При попытке установить программу с помощью установочного MSI пакета на рабочей станции (права локального администратора имеются) возникает ошибка «Данная установка запрещена политикой, заданной системным администратором». Пытался запускать другие MSI файлы, они также не устанавливаются. Что делать?
Ответ
Сообщение Данная установка запрещена политикой, заданной системным администратором (The system administrator has set policies to prevent this installation) при установке (обновлении) программ из MSI пакетов или exe-инсталляторов указывает на то, что на компьютере включены политики, ограничивающие установку программ.
Если ваш пользователь обладает правами локального администратора, то вместо модификации локальных политик безопасности предлагаем простое обходное решение.
- Если это установщик, упакованный в EXE, щелкните по нему и выберите Запуск от имени администратора.
- Если это MSI пакет, откройте командную строку с правами администратора и запустите установку командой:
msiexec.exe /i C:\Install\MyApp-Installer.msi
Если программа не устанавливается даже с повышенными привилегиями, проверьте настройки групповых политик на компьютере. Можно получить настройки результирующих GPO на компьютере с помощью графической оснастки
rsop.msc
или с помощью команды gpresult. Проверьте, есть ли настроенные параметры политик в разделе Конфигурация компьютера -> Административные шаблоны -> Компоненты Windows -> Установщик Windows (Computer Configuration -> Administrative Templates -> Windows Components -> Windows Installer). Параметры GPO, которые могут отграничивать права установки программ через службу
msiserver
:
- Отключение установщика Windows (Turn off Windows Installer)
- Запретить пользователям, не являющимися администраторами, устанавливать обновления, подписанные изготовителем программы (Prohibit non-administrators from applying vendor signed updates)
- Запретить пользователям устанавливать обновления через Windows Installer (Prevent users from using to install updates and upgrades)
Если хотя бы одна из политик настроена, откройте редактор локальной GPO (
gpedit.msc
), перейдите в указанную выше ветку GPO, и измените настройку политики:
- Turn off Windows Installer:
Enabled
со значением
Never - Prohibit non-administrators from applying vendor signed update:
Disabled - Prevent users from using to install updates and upgrades:
Disabled
Политика позволяет запретить или разрешить пользователям (без прав администратора) выполнять обновление уже установленной программ (по умолчанию политика отключена). Если установленная программа запущена в привилегированном режиме (с правами SYSTEM), дополнительно нужно включить параметр GPO:
- Allow user to patch elevated products:
Enabled
После внесения изменений, примените настройки локальной GPO, выполнив команду:
gpupdate /force
Если на компьютере отсутствует редактор локальной GPO (например, в случае Home редакции Windows), или ограничивающие настройки применены непосредсвенно через реестр, нужно отредактировать значения в реестре. Перейдите в ветку
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer
и измените значение параметров следующим образом:
DisableMSI = 0 DisablePatch = 0 DisableLUAPatching=0 AllowLockdownPatch=1
Если параметры отсутствуют, можно создать их вручную.
Обратите внимание, что в Windows Server, в отличии от дестопных версий Windows, значение политики
Turn off Windows Installer
по умолчанию For managed application only. Поэтому в Windows Server под пользователем нельзя обновить установленное приложение.
В частности, это вызывает ошибку при обновлении компонентов 1C под пользователем, не являющимся локальным администратором:
Установка запрещена на основании системной политики. Обратитесь к системному администратору.
Чтобы разрешить установку обновлений 1С под пользователем, нужно отключить политику. Либо выполнять обновлений с правами администратора.
Также ограничения на установку программ (запуск определённых типов файлов) может быть внедрены с помощью политик ограниченного использования программ ( Software Restriction Policies) или AppLocker. Проверьте результирующие настройки политик в разделах:
- Computer Configuration -> Windows Settings -> Security Settings -> Software Restriction Policies
- Computer Configuration -> Windows Settings -> Security Settings -> Application Control Policies -> Applocker
Если ошибка возникает при установке или обновлении браузера Google Chrome под пользователем, сбросьте настройки политик браузера, удалив ветку
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\
.
Подробнее о сбросе локальных политик в Windows.
While installing an application, you got an error – The system administrator has set policies to prevent this installation. The application installation failed, and you wasn’t sure what polices were preventing the installation.
We hope the steps mentioned in this post will surely help you.
System administrator has set policies to prevent installation
To fix the error System administrator has set policies to prevent this installation:
You open the Run dialog box (Windows + R) => enter the command gpedit.msc
This brings up the Local Group Policy Editor.
Expand Computer Configuration > Administrative Templates > Windows Components > Windows Installer.
On the right pane edit the policy setting – Turn off Windows Installer.
On the Turn off Windows Installer setting box, click Enabled. Under Options > Enabled Windows Installer – Click the drop-down and select Never.
Click Apply and OK.
In the group policy editor, expand Windows Settings > Security Settings > Software Restriction Policies. Right click Software Restriction Policies and click New Software Restriction Policies.
On the right pane, right click Enforcement and click Properties. In the Enforcement properties box, look for Apply software restriction policies to the following users.
Select All users except local administrators. Click Apply.
