Recent Posts

Topics

Archives


« | Main | »

Fix for “The system administrator has set policies to prevent this installation” error.

By Jesse | March 9, 2009

Several times I have encountered the error:

“The system administrator has set policies to prevent this installation”

The solution to this is to fix the local security policy.

  1. Open control Panel and go to Administrative Tools.
  2. In Administrative tools open Local Security Policy.
  3. In Local Security Policy right click Software Restriction Policies and click “New Software Rectriction Policy”.
  4. Now Left click on software restriction policies and in the right-hand window you should see enforcement.
  5. Double-click on enforcement and set the policy to apply to “ALL USERS EXCEPT LOCAL ADMINISTRATORS”

Now approve the changes and see if you are now able to install software.

Alternately several people recommended the following but I’ve found the above steps fix the problem in 98% of cases.  If you are unfamiliar with the registry…. stop reading.

  1. Browse the registry to HKLM\Software\Policies\Microsoft\Windows\Installer
    Create: DisableMSI       Type: REG_DWORD  value = 0   (0 should allow you to install it was originally 1)
  2. Browse to HKEY_CLASSES_ROOT\Installer\Products\
    Search the list for the product that is causing the error.. delete the folder in the products folder…  this may also correct your error…

If you have any additional comments or pointers they are welcome.

*********************
***** UPDATE ******
*********************
I’ve gotten alot of comments that they cannot find secpol.msc.  This is because it is not included on Home versions of vista. However, I now believe I have an answer even to this.  I have spent the last hour reviewing the registry changes that are made and have narrowed down the value that is changed when you set the above policy.  The Value changed is a dword value :

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{A541BD3D-1A70-4D7B-BC99-CF1ADFC0DE9F}Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\PolicyScope

It is changed from 0 to 1 when you set it not to apply to administrators.  When you set “new software restriction policy the following tree is populated:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{A541BD3D-1A70-4D7B-BC99-CF1ADFC0DE9F}Machine\Software\Policies\Microsoft\Windows\Safer

I am not sure if you need the whole tree to get it to function or just the value I have included 2 Registry files to run.   The first includes just the policyscope value of 1 the second includes the entire “Safer” tree that was created on my machine when I added the software restriction settings.

Click here to download just the PolicyScope setting.  (download and run first to see if it fixes your problem.)

Click here to download the entire “Safer” tree that manually adds the fixed software restriction settings. (try this if the above reg file does not fix your problem.)


_______________________________________
PLEASE HELP BY BOOKMARKING OUR SITE...
[del.icio.us] [Digg] [StumbleUpon]

Topics: Uncategorized | 81 Comments »

81 Responses to “Fix for “The system administrator has set policies to prevent this installation” error.”

  1. Joe Says:
    May 21st, 2009 at 2:55 am

    Hi. Im using dell vostro 1400. Windows vista basic. I have the same errors but couldnt find local security policy on the administrative tools. How can i still solve this problem?

  2. Jesse Says:
    May 21st, 2009 at 10:36 am

    Sure.. If you go to start –> run and type ‘secpol.msc /s’ then press enter. .it will load local security policy.. let me know if that worked…

  3. milton Says:
    June 5th, 2009 at 5:08 pm

    first step did not work for me.

  4. Jesse Says:
    June 6th, 2009 at 12:44 pm

    Did you try going to start –> run and type ’secpol.msc /s’ then press enter. it will load local security policy.. let me know if that worked…

  5. ayman Says:
    June 9th, 2009 at 7:16 am

    very thanks,

    the first one did work successfully..

  6. Michael Says:
    June 25th, 2009 at 10:45 pm

    This didnt work at all. Looks like your talking XP as there is no “Start – Run”.

    I copied and paste what you said in RUN and ..Nothing

    What exactly did you copy and paste into run?? and did you make the changes to the registry?

  7. Jesse Says:
    June 26th, 2009 at 10:44 pm

    What exactly did you copy and paste into run?? and did you make the changes to the registry?

  8. Gill Says:
    July 3rd, 2009 at 6:21 pm

    Hi I have tried the above.
    I am trying to install Abby fine reader.
    Do you have any other suggestions

  9. Melony Says:
    July 18th, 2009 at 9:04 am

    I have windows vista 64 bit and can’t find the local security policy and when typing in the aboved mentioned in run, it says, ” windows can not find ’secpol.msc /s’ . Make sure you typed the names correctly then try again.

