When trying to install a program from an MSI package on a workstation (administrator rights are available), the error "This installation is prohibited by the policy set by the system administrator" occurs. Checked - no other MSI file also starts. What to do?
Answer
Message " » ( The system administrator has set policies to prevent this installation) can appear both during the launch of exe files and during the installation of MSI packages. Even if the restrictions were not specifically configured, in some cases Windows or some other program could independently change the settings of the Software Restriction Policies (SRP). Here is what you can do in this case:
Temporarily disable UAC
A possible cause of the application installation issue could be UAC policies. Try to install the application with UAC disabled (I remind you that disabling UAC is not a recommended step, and after testing it should be enabled back).
If this does not help to get rid of the notification, then try disabling the blocking policy that blocks the execution of MSI packages by the Windows Installer through the local group policy editor or the registry.
Windows Installer Service
Open the Services Management Console (services.msc) and make sure the Windows Installer service is present on the system and running (if not, start the service).
Group Policy Disable Windows Installer
Check that there are no policies in the Software Restriction Policies that prevent the specified file (file type) from running. If there are such policies, remove them. These policies are located in Computer Configuration -> Windows Settings -> Security Settings -> Software Restriction Policies (Computer Configuration -> Windows Configuration -> Security Settings -> Software Restriction Policies)
Open a command prompt and run gpupdate /force.
DisableMSI registry key
If you are using the Home Edition Windows operating system, then the Local Group Policy Editor will not be available in it. You can make all the necessary changes through the registry. For this:
After the above steps, be sure to restart your computer and run the installation of the desired program. The error will no longer appear.
If you can't solve the problem, try creating a new folder inside Program Files or Windows, copy the distribution into it, and run it as an administrator.
Usually passes without problems, but sometimes due to errors it becomes impossible. Many users, when trying to install programs, encountered a new problem: "This installation is prohibited by the policy set by the system administrator." Occasionally, a code is displayed to help users troubleshoot the problem. This error is not critical at all. You can get rid of the problem using one of several methods. All of them are pretty simple. Follow them in turn until you get rid of the annoying reminder.
Correction of the error "This installation is prohibited by the policy set by the system administrator."
In some cases, when you run the installation file, Windows issues a warning and a security message. They can be disabled during the installation of problematic software.
IMPORTANT. Immediately after the end of the manipulations, it is necessary to return this parameter to its original place. Otherwise, the computer will remain unprotected.
- Open the control panel by searching in the start menu.
- Switch the "View" option to "Large Icons", and find "User Accounts".
- Open the item and click "Change User Account Control Settings".
You will notice that you can select multiple options on the slider. If your slider is set to the top level, the number of such warning system messages will be maximum. In this case, the error described above most often occurs precisely because of user account control. If installation is denied based on a system policy, you first need to disable policies that block the installation of programs. Try decreasing the value by one if it is at the top mark.
Check if it helped. Repeat this process if the error still appears or if UAC is disabled completely. You can immediately set the minimum value and proceed to install the problematic software. Regardless of the result of the installation, be sure to return the slider to its previous position.
View installation policies in the Local Group Policy Editor
Error is caused by a disallowing security setting and will need to be edited.
- Run - gpedit.msc.
- Computer Configuration/Administrative Templates/Windows Components/Windows Installer.
- Move to the right side of the screen.
- Double-click the Turn off Windows Installer option, check the box next to Enabled, and set Turn off Windows Installer to Never.
If you mistakenly edit the wrong key, the consequences can be quite serious. Therefore, if you are not confident in your abilities, it is better to postpone this method for later. If this setting is still prohibited by administrator policy, proceed to edit the registry.
- In the registry editor follow the directory:
HKEY_LOCAL_MACHINE/Software/Policies/Microsoft/Windows Installer
- Right-click in an empty area/Create DWORD (32-bit).
- Rename to DisableMSI and set the option to 1.
- Navigate to the next location and browse through the list until you find the software you tried to install on your computer.
