The system administrator has set policies to prevent this ..

This looks as though you have a GPO setting somewhere which restricts
execution of this software. Check out the Software Restriction Policies
which apply to your account. To see if this is correct, run the Group Policy
Result wizard in GPMC and see if this is indeed so.

Casper

"Travis" wrote in message

>I am unable to run certain MSI and EXE files. I receive the following
>error..
>
> "The system administrator has set policies to prevent this installation"
>
> Windows Server 2003 SP1
> Domain Contoller
>
> I am logged in as a Domain Admin with local Admin rights. I installed this
> server 2 years ago and have been the only Admin to touch it. The only
> modifications to any GPO is for logon scripts, folder redirection, and
> WSUS.
>
> I have updated Windows Installer to version 3.1 v2
>
> I have added the DisableMSI reg key and set the value to 0
>
> I attemepted to run the Windows Installer Cleanup utility to remove the
> application that will not install but I receive the same error when I try
> to
> install it.
>
> Any help would be much appreciated.
>
> Travis
 >> Stay informed about: The system administrator has set policies to prevent this .. 

There are no Software Restriction Policies in place. I have checked very GPO,
including the local policy.

"Casper van Eersel" wrote:

> This looks as though you have a GPO setting somewhere which restricts
> execution of this software. Check out the Software Restriction Policies
> which apply to your account. To see if this is correct, run the Group Policy
> Result wizard in GPMC and see if this is indeed so.
>
> Casper
>
> "Travis" wrote in message
>
> >I am unable to run certain MSI and EXE files. I receive the following
> >error..
> >
> > "The system administrator has set policies to prevent this installation"
> >
> > Windows Server 2003 SP1
> > Domain Contoller
> >
> > I am logged in as a Domain Admin with local Admin rights. I installed this
> > server 2 years ago and have been the only Admin to touch it. The only
> > modifications to any GPO is for logon scripts, folder redirection, and
> > WSUS.
> >
> > I have updated Windows Installer to version 3.1 v2
> >
> > I have added the DisableMSI reg key and set the value to 0
> >
> > I attemepted to run the Windows Installer Cleanup utility to remove the
> > application that will not install but I receive the same error when I try
> > to
> > install it.
> >
> > Any help would be much appreciated.
> >
> > Travis
>
>
>
 >> Stay informed about: The system administrator has set policies to prevent this .. 

It now appears that it is affecting every computer in this Domain. So far I
have been unable to install Office 2003, Group Policy Management Console, MS
Installer Cleanup Utility, Financial Edge, and Raiser's Edge. On the
workstations it seems that the following registry key has been modified.

HKLM\Software\Policies\Microsoft\Windows\Installer\disableMSI

The value on the workstations is set to 2. This value is not present on my
servers. When I change the value on the workstations from 2 to 0 I am then
able to install whatever I like. I have added the desableMSI key to a server
and made the value 0 but I am still unable to install anything.

I have also created a new GPO, set it to block policy inheritance, and move
the DC to this GPO. I then ran "gpupdate /force". I was then able to install
the Group Policy Management Console but I still recieve the same error when I
attempt to Upgrade my Accounting package.

Is it possible that a recent Windows Update may have caused this?

Travis

"Roger Abell [MVP]" wrote:

> The last time that I searched the KB with the exact string you quoted
> there were a number of hits for different apps with installs that gave that
> result and their various workarounds.
>
> "Travis" wrote in message
>
> >I am unable to run certain MSI and EXE files. I receive the following
> >error..
> >
> > "The system administrator has set policies to prevent this installation"
> >
> > Windows Server 2003 SP1
> > Domain Contoller
> >
> > I am logged in as a Domain Admin with local Admin rights. I installed this
> > server 2 years ago and have been the only Admin to touch it. The only
> > modifications to any GPO is for logon scripts, folder redirection, and
> > WSUS.
> >
> > I have updated Windows Installer to version 3.1 v2
> >
> > I have added the DisableMSI reg key and set the value to 0
> >
> > I attemepted to run the Windows Installer Cleanup utility to remove the
> > application that will not install but I receive the same error when I try
> > to
> > install it.
> >
> > Any help would be much appreciated.
> >
> > Travis
>
>
>
 >> Stay informed about: The system administrator has set policies to prevent this .. 