  10. mike Says:
    July 24th, 2009 at 10:02 pm

    can you recommend a fix for windows xp? i am unable to do steps three thru 5 since there is no “Local Security Policy” tab nor icon. cannot run ’secpol.msc /s’ since windows cannot find it. thanks!!!

  11. asdf Says:
    August 6th, 2009 at 2:15 pm

    Worked like a charm on Win2k3 and VMware Server 2 installation problem.

  12. Marty Says:
    August 15th, 2009 at 3:46 pm

    Fix #1 worked great on a Windows 2008 domain controller that wouln’t allow me to install anything. I tried a lot of other ‘Fixes’ from other sites including some recommending fix #2 (none of which worked). Thanks so much!

  13. Wendy Says:
    August 21st, 2009 at 7:07 pm

    I have Vista Home Premium 32. I have tried everything to get rid of “The system administrator has set policies to prevent this installation” when I tried to install my Topaz program. This is what finally worked – I turned my User Account Control off here:
    Start>Control Panel>User Accounts>Turn User Account Control on or off>

  14. Mike Says:
    August 24th, 2009 at 10:13 pm

    First fix work on virtual Windows 2003 connected via a remote terminal session though a second remote session. Also fixes within resistry concerning policy or intaller did not work. Thanks for your solution.

  15. Stan Says:
    August 25th, 2009 at 8:30 am

    Itried to run ‘secpol.msc/s’ and received the following error message:

    Windows cannot find ‘secpol.msc/s’…

    Please help!

  16. Manish Says:
    September 18th, 2009 at 3:01 pm

    Thanks for me the first solution worked. Saved me lot of time.

  17. Nebbie Says:
    September 21st, 2009 at 9:29 pm

    I also was not able to find local security policy in Admin tools and when I ran “secpol.msc /s” it said Windows cannot find ’secpol.msc/s’…

  18. Randall Says:
    September 28th, 2009 at 5:11 am

    Thank goodness I finally found this first solution, was pulling my hair out trying to pin down the problem. Many thanks!

  19. Jesse Says:
    October 8th, 2009 at 12:18 pm

    Please see my updated article, I have added some Reg files that should fix the problem for people who do not have secpol.msc

  20. Jesse Says:
    October 8th, 2009 at 12:19 pm

    I have updated the post and added some reg files that should fix this now… I tracked down the registry settings that secpol was changing… let me know if this helps….

  21. dave Says:
    October 25th, 2009 at 5:04 pm

    I have tried all of these for Windows 7 to no avail. Some of the Registry locations vary as well, but a search yielded little and what I could change did nothing.

    I have attempted the policy changes to no avail. This is a home computer upgraded from Vista. It used to work on my other Vista machine. Now that I have upgraded I am trying to install MS Publisher on Winows 7. Bummer.

  22. mweya Says:
    November 23rd, 2009 at 2:52 am

    have tried that, not working for me

  23. JLD Says:
    December 10th, 2009 at 1:58 am

    HI
    I’ve tried the steps above, can see and complete steps 1-5 but nothing happens, please advise!

  24. Jesse Says:
    December 10th, 2009 at 2:16 pm

    what operating system are you running? (both version (ie xp, vista, server 2003) and type (standard, professional, basic, etc).?

    Regards,
    Jesse Vaughan

  25. Jesse Says:
    December 10th, 2009 at 2:16 pm

    can you give me more details about your operating system.

  26. Gerry Says:
    December 14th, 2009 at 8:13 pm

    Jesse…

    I’m on Vista Home 32, and none of the solutions (including the reg changes) seem to have any effect. I’m considering turning off the UAC, but I don’t really like that. It’s not nearly as elegant as your solutions are (when they work).

    FYI, I’m simply trying to install ActivePerl.

  27. Jesse Says:
    December 17th, 2009 at 6:38 pm

    UAC can be reactivated after the install.. if you did turn it off.. However if you are in the local admins group and you right click on the file and select run as administrator that should more or less do the same thing as running with UAC off..

  28. Dan Says:
    December 18th, 2009 at 3:34 pm

    Ok, this site is really appreciated by me, but still no luck! I am running vista home premium, and have tried
    - regedits
    - hidden admin
    - uac
    - everything i can find on the internet!