HKEY_CLASSES_ROOT Installer Products
- The key you need will be presented as a folder. Right-click on it and select "Delete".
After that, try installing the software again and check if the error message still appears.
Additional methods to fix the error "This installation is prohibited by policy ..."
Just try running the setup file as administrator. This is the most primitive solution, but, nevertheless, in many cases it worked. So before you try more advanced fixes, make sure you try running as admin and save yourself a couple of hours. Locate the installation file for the desired program and right-click on it. From the context menu, select the "Run as administrator" option and agree to any pop-up warnings that may appear.
Use a "hidden" administrator account
The occurrence of such an error means that you are not actually the administrator of your PC, even if your account is called administrator. This method is to run the problematic software from the admin account, and then log in again under the usual login.
- Click Start or the Win key and type cmd (or command prompt).
- Right-click it and select the "Run as administrator" option (or select the program with the keyboard arrows and launch it with the Ctrl+Shift+Enter key combination).
"net user administrator active: yes".
- After a couple of seconds, the message "Command completed successfully" will appear.
- Copy and paste the following command into the command prompt and press enter.
"net user administrator<пароль>».
- Instead of<пароль>enter your account password to log in.
- Log in to this administrator account and wait a couple of minutes before everything is ready.
Now you can try restarting your computer, logging into the new administrator account, and running the setup file. Once you're done with the hidden administrator account, you can disable it again by opening a command prompt as admin and typing the following command:
"net user administrator active: no".
After completing all these steps, the error "This installation is prohibited by the policy set by the system administrator" will no longer interfere with the normal operation of your PC.
Working in the 1C program allows different users to assign functional access to documents and directories of the base. For example:
- If the user works as an accountant, then he is assigned the appropriate role in 1C, which allows you to add, change, delete documents and reference books on business activities.
- If a 1C user works only with reports and views the database data, for example, a manager, then he is given the rights to read the data.
- A user who can work with all objects of the 1C - Administrator program has full rights and gets unlimited access to work with the database in 1C.
Access rights can only be configured Administrator- a 1C user who has been assigned Full rights.
Setting access rights in 1C 8.3 Accounting 3.0
In 1C: Accounting 8 ed. 3.0 there are 4 main profiles for working with the program:
- Administrator;
- Accountant;
- Chief Accountant;
- Synchronization with other programs;
- Only reading.
To understand the principle of setting rights in 1C, let's turn to the configurator. When analyzing configuration objects, we will see a special branch Roles, which lists all the possible accesses to the database data specified by the 1C developers:
Each role corresponds to a set of capabilities for working with configuration objects, these are
- Reading;
- Addition;
- holding;
- Cancellation of the event;
- Editing;
- Removal.
If you open some given role, then for each object you can view what you can do with each configuration object:
It is important to know that a 1C user can be assigned any set of roles from the list specified by the developers. At the same time, if in some role it is impossible to change the object, but in another role added to this user it is possible, then the resulting user rights will be - you can “change”. The roles complement each other. In order for an object not to be modified by the user, none of the roles assigned to it should have "Modify".
Setting access rights in 1C 8.3 Accounting
Setting access rights in 1C 8.3 is carried out in the Administration - User and rights settings section:
The User and Rights Settings window opens:
Consider the possibilities of setting up access in 1C.
How to create a new user in 1C 8.3
By default, the 1C program sets Login to the program is allowed, Show in selection list and entering the program using the login and password set in 1C. You can set the password yourself, or you can offer to set it to the program. As a rule, the password set by the 1C program corresponds to a more serious level of verification and it is more difficult to pick up such a password when hacking the system.
The password must be remembered! If the password is lost, only the Administrator can reset it. If the passwords are lost and the database cannot be entered, then you will have to “hack” the entrance to the database.
Specialists use a HEX editor for this and change the information responsible for working with users in the right places. It is possible, but not desirable, to do so.
