ActiveSetup with Batch File
I am trying to add some HKCU keys with ActiveSetup. I have my activesetup pointing to a Batch file which is basically creating some HKCU with REG ADD command. It is working fine for an admin but it fails with "ACCESS DENIED" if a user logs on to the box. I end up giving full rights to the USERS but still no success. Any advise on this?
0 Comments
[ + ] Show comments
Answers (16)
Please log in to answer
Posted by:
WiseAppPackager
13 years ago
Modifying the batch script so as to run it using local admin rights may not work here.
I think, its unlikely to get it work by using batch file - Instead of active setup, you should make use of a CA which calls this batch file.
BTW, have you checked whether the use of "regedit" in stubpath works for your normal users?
I think, its unlikely to get it work by using batch file - Instead of active setup, you should make use of a CA which calls this batch file.
BTW, have you checked whether the use of "regedit" in stubpath works for your normal users?
Posted by:
anonymous_9363
13 years ago
Have you checked the permissions on the keys in question?
It's perfectly feasible that your domain administrator has permissioned one or more of the keys to protect, say, Group Policy settings. It's certainly done a lot at my current client.
It's perfectly feasible that your domain administrator has permissioned one or more of the keys to protect, say, Group Policy settings. It's certainly done a lot at my current client.
Posted by:
captain_planet
13 years ago
.....why don't you build the HKCU reg keys (and the Active Setup HKLM key) into an installer, and have the ActiveSetup stubpath as "MSIEXEC /fu [ProductCode] /qb!"?
Posted by:
chichora123
13 years ago
Permissions are set to Full control for Usres & Everyone, still no success. I could have done that captain planet but this is a custom wrap MSI that i created using Windows EDP tool for Windows media player & I can't seem to find either the shortcut or wmplayer.exe file under a file table... What i could do is stage a registry file and then run it with Activesetup for users. This is something i haven't tried ...
Posted by:
chichora123
13 years ago
Yea there was a change in policy recently i will verify that. If i do a copy file command in my stubpath it works fine but when i try to run the batch file it says access denied. I thought setting the permissions to full control for USERS should do the trick?
Posted by:
anonymous_9363
13 years ago
I thought setting the permissions to full control for USERS should do the trick?USERS caters only for user accounts on the machine itself. Presumably, your users are domain members, in which case you should add 'Domain Users' or the special group 'Everyone'.
Posted by:
chichora123
13 years ago
Full control added for DOMAIN USERS & EVERYONE as well but no success :( still getting access denied.
Posted by:
chichora123
13 years ago
reg add "HKCU\Software\Policies\Microsoft\WindowsMediaPlayer" /v "DisabelAutoUpdate" /t REG_DWORD /d 1 /f
reg add "HKCU\Software\Policies\Microsoft\WindowsMediaPlayer" /v "EnableAutoUpgrade" /t REG_SZ /d No /f
Posted by:
chichora123
13 years ago
its giving me an Access denied not on the batch file but i guess on the registry itself.
Posted by:
captain_planet
13 years ago
Can you not just use a GPO for this registry? It's not a UAC issue is it? Which OS are you testing on?
Posted by:
chichora123
13 years ago
oh it's going to take a long time for our GPO team to roll a new policy out for this & since it's in my queue i thought of just completing it instead of passing it on to the other team.
Posted by:
chichora123
13 years ago
I added Full control rights for Users, Domain Users, Power Users to the "HKCU\Software\Policies\Microsoft" but when i logon as a regular user the rights are gone. SO if they are not there what is the other way of granting permission to this registry?
Posted by:
anonymous_9363
13 years ago
when i logon as a regular user the rights are gone.Clearly, there is a user-based Group Policy being applied! Back to your GP guys...
Posted by:
chichora123
13 years ago
Thanks VB. I am not good @ GPO just wanna to know before i go talk to them that the policy should be set to machine based instead of User based? To verify this i granted full rights to a file instead of a HKCU hive & it shows that the permission stays there. If the policy was set to user based than it shouldn't have worked. Your thoughts?
Posted by:
anonymous_9363
13 years ago
You want the keys that they're permissioning removed from the GP. If they know their stuff, they can create a separate OU and exclude a group of users (your application users) from having the policy applied.
Rating comments in this legacy AppDeploy message board thread won't reorder them,so that the conversation will remain readable.