Did you run rsop.msc on a couple of the domain workstations to see if it
shows that a Group Policy setting for Windows Installer is disabled?? Unless
this is happening via a direct registry mod such as a Group Policy startup
script using a .reg file it would seem that this would be happening via a
GPO. What you might try is to create a new Group Policy, link it to the
domain container, enable enforcement/do not override for that GPO, put it at
the top of the list, and go to computer configuration/administrative
templates/Windows components/Windows installer and set disable Windows
Installer to disabled or enabled for "never". Then run gpupdate /force on
the domain controller and do the same on the domain workstation or reboot
it.

Steve


"Travis" wrote in message

> It now appears that it is affecting every computer in this Domain. So far
> I
> have been unable to install Office 2003, Group Policy Management Console,
> MS
> Installer Cleanup Utility, Financial Edge, and Raiser's Edge. On the
> workstations it seems that the following registry key has been modified.
>
> HKLM\Software\Policies\Microsoft\Windows\Installer\disableMSI
>
> The value on the workstations is set to 2. This value is not present on my
> servers. When I change the value on the workstations from 2 to 0 I am then
> able to install whatever I like. I have added the desableMSI key to a
> server
> and made the value 0 but I am still unable to install anything.
>
> I have also created a new GPO, set it to block policy inheritance, and
> move
> the DC to this GPO. I then ran "gpupdate /force". I was then able to
> install
> the Group Policy Management Console but I still recieve the same error
> when I
> attempt to Upgrade my Accounting package.
>
> Is it possible that a recent Windows Update may have caused this?
>
> Travis
>
> "Roger Abell [MVP]" wrote:
>
>> The last time that I searched the KB with the exact string you quoted
>> there were a number of hits for different apps with installs that gave
>> that
>> result and their various workarounds.
>>
>> "Travis" wrote in message
>>
>> >I am unable to run certain MSI and EXE files. I receive the following
>> >error..
>> >
>> > "The system administrator has set policies to prevent this
>> > installation"
>> >
>> > Windows Server 2003 SP1
>> > Domain Contoller
>> >
>> > I am logged in as a Domain Admin with local Admin rights. I installed
>> > this
>> > server 2 years ago and have been the only Admin to touch it. The only
>> > modifications to any GPO is for logon scripts, folder redirection, and
>> > WSUS.
>> >
>> > I have updated Windows Installer to version 3.1 v2
>> >
>> > I have added the DisableMSI reg key and set the value to 0
>> >
>> > I attemepted to run the Windows Installer Cleanup utility to remove the
>> > application that will not install but I receive the same error when I
>> > try
>> > to
>> > install it.
>> >
>> > Any help would be much appreciated.
>> >
>> > Travis
>>
>>
>>
 >> Stay informed about: The system administrator has set policies to prevent this .. 

Ok, tried it. No change.

I've also checked every GPO for a Software Restriction Policy and none are
present.

Travis

"Steven L Umbach" wrote:

