstation, logging in as local admin, and installing?

Agree that putting users in the domain admins group is dangerous even for a
wee test.

 

[Cary Shultz [A.D. MVP]]

Lanwench,

It is true with Flash. It will install so far ( that nice little blue line
will go from left to right only so far ) and then you receive an error in a
nice little box stating that access to some path was denied....

Cary

"Lanwench [MVP - Exchange]"

 

[Lanwench [MVP - Exchange]]

OK - noted. I've seen this with plenty of other apps as well...silly
developers! Did I mention that I detest flash?

Once you install it, you're at the mercy of flash popups/ads and I have yet
to figure out how to block them. Arrrrgh.

Lanwench,

It is true with Flash. It will install so far ( that nice little
blue line will go from left to right only so far ) and then you
receive an error in a nice little box stating that access to some
path was denied....

Cary

"Lanwench [MVP - Exchange]"

In addition to Oli's sage reply - I haven't seen this with
Macromedia, but I have often run into software that wants to be
installed as "administrator" itself - the local admin account. Have
you tried copying the install files to the local workstation,
logging in as local admin, and installing?

Agree that putting users in the domain admins group is dangerous
even for a wee test.

 

[Andy Cadley]

Yes, Developers are the second worst thing System Administrators have to
deal with (the first being Users, of course!)

For what it's worth you can get a deployable MSI for Flash and Shockwave
from Macromedia's site somewhere (I haven't done it in a while). You have to
sign up I think but it's easier than mucking around with the end-user
installer.

AndyC

"Lanwench [MVP - Exchange]"

OK - noted. I've seen this with plenty of other apps as well...silly
developers! Did I mention that I detest flash?

Once you install it, you're at the mercy of flash popups/ads and I have yet
to figure out how to block them. Arrrrgh.

Lanwench,

It is true with Flash. It will install so far ( that nice little
blue line will go from left to right only so far ) and then you
receive an error in a nice little box stating that access to some
path was denied....

Cary

"Lanwench [MVP - Exchange]"

In addition to Oli's sage reply - I haven't seen this with
Macromedia, but I have often run into software that wants to be
installed as "administrator" itself - the local admin account. Have
you tried copying the install files to the local workstation,
logging in as local admin, and installing?

Agree that putting users in the domain admins group is dangerous
even for a wee test.

Scot Welker wrote:
Now that I'm tired of banging my head against the wall, I wanted to
post this question:

I am trying to allow users to install Macromedia Flash on their
local workstation. Our Group Policies give users non admin rights
but I have made the users both Domain Admins and Administrator
rights from AD without effect on the install. It still tells me I
have to be an admin user to install the software. Do I actually
have to physically add these people at the workstation to be
administrative users on the domain? I tried adding them at the
computer level in AD with administrative rights...again no effect.
I thought by making them an administrative user at the server level
would allow them admin rights to the workstation. I'd rather not
have to walk around to every user and hear about the latest story
about their kids. Can I not handle this on a server level or am I
screwed?

Thanks in advance

 

[Matt]

WOAH WOAH WOAH! Don't go blaming the developers! This is a microsoft
issue.
If microsoft would A) make active directory work correctly
(ie... have you ever actually tried disabling access to the command
prompt? There are about 1 zillion ways to get to it if you know what
you're doing - even a batch file or an exe that shells out to command.com!)

B) get their file permissions straight.

Users should
A) be able to install things in their home directory.. without needing
to write to global registry keys! that's just bad! Why can't I install
software as a user and have all the settings go in local reg keys? huh? huh?
B) not be able to affect system files or write to C:\ by default!

 

[Lanwench [MVP - Exchange]]

WOAH WOAH WOAH! Don't go blaming the developers! This is a
microsoft issue.

It's not a microsoft issue if the software developer doesn't allow an
admin-equivalent user (whether local or domain) to install software.

If microsoft would A) make active directory work correctly
(ie... have you ever actually tried disabling access to the command
prompt? There are about 1 zillion ways to get to it if you know what
you're doing - even a batch file or an exe that shells out to
command.com!)

B) get their file permissions straight.

Users should
A) be able to install things in their home directory.. without needing
to write to global registry keys! that's just bad! Why can't I
install software as a user and have all the settings go in local reg
keys? huh? huh? B) not be able to affect system files or write to C:\
by default!

I don't want users installing software, period. But that's just me.

OK - noted. I've seen this with plenty of other apps as well...silly
developers! Did I mention that I detest flash?

Once you install it, you're at the mercy of flash popups/ads and I
have yet to figure out how to block them. Arrrrgh.

Lanwench,

It is true with Flash. It will install so far ( that nice little
blue line will go from left to right only so far ) and then you
receive an error in a nice little box stating that access to some
path was denied....

Cary

"Lanwench [MVP - Exchange]"
message
In addition to Oli's sage reply - I haven't seen this with
Macromedia, but I have often run into software that wants to be
installed as "administrator" itself - the local admin account. Have
you tried copying the install files to the local workstation,
logging in as local admin, and installing?

Agree that putting users in the domain admins group is dangerous
even for a wee test.

Scot Welker wrote:

Now that I'm tired of banging my head against the wall, I wanted
to post this question:

I am trying to allow users to install Macromedia Flash on their
local workstation. Our Group Policies give users non admin rights
but I have made the users both Domain Admins and Administrator
rights from AD without effect on the install. It still tells me I
have to be an admin user to install the software. Do I actually
have to physically add these people at the workstation to be
administrative users on the domain? I tried adding them at the
computer level in AD with administrative rights...again no effect.
I thought by making them an administrative user at the server
level would allow them admin rights to the workstation. I'd
rather not have to walk around to every user and hear about the
latest story about their kids. Can I not handle this on a server
level or am I screwed?

Thanks in advance