I am trying to add some HKCU keys with ActiveSetup. I have my activesetup pointing to a Batch file which is basically creating some HKCU with REG ADD command. It is working fine for an admin but it fails with "ACCESS DENIED" if a user logs on to the box. I end up giving full rights to the USERS but still no success. Any advise on this?
0 Comments   [ + ] Show Comments

Comments

Please log in to comment

Rating comments in this legacy AppDeploy message board thread won't reorder them,
so that the conversation will remain readable.

Answers

0
Modifying the batch script so as to run it using local admin rights may not work here.
I think, its unlikely to get it work by using batch file - Instead of active setup, you should make use of a CA which calls this batch file.
BTW, have you checked whether the use of "regedit" in stubpath works for your normal users?
Answered 02/22/2011 by: WiseAppPackager
Purple Belt

Please log in to comment
0
Have you checked the permissions on the keys in question?

It's perfectly feasible that your domain administrator has permissioned one or more of the keys to protect, say, Group Policy settings. It's certainly done a lot at my current client.
Answered 02/23/2011 by: VBScab
Red Belt

Please log in to comment
0
.....why don't you build the HKCU reg keys (and the Active Setup HKLM key) into an installer, and have the ActiveSetup stubpath as "MSIEXEC /fu [ProductCode] /qb!"?
Answered 02/23/2011 by: captain_planet
Second Degree Brown Belt

Please log in to comment
0
Permissions are set to Full control for Usres & Everyone, still no success. I could have done that captain planet but this is a custom wrap MSI that i created using Windows EDP tool for Windows media player & I can't seem to find either the shortcut or wmplayer.exe file under a file table... What i could do is stage a registry file and then run it with Activesetup for users. This is something i haven't tried ...
Answered 02/23/2011 by: chichora123
Fourth Degree Green Belt

Please log in to comment
0
Yea there was a change in policy recently i will verify that. If i do a copy file command in my stubpath it works fine but when i try to run the batch file it says access denied. I thought setting the permissions to full control for USERS should do the trick?
Answered 02/23/2011 by: chichora123
Fourth Degree Green Belt

Please log in to comment
0
I thought setting the permissions to full control for USERS should do the trick?USERS caters only for user accounts on the machine itself. Presumably, your users are domain members, in which case you should add 'Domain Users' or the special group 'Everyone'.
Answered 02/23/2011 by: VBScab
Red Belt

Please log in to comment
0
Full control added for DOMAIN USERS & EVERYONE as well but no success :( still getting access denied.
Answered 02/23/2011 by: chichora123
Fourth Degree Green Belt

Please log in to comment
0
Post your batch file. Remember to use the CODE tag, please.
Answered 02/23/2011 by: VBScab
Red Belt

Please log in to comment
0
reg add "HKCU\Software\Policies\Microsoft\WindowsMediaPlayer" /v "DisabelAutoUpdate" /t REG_DWORD /d 1 /f

reg add "HKCU\Software\Policies\Microsoft\WindowsMediaPlayer" /v "EnableAutoUpgrade" /t REG_SZ /d No /f
Answered 02/23/2011 by: chichora123
Fourth Degree Green Belt

Please log in to comment
0
its giving me an Access denied not on the batch file but i guess on the registry itself.
Answered 02/23/2011 by: chichora123
Fourth Degree Green Belt

Please log in to comment
0
Can you not just use a GPO for this registry? It's not a UAC issue is it? Which OS are you testing on?
Answered 02/23/2011 by: captain_planet
Second Degree Brown Belt

Please log in to comment
0
oh it's going to take a long time for our GPO team to roll a new policy out for this & since it's in my queue i thought of just completing it instead of passing it on to the other team.
Answered 02/23/2011 by: chichora123
Fourth Degree Green Belt

Please log in to comment
0
I added Full control rights for Users, Domain Users, Power Users to the "HKCU\Software\Policies\Microsoft" but when i logon as a regular user the rights are gone. SO if they are not there what is the other way of granting permission to this registry?
Answered 02/23/2011 by: chichora123
Fourth Degree Green Belt

Please log in to comment
0
when i logon as a regular user the rights are gone. Clearly, there is a user-based Group Policy being applied! Back to your GP guys...
Answered 02/24/2011 by: VBScab
Red Belt

Please log in to comment
0
Thanks VB. I am not good @ GPO just wanna to know before i go talk to them that the policy should be set to machine based instead of User based? To verify this i granted full rights to a file instead of a HKCU hive & it shows that the permission stays there. If the policy was set to user based than it shouldn't have worked. Your thoughts?
Answered 02/24/2011 by: chichora123
Fourth Degree Green Belt

Please log in to comment
0
You want the keys that they're permissioning removed from the GP. If they know their stuff, they can create a separate OU and exclude a group of users (your application users) from having the policy applied.
Answered 02/24/2011 by: VBScab
Red Belt

Please log in to comment
Answer this question or Comment on this question for clarity