> Did you run rsop.msc on a couple of the domain workstations to see if it
> shows that a Group Policy setting for Windows Installer is disabled?? Unless
> this is happening via a direct registry mod such as a Group Policy startup
> script using a .reg file it would seem that this would be happening via a
> GPO. What you might try is to create a new Group Policy, link it to the
> domain container, enable enforcement/do not override for that GPO, put it at
> the top of the list, and go to computer configuration/administrative
> templates/Windows components/Windows installer and set disable Windows
> Installer to disabled or enabled for "never". Then run gpupdate /force on
> the domain controller and do the same on the domain workstation or reboot
> it.
>
> Steve
>
>
> "Travis" wrote in message
>
> > It now appears that it is affecting every computer in this Domain. So far
> > I
> > have been unable to install Office 2003, Group Policy Management Console,
> > MS
> > Installer Cleanup Utility, Financial Edge, and Raiser's Edge. On the
> > workstations it seems that the following registry key has been modified.
> >
> > HKLM\Software\Policies\Microsoft\Windows\Installer\disableMSI
> >
> > The value on the workstations is set to 2. This value is not present on my
> > servers. When I change the value on the workstations from 2 to 0 I am then
> > able to install whatever I like. I have added the desableMSI key to a
> > server
> > and made the value 0 but I am still unable to install anything.
> >
> > I have also created a new GPO, set it to block policy inheritance, and
> > move
> > the DC to this GPO. I then ran "gpupdate /force". I was then able to
> > install
> > the Group Policy Management Console but I still recieve the same error
> > when I
> > attempt to Upgrade my Accounting package.
> >
> > Is it possible that a recent Windows Update may have caused this?
> >
> > Travis
> >
> > "Roger Abell [MVP]" wrote:
> >
> >> The last time that I searched the KB with the exact string you quoted
> >> there were a number of hits for different apps with installs that gave
> >> that
> >> result and their various workarounds.
> >>
> >> "Travis" wrote in message
> >>
> >> >I am unable to run certain MSI and EXE files. I receive the following
> >> >error..
> >> >
> >> > "The system administrator has set policies to prevent this
> >> > installation"
> >> >
> >> > Windows Server 2003 SP1
> >> > Domain Contoller
> >> >
> >> > I am logged in as a Domain Admin with local Admin rights. I installed
> >> > this
> >> > server 2 years ago and have been the only Admin to touch it. The only
> >> > modifications to any GPO is for logon scripts, folder redirection, and
> >> > WSUS.
> >> >
> >> > I have updated Windows Installer to version 3.1 v2
> >> >
> >> > I have added the DisableMSI reg key and set the value to 0
> >> >
> >> > I attemepted to run the Windows Installer Cleanup utility to remove the
> >> > application that will not install but I receive the same error when I
> >> > try
> >> > to
> >> > install it.
> >> >
> >> > Any help would be much appreciated.
> >> >
> >> > Travis
> >>
> >>
> >>
>
>
>
 >> Stay informed about: The system administrator has set policies to prevent this .. 

Weird. Your description in that it now is applying to all computers in the
domain would seem to indicate a Group Policy setting for Windows Installer
as does the registry key being used though that registry key can also be
configured manually, possibly by malware. Did running rsop.msc on an
affected domain computer show any settings configured for Windows Installer
under either computer OR user configuration /administrative
templates/Windows components/Windows Installer? Does it show and Group
Policy logon or startup scripts under Windows settings/scripts? Have you
scanned at least one of the affected computers for malware?

Steve


"Travis" wrote in message

> Ok, tried it. No change.
>
> I've also checked every GPO for a Software Restriction Policy and none are
> present.
>
> Travis
>
> "Steven L Umbach" wrote:
>
>> Did you run rsop.msc on a couple of the domain workstations to see if it
>> shows that a Group Policy setting for Windows Installer is disabled??
>> Unless
>> this is happening via a direct registry mod such as a Group Policy
>> startup
>> script using a .reg file it would seem that this would be happening via a
>> GPO. What you might try is to create a new Group Policy, link it to the
>> domain container, enable enforcement/do not override for that GPO, put it
>> at
>> the top of the list, and go to computer configuration/administrative
>> templates/Windows components/Windows installer and set disable Windows
>> Installer to disabled or enabled for "never". Then run gpupdate /force on
>> the domain controller and do the same on the domain workstation or reboot
>> it.
>>
>> Steve
>>
>>
>> "Travis" wrote in message
>>
>> > It now appears that it is affecting every computer in this Domain. So
>> > far
>> > I
>> > have been unable to install Office 2003, Group Policy Management
>> > Console,
>> > MS
>> > Installer Cleanup Utility, Financial Edge, and Raiser's Edge. On the
>> > workstations it seems that the following registry key has been
>> > modified.
>> >
>> > HKLM\Software\Policies\Microsoft\Windows\Installer\disableMSI
>> >
>> > The value on the workstations is set to 2. This value is not present on
>> > my
>> > servers. When I change the value on the workstations from 2 to 0 I am
>> > then
>> > able to install whatever I like. I have added the desableMSI key to a
>> > server
>> > and made the value 0 but I am still unable to install anything.
>> >
>> > I have also created a new GPO, set it to block policy inheritance, and
>> > move
>> > the DC to this GPO. I then ran "gpupdate /force". I was then able to
>> > install
>> > the Group Policy Management Console but I still recieve the same error
>> > when I
>> > attempt to Upgrade my Accounting package.
>> >
>> > Is it possible that a recent Windows Update may have caused this?
>> >
>> > Travis
>> >
>> > "Roger Abell [MVP]" wrote:
>> >
>> >> The last time that I searched the KB with the exact string you quoted
>> >> there were a number of hits for different apps with installs that gave
>> >> that
>> >> result and their various workarounds.
>> >>
>> >> "Travis" wrote in message
>> >>
>> >> >I am unable to run certain MSI and EXE files. I receive the following
>> >> >error..
>> >> >
>> >> > "The system administrator has set policies to prevent this
>> >> > installation"
>> >> >
>> >> > Windows Server 2003 SP1
>> >> > Domain Contoller
>> >> >
>> >> > I am logged in as a Domain Admin with local Admin rights. I
>> >> > installed
>> >> > this
>> >> > server 2 years ago and have been the only Admin to touch it. The
>> >> > only
>> >> > modifications to any GPO is for logon scripts, folder redirection,
>> >> > and
>> >> > WSUS.
>> >> >
>> >> > I have updated Windows Installer to version 3.1 v2
>> >> >
>> >> > I have added the DisableMSI reg key and set the value to 0
>> >> >
>> >> > I attemepted to run the Windows Installer Cleanup utility to remove
>> >> > the
>> >> > application that will not install but I receive the same error when
>> >> > I
>> >> > try
>> >> > to
>> >> > install it.
>> >> >
>> >> > Any help would be much appreciated.
>> >> >
>> >> > Travis
>> >>
>> >>
>> >>
>>
>>
>>
 >> Stay informed about: The system administrator has set policies to prevent this .. 