    Im sure theres not much more I can do, but if anyone can help, it will be you guys!

  29. Dustin Says:
    December 22nd, 2009 at 7:04 pm

    I am also getting this error message and can not seem to fix it. I have gone through your steps and nothing is working.

    I’m running Windows 7 by the way.

  30. Gintare Says:
    December 27th, 2009 at 11:08 am

    Hi,

    “In Local Security Policy right click Software Restriction Policies and click “New Software Rectriction Policy”.
    My Action menu don’t work and I can’t click new software rectriction policy. Why?

    Please, help me.

  31. Kelly Says:
    January 2nd, 2010 at 1:37 am

    I’m using Windows Vista Home Premium 64…I tried the second step and I could not find Local Security Policy. I tried to run secpol.msc /s but it said it cannot be found.

    So, I downloaded the PolicyScope. I don’t really know how it works so I just downloaded, double clicked (in WinRAR) and allowed it.

    I tried uninstalling something again but it didn’t let me. Help please Jesse? Thanks :D

  32. Jesse Says:
    January 2nd, 2010 at 8:31 pm

    did you try adding the registry files I listed?? I’ve never heard of the tool you downloaded.. but basically if you open those .reg files on my site it will import the policy that secpol adds. I figured out where it was using procmon.

    let me know if it works.

  33. wendiie Says:
    January 2nd, 2010 at 11:22 pm

    thank you so much (:
    it actually work
    :D
    life saver .but does it gives a virus :P
    xo.

  34. Lisa Says:
    January 5th, 2010 at 2:24 pm

    I am in the same boat! I tried both your registry files. Nothing worked. I have a HP Pavillion with Vista 64-bit.

    I am trying to update itunes. Would not complete. I also cannot uninstall itunes. I was able to unistall something completely different. . I tried to just install Quicktime first and I get that policy prevention error.

    :( Lisa

  35. frank Laurent Says:
    January 7th, 2010 at 4:57 pm

    Try turning off UAC

    Control Panel>User Accounts, User Accounts,
    Turn User Account Control on or off
    Source(s):
    http://forums.techguy.org/windows-vista-7/657215-system-administrator-has-set-policies.html

    It fixed mine which had Vista

  36. Jesse Says:
    January 26th, 2010 at 9:38 am

    Please try to refrain from chastising people from whom you are asking free help…. The reason it’s not explained, is it’s not necessary- double clicking on my downloaded reg files will install them…

    If you do need to access the registry, you would goto start–> run and then type regedit..

    Next time, please ask nicely… i’m offering free help, and I dont think it’s too much to ask that you be polite.

  37. Vinay B Says:
    January 30th, 2010 at 11:58 pm

    The solution provided here worked for me…

    http://social.answers.microsoft.com/Forums/en-US/vistasecurity/thread/84890be5-45c2-4e4d-af2f-37e72fbfe3b1

  38. sunny Says:
    February 1st, 2010 at 3:00 am

    The method 1 work, but when you install, you need to point to the install file and right click, then select “Run as Administrator”. This solves my problem, may be I wasn’t setup as Administrator” althought I thought I am an Admin.

  39. Zid Says:
    February 20th, 2010 at 10:55 am

    Hi, I tried the alternative part by creating DisableMSI but still won’t work. I’m using XP Home Ed SP2 upgrade to SP3. I’m installing the Scorch Viewer Plugin and still the message still appears. And I can’t even find the product on HKEY_CLASSES_ROOT\Installer\Products\

    Thanks!

  40. Jake Ames Says:
    February 23rd, 2010 at 3:25 pm

    God bless you my man!! I have had this issue on a relatively new (to me) XPMC computer for about a month and have had no luck at all in fixing this. A windows update messed me up by the way – sometime mid January/10. Your fix that worked for me was to create a new security policy.

    I had tried almost every thing to do with the security and was getting close to flat lining this and rebuilding this computer. So … thanks again.

    jake

  41. Rashawn Says:
    February 25th, 2010 at 5:33 pm

    I have windows acer computer and can’t find the local security policy and when typing in the aboved mentioned in run, it says, ” windows can not find ’secpol.msc /s’ . Make sure you typed the names correctly then try again.