In ours case after performing the above steps, we did not see the error again.
Hopefully this article will be useful for you. Good luck !
Last week while installing an application, I got an error – The system administrator has set policies to prevent this installation. The application installation failed, and I wasn’t sure what polices were preventing the installation.
On my Windows 10 virtual machine, I got this error when I was installing a software that was a .msi installer. The installer wasn’t corrupt, and I downloaded the installer again, but I got the same error.
First of all check if the antivirus is blocking the installation. This could occur because some antivirus software programs set very strict rule when it comes to installing applications. Therefore, temporarily disable the antivirus software running on the computer and check if you can install the software.
In my case, my initial suspect was an antivirus that could prevent this installation but no, it wasn’t the antivirus. Furthermore, the .msi installer was downloaded from a trusted source and I also made sure that UAC was off.
If you are also experiencing the same error, then I hope the steps mentioned in this post will surely help you.
The system administrator has set policies error can also be encountered while installing VMware Tools on Windows computer.
According to VMware KB, this error may occur twice if you are logged in twice as the same user on system. For example, you may see this error twice if you are logged in locally from the console and logged in through a Remote Terminal Service session.
In my case, I resolved this issue by enabling the Windows installer setting in the Windows Software Restriction Policy. In addition to that I also created a new software restriction policy and applied it to All users except local administrators.
System administrator has set policies to prevent installation
To fix the error System administrator has set policies to prevent this installation:
- Login to the system with an administrator account.
- Click Start > Run. Enter gpedit.msc.
- This brings up the Local Group Policy Editor.
- Expand Computer Configuration > Administrative Templates > Windows Components > Windows Installer.
- On the right pane edit the policy setting – Turn off Windows Installer.
On the Turn off Windows Installer setting box, click Enabled. Under Options > Disable Windows Installer – Click the drop-down and select Never.
Click Apply and OK.
In the group policy editor, expand Windows Settings > Security Settings > Software Restriction Policies. Right click Software Restriction Policies and click New Software Restriction Policies.
On the right pane, right click Enforcement and click Properties. In the Enforcement properties box, look for Apply software restriction policies to the following users.
Select All users except local administrators. Click OK.
Close the group policy editor.
Launch the command prompt as administrator and run gpupdate /force. Finally once the policy gets updated, re-run the installer.
In my case after performing the above steps, I did not see the error again.
Fix System administrator has set policies – Registry Method
To fix “The System administrator has set policies to prevent this installation” error by tweaking the registry.
Here are steps for editing the registry:
- Click Start > Run and type regedit and click OK. This opens the registry editor.
- Navigate to HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer.
- Right click DisableMSI and click Modify. Change the value to 0.
- Close the Registry Editor.
- Log off and login back to the machine.
Note: If you are running Windows operating systems that are Home versions, the Group Policy Editor is not available.
Still Need Help?
If you need further assistance on the above article or want to discuss other technical issues, check out some of these options.
Prajwal Desai
Prajwal Desai is a technology expert and 10 time Dual Microsoft MVP (Most Valuable Professional) with a strong focus on Microsoft Intune, SCCM, Windows 365, Enterprise Mobility, and Windows. He is a renowned author, speaker, & community leader, known for sharing his expertise & knowledge through his blog, YouTube, conferences, webinars etc.
“The system administrator has set policies to prevent this installation” is an error message you might receive while installing a program. To resolve the problem, MiniTool Partition Wizard has developed a simple guide where some feasible solutions are displayed.
You should be very familiar with the process of installing programs on computer. If there is no issue with the installer and the destination drive has enough free space, you should be able to complete the installation smoothly by following the given instructions.
But sometimes, you might fail to install a program and receive a Windows Installer window displaying the error message: The system administrator has set policies to prevent this installation.
This is not a critical error for your system, but I will prevent you from install programs. What can you do if you unfortunately receive this Windows Installer error? Don’t worry. Here are some feasible solutions. Just keep reading to check the detailed instructions.
Fix 1: Run the Executable as Administrator
As the error message shows, you cannot perform the installation as it has been prevented by system administrator. So, the direct method to resolve the problem is to launch the installer with administrative privilege.
Just right-click the executable file you’ve downloaded and choose Run as administrator from the context menu.
Fix 2: Set UAC to Never Notify
User Account Control (UAC) is a mandatory access control enforcement facility working to improve the security of OS. If it is enabled, you will receive notifications every time when you are trying to install a program or make changes to your computer/Windows settings.
If you always receive “the system administrator has set policies to prevent this installation” message when you install programs, you can set the UAC to Never Notify. Here’s how to do that.
Step 1: Press Windows + S, input control panel and click the result.
Step 2: Navigate to User Accounts > User Accounts and click Change User Account Control settings.
Step 3: Move the slider to Never notify and click OK button.
Now, you won’t receive notifications when you install the program. Once you have completed the installation, don’t forget to set UAC to the default to protect your PC.
Fix 3: Modify Windows Registry
To get rid of “the system administrator has set policies to prevent this installation” error message, you can also modify Windows registry. But as this is a rather risky operation, you had better back up the registry in advance.