Interesting.
I am not sure what you have going on, per this thread's exchange with Steve.
However I notice you said you changed the GPOs that apply to the DC by
blocking inheritance. You really should leave the DC OU inheriting and with
the Default DC GPO applied. If needed just link a GPO to the DC OU at
higher priority to set a few policy overrides.

"Travis" wrote in message

> It now appears that it is affecting every computer in this Domain. So far
> I
> have been unable to install Office 2003, Group Policy Management Console,
> MS
> Installer Cleanup Utility, Financial Edge, and Raiser's Edge. On the
> workstations it seems that the following registry key has been modified.
>
> HKLM\Software\Policies\Microsoft\Windows\Installer\disableMSI
>
> The value on the workstations is set to 2. This value is not present on my
> servers. When I change the value on the workstations from 2 to 0 I am then
> able to install whatever I like. I have added the desableMSI key to a
> server
> and made the value 0 but I am still unable to install anything.
>
> I have also created a new GPO, set it to block policy inheritance, and
> move
> the DC to this GPO. I then ran "gpupdate /force". I was then able to
> install
> the Group Policy Management Console but I still recieve the same error
> when I
> attempt to Upgrade my Accounting package.
>
> Is it possible that a recent Windows Update may have caused this?
>
> Travis
>
> "Roger Abell [MVP]" wrote:
>
>> The last time that I searched the KB with the exact string you quoted
>> there were a number of hits for different apps with installs that gave
>> that
>> result and their various workarounds.
>>
>> "Travis" wrote in message
>>
>> >I am unable to run certain MSI and EXE files. I receive the following
>> >error..
>> >
>> > "The system administrator has set policies to prevent this
>> > installation"
>> >
>> > Windows Server 2003 SP1
>> > Domain Contoller
>> >
>> > I am logged in as a Domain Admin with local Admin rights. I installed
>> > this
>> > server 2 years ago and have been the only Admin to touch it. The only
>> > modifications to any GPO is for logon scripts, folder redirection, and
>> > WSUS.
>> >
>> > I have updated Windows Installer to version 3.1 v2
>> >
>> > I have added the DisableMSI reg key and set the value to 0
>> >
>> > I attemepted to run the Windows Installer Cleanup utility to remove the
>> > application that will not install but I receive the same error when I
>> > try
>> > to
>> > install it.
>> >
>> > Any help would be much appreciated.
>> >
>> > Travis
>>
>>
>>
 >> Stay informed about: The system administrator has set policies to prevent this ..