  42. mr.tun tun zaw Says:
    February 27th, 2010 at 9:29 pm

    very very thanks for the solution of installer error

  43. siva kumar Says:
    March 2nd, 2010 at 6:33 pm

    i have tried

    1)HKLM\Software\Policies\Microsoft\Windows\Installer

    2)Local Security Policy set to ALL USERS EXCEPT LOCAL ADMINISTRATORS”

    3)HKEY_CLASSES_ROOT\Installer\Products\

    but could not install the nymgo_installer software. Could you plz help me. it still gives me the error system administrator has set policies to prevent this installation

  44. siva kumar Says:
    March 2nd, 2010 at 6:38 pm

    i am running windows XP and also login as administrator

  45. Jesse Says:
    March 22nd, 2010 at 2:04 pm

    to fix this you probably have windows home, try running my Registry keys…

  46. JosR Says:
    March 26th, 2010 at 10:14 pm

    I type ’secpol.msc /s’ (I’ve tryed just secpol.msc, I’ve taken the space out of the c and /, I’ve tried it with the quotes and I tried just what was in the quotes with no changes) and it still doesn’t work for me, I cannot find Local Security Policy

  47. Jesse Says:
    March 26th, 2010 at 10:27 pm

    Please go back and re-read the UPDATE section of this post that explains what to do if you dont / cant find secpol.msc.. Please let me know if this resolves your problem.

  48. Grecko Says:
    March 31st, 2010 at 7:31 am

    Thanks dude, this help me a lot!!!

  49. Thet Htut Naing (Spring) Says:
    April 5th, 2010 at 1:51 am

    Ths alot

  50. Jim Says:
    April 16th, 2010 at 3:29 pm

    The reghack worked for me on a 2008DC. Thanks man!

  51. Sam Says:
    April 27th, 2010 at 4:39 pm

    Fix #2 worked for me. Thanks a lot!

  52. Techman Says:
    April 27th, 2010 at 11:47 pm

    I tried everything on this page for my Windows Vista Home Basic, and this is what finally worked. http://msdn.microsoft.com/en-us/library/aa367561(VS.85).aspx

    I created the AlwaysInstallElevated under local user since it did not exist and turned set both to a value of 1. Create a restore point prior to messing with the Registry and using REGEDIT.

  53. A Says:
    April 28th, 2010 at 12:15 am

    Good Recommendation. Thanks.

  54. rencourt Says:
    May 4th, 2010 at 10:13 pm

    Hi, I am having the issue with “The system administrator has set policies to prevent this installation” error.

    This happens in safe mode while logged in as administrator with most any exe file!

    In regular mode I am getting ‘windows can not access the specified device path…’

    While in safe mode, I am logged in as administrator.

    I have windows xp 64bit version… so the vista fix wont work for me.

    There are many conversations going back and forth, so Im not sure I have seen an answer for those requesting help on the xp problem… please forgive me if I am wrong… any help would be MOST appreciated!
    :)

  55. Brian Says:
    May 10th, 2010 at 9:21 pm

    Neither reg fix worked for me :( Still can’t install update to Open Office which is very odd since the original installed just fine. Odder still is this mischievous ‘Administrator’ who has been setting policies behind my back.

  56. tron Says:
    May 12th, 2010 at 12:16 am

    thank you very much to help me from problem

  57. tron Says:
    May 12th, 2010 at 12:35 am

    i can open installer windows internet explorer plat form preview version 1.9.7766.6000 but i can’t open installer adobe 9.3 and flash player 10
    can you help me plzz

  58. tron Says:
    May 12th, 2010 at 12:42 am

    i tell you about can’t open installer it in the flashdrive

    can you tell me what happen in my flash drive

  59. Jesse Says:
    May 20th, 2010 at 3:37 pm

    I dont think you can install stuff in safe mode….

  60. Mark the Mackem Says:
    May 20th, 2010 at 4:17 pm

    Windows 7 solution (worked for me anyway) that needs you to be logged in as administrator – i.e. the main account on the computer:

    Right click the program and select “run as administrator”.

    **If that option is not available** . . .

    go to
    Start/All programs/Accessories
    and right click on the command prompt, then select “run as administrator”.

    From within the command prompt, navigate to the folder containing the program you want to run, then type the file name to run it.

    e.g.
    if your program is abc.exe in c:\folder1\folder2, you would type
    cd folder1\folder2
    and then type
    abc.exe

    Good luck!

  61. Tubbs Says:
    June 9th, 2010 at 4:13 pm

    to Mark the Mackem –

    u must be a genius

    I don’t know your average joe would figure this out.

