Hello Jim, and others

I hope this is a good question

I install all programs by GPO mostly computer packages

Deployment option:
Uninstall when it falls out of scope

In GPO I have not enabled the settings USER or COMPUTER for Elevated Privileges

And I don’t intend to do so.

Why? should I ?

“This setting extends elevated privileges to all programs and all users”

I don’t like this

I know you can set up settings that prevents users from running some predefined extensions.
My users are not members of local admins group, and they should not be able to install all sort of programs that I don’t know of.

And I see it as a great risk if they could.

I see a lot of recommending of using Elevated Privileges, which in my opinion should no stand alone.

I think there could be some misunderstanding.

Elevated rights are already there when you install or offer by GPO.

Am I totally wrong or what ?

Sweede [:D]
0 Comments   [ - ] Hide Comments


Please log in to comment

Rating comments in this legacy AppDeploy message board thread won't reorder them,
so that the conversation will remain readable.
Answer this question or Comment on this question for clarity


Maybe I'm misunderstanding, but are you referring to the AlwaysInstallElevated key?

Setting that allows your msi packaged to install with elevated rights, allowing users with restricted permissions to install the package you assign them.

Without setting this, normal or restricted users could never install the packages you assign them.
Answered 04/22/2005 by: Bladerun
Green Belt

Please log in to comment

You are correct. If an MSI is deployed with Group Policy, it installs elevated. Setting the "AlwaysInstallElevated" registry keys/policy settings has the same effect for MSIs installed outside of Group Policy.

Thus, setting these policies has no effect on installations performed from GP. This can be verified by looking in an MSI log file and searching for the "Privileged" property, which gets set for "elevated" installations.

Hope this helps!

Answered 04/28/2005 by: curtis.sawin
Yellow Belt

Please log in to comment

Thank you!

so I got that one right and it was a god question after all.


Yes i was referring to that key, and wrong by GPO it installs just fine.

Answered 05/09/2005 by: Sweede
Second Degree Green Belt

Please log in to comment