Step 1: Press Windows + R, input regedit and click OK to open Registry Editor.
Step 2: Navigate to the following path: HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoft WindowsInstaller
Step 3: Check if there is a DWORD named DisableMSI. If not, right-click the empty space in the right pane, choose New > DWORD (32-bit) Value and name it as DisableMSI.
Step 4: Double-click DisableMSI DDWORD and set its Value data to 1. Click OK to save changes.
Step 5: Now, navigate to ComputerHKEY_CLASSES_ROOTInstallerProducts to find the key related to the problematic program. You can check the ProductName in the right pane after selecting a key.
Step 6: Right-click the target key and choose Delete.
Once it’s done, restart your computer for the changes to take effect. Then, try installing the program again to check if the issue has been resolved.
Alternatively, you can enable the hidden administrator account which is often used to resolve various administrative issues. You can follow the steps below to enable the account.
Step 1: Invoke Run window.
Step 2: Input cmd and press Ctrl + Shift + Enter to launch Command Prompt as administrator.
Step 3: Type the command net user administrator /active:yes and press Enter to enable the hidden administrator account.
Now, log out of the current account and log into this built-in administrator account. Test if you can install the program smoothly without the error message.
Note: The administrator account has the highest privileges. To avoid any misoperation with the account, you’d better disable the account after resolving the problem by using the command net user administrator /active:no.
Fix 5: Change Windows Installer Policy Settings
To resolve “the system administrator has set policies to prevent the installation” problem, you can also go to change Windows Installer policy settings in Local Group Policy Editor. Note that the Local Group Policy Editor is not available in Windows 10 Home edition.
Step 1: Open Run window, input gpedit.msc and click OK to open Local Group Policy Editor.
Step 2: Go to Computer Configuration > Administrative Templates > Windows Components > Windows Installer.
Step 3: In the right pane, double-click Turn off Windows Installer policy to edit its settings.
Step 4: In the pop-up window, click Enabled and choose Never from the drop-down list of Disable Windows Installer.
Step 5: Click Apply and OK to save changes.
After that, restart your computer and check if the Windows Installer error is fixed.
If you receive “The system administrator has set policies to prevent this installation” error message when trying to install any new program or modify existing program in Windows 10/8/7, this fix is for you.
The system administrator has set policies to prevent this installation
This error message is from the Windows Installer feature and it actually appears while you are trying to install any new program or modify existing program on your PC. The error is not a dangerous one, you can try the below solutions and check if they help you.
Read more: How to Change Administrator on Windows 10
How To Fix The System Administrator Has Set Policies To Prevent This Installation in Windows 10/8/7
Try the tips and tricks below and see if they help you.
1. Try installing the program/software by running the setup file as administrator.
2. Make sure Windows Installer service is running in Services snap-in
3. Temporarily turn off the third-party antivirus you’re using, if any.
4. Temporarily turn off and disable User Account Control (UAC) and try installing your program/software.
If none of these tips here, try the methods mentioned below.
Method 1. Using Command Prompt
In order to fix “The system administrator has set policies to prevent this installation” error, you can try to change your current account to a true administrator account in order to proceed with the installation. To do so, follow these steps:
Step 1. Click Start menu and type “cmd“. Then right-click on Command Prompt in the search results and click on Run as administrator.
Step 2. In the Command Prompt window, type the following command prompt and press Enter:
net user administrator /active:yes
Step 3. You can close Command Prompt window and reboot the machine.
After restarting your computer, you will see a new user account with the name “Administrator”. Select it to log in. Using this account, you can install or modify anything you want.
Method 2. Using Registry Editor
Step 1. Press Windows Key + R then type regedit in run dialog box and click OK.
Step 2. In the left pane of Registry Editor window, browse to following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer
Step 3. In the right pane of Installer registry key, look for DisableMSI registry DWORD (REG_DWORD) and delete it.
Step 4. Then, navigate to following registry location:
HKEY_CLASSES_ROOT\Installer\Products
Step 5. Expand the Products registry key and search through the list until you determine the program/product for which you’re getting this problem.
Step 6. Once you verified the registry sub-key which should look like a folder, delete the entire folder by right-clicking on it and clicking Delete.
Close the Registry Editor and restart your system. After that, you should be able to perform program’s modification/installation.
Method 3. Using the Group Policy Editor
Step 1. Press Windows Key + R then type gpedit.msc in run dialog box. Click OK to open the Group Policy Editor. You can refer how to fix “Windows cannot find gpedit.msc” in Windows 10 from this tutorial.
Step 2. In the left pane of Local Group Policy Editor, go to the following path:
Computer Configuration > Administrative Templates > Windows Components > Windows Installer
Step 3. Find the Turn off Windows Installer policy option.
Step 4. Double-click on it and then tick the box next to the “Enabled” option and change the Disable Windows Installer option to Never. Click OK to save changes.
Restart your computer and then check to see if the error message still occurs.
Hope something helps you. Please let me know if you have any questions.
FIX: The System Administrator Has Set Policies To Prevent This Installation
5 (100%) 1 vote