    I seriously regret updating from XP to Windows 7.

    mahalo

  62. kyaw Says:
    June 24th, 2010 at 12:55 am

    thanks million
    i solved with that.

  63. will Says:
    June 28th, 2010 at 6:26 pm

    I cant find Local Security Policy .

  64. ss Says:
    June 30th, 2010 at 4:12 am

    thanks millions

  65. mauricio Says:
    July 19th, 2010 at 2:29 pm

    Thanks man!!!!!!!!!!

  66. jacquelyn Says:
    August 2nd, 2010 at 2:53 pm

    i tried every single suggestion but it did not work finally i tried this i removed my antivirus first which is norton then uninstall the software that i am having trouble removing and everything starts to work.

  67. Abdullah Says:
    September 3rd, 2010 at 10:26 am

    Thanks to you alot, But still that error appare
    so i can’t updata itunes ):

  68. Brokk Says:
    October 11th, 2010 at 4:54 pm

    Nothing in the original or update worked for me (tried both registry files). Using Vista Home edition. However, the fix from comment #52 – Techman seems to be working. At least that message hasn’t popped up yet, and it usually happens pretty quickly.

  69. ray Says:
    October 20th, 2010 at 3:10 am

    i tried the update on my hp laptop with win xp and still no luck. cant run cmd prgm or run administrator however, i am logged on as admin? did the regedit with no luck as well. any ideas?

  70. razl Says:
    November 30th, 2010 at 9:30 pm

    Hallelujah (sp?) – it worked for Windows XP home edition!!!

  71. Aron Says:
    December 24th, 2010 at 7:28 pm

    Okey.. I’ve been sitting here for days trying to figure this one out. I’ve tried every single solution posted here, from the original article to each and every one of the posts. Still there is no change in the error-message :/

    I’m running on Windows Vista Home and I’m trying to install a Driver called “MobilePre” for an m-audio soundcard. But as soon as I in any way try to start the installation the error pops up. (Both from the CD and a .exe driver that I downloaded)

    Quite positive that I haven’t made any mistakes working through all of the solutions, I’ve lost a bit of hope ^^’ Anyone know some other possible way of getting around this? Or maybe I should just give up and try getting hold of windows 7 or xp.. since Vista always has these impossible problems O.o

  72. Aron Says:
    December 24th, 2010 at 7:33 pm

    Oh, and Merry Christmas! Thanks to all or anyone for trying fix these things =) Many smart solutions above.. just don’t get why none work in my case :/

  73. Angelo Says:
    October 20th, 2011 at 9:16 pm

    The first solution worked for me (Editing the Local Security policy).

    I was unable to install ESET Smart Security v5 on a Win7 Pro 32bit machine.

    Following your help it worked. Thanks.

  74. Natarajan Says:
    December 15th, 2011 at 2:53 am

    Editing the Local Securitu Policy worked for me. Thanks a lot. :)

  75. peter Says:
    January 27th, 2012 at 2:51 am

    It can done thank you very very… much

  76. SAMI Says:
    February 28th, 2012 at 6:55 pm

    Jesse you r realli a genius. The second step about reading the registry to HKLM and disabling MSI worked for me, but hey about the HKEY CLASSE_INSTALLER_PRODUCT and find the product that is causing the problem
    how can I find the product that is causing the problem when nothing shows that a product is faulty

  77. Donald Says:
    March 17th, 2012 at 1:12 pm

    Awesome fix on option one for windows 7.

  78. Kim Leng Says:
    April 7th, 2012 at 1:18 am

    thks Wendy,

    i follow your steps, and it works.

  79. gary Says:
    May 11th, 2012 at 9:38 pm

    I did step 1 and didnt work. I have windows 7 64 ultimate.
    I tried step 2 and there is no Installer listed in the windows folder to do the step.?? Please help. Trying to install Itunes.

  80. gary Says:
    May 11th, 2012 at 9:58 pm

    ohh my GOD. Here it is people.

    Goto User accounts.
    Change user account setting to never notify then it will want you to reboot.
    After reboot, install your software, then go bach and put setting as it was. Ta Daaaaaaaa

  81. Heidi Says:
    November 30th, 2012 at 4:08 am

    Thanks! I had to edit the registry as well, but then it worked :)

Comments