How to set up access rights based on typical profiles in 1C 8.3
Each user (Administration - User and Rights Settings - Users) is assigned Access Rights from the list of profiles, which is in the configuration. For example, for the accountant Petrova S.B. assign the accountant profile:
Here we can also transfer the settings to a new user from a user already working in 1C: Functionality settings, internal report settings, etc., so as not to waste time and do not type everything manually:
We mark the settings for transferring to a new user Accountant Petrova from the user Administrator:
We transfer personal settings, print settings and Favorites:
We press the book. Select and in the settings selection form "Copy and close". All settings for the new user from the Administrator user have been migrated.
Setting access rights with the addition of new profiles in 1C 8.3
We create a new profile with limited access to directories and documents. Access group profiles - Create:
It is convenient to create a new profile according to 1C subsystems. For example, for the rights of the Calculator, we can note the following functionality:
- Reflection of salary in accounting;
- Reading taxes and contributions;
- Mutual settlements with employees;
- Personalized accounting;
- Payroll accounting:
According to the book Only selected roles a list of selected user roles is displayed. Personnel accounting can be set separately for the HR profile.
How to set up additional access rights to existing standard profiles in 1C 8.3
A specific 1C user with a selected profile can add functionality. For example, for the user Petrov, in the Accountant profile, the command is not available All features, but we can add it to this user. Go to Administration - User and Rights Settings - Access Group Profiles. Book. Create - All functions mode - add rights "All functions" mode:
We add a new profile to the accountant Petrova S.B.:
Setting up additional access rights to individual documents and directories in 1C 8.3
This setting provides for working with the configuration extension. Let's say you need to set up access for a 1C user to an arbitrary set of documents and directories. The set of these documents and reference books may be different - 1C developers are not able to provide all the options for suitable roles that users may need in practice. Moreover, requests for data access can be completely extraordinary.
In 1C 8.2, we had to remove the prohibition of editing from the configuration and add a new role to the Role objects, assigning access to the necessary directories and documents, and, accordingly, there were difficulties with the subsequent update of 1C. Such configurations were no longer automatically updated, so only users of organizations with 1C programmers on staff could afford such pleasure.
In 1C 8.3, due to the emergence of a new opportunity to work with configuration applications, we can realize our task of delimiting user rights without removing the prohibition of editing from the main configuration and leaving it completely standard. How to do this - now and consider:
- For reference Users we will introduce an additional attribute "Access_Sales_of_Goods", which will take the values "Yes" or "No".
We go Administration - General settings - Additional details and information. We enable the ability to work with "Details and information with a common list of values":
- Opening a hyperlink Additional details.
In the left column of the lists of configuration objects we find Users and click on the book. Add. Fill out the form that opens as shown below. The new attribute will have two values: "Yes" and "No". Combine the values in the "Access" group. Fill in the Main tab:
Fill in the Values tab:
- Now let's fill in this requisite for our users.
"Accountant Petrova" - No:
"Administrator" - Yes:
All the necessary actions in the 1C 8.3 base have been done, now we will work with configuration extension.
- We enter the database configurator: Configuration - Configuration extensions:
Adding a new configuration extension by book. +:
We agree with the default extension data or set our own:
Open the extension configuration by the book. :
Now we will transfer the data necessary for work from the main configuration. The created configuration extension "Extension 1" is still empty:
In the main configuration, we find in the documents - the document Sales of goods and services, and transfer the form with which we will work. For example, let's add "FormDocumentProducts" to the configuration extension by clicking on the name of the form and right-clicking on it. mice. From the drop-down menu, select the "Add to extension" command:
Open the form in the configuration extension and create an event handler Before Recording. When creating an event handler, the 1C 8.3 program will ask you to indicate where to create the program code. Choose: Create on the client and procedure on the server without context:
When creating an event, we will see in the empty cell of the “BeforeRecording” events the procedure for processing the event assigned by the 1C 8.3 program: “Ext1_BeforeRecording”:
Go to the form module and paste the following code:
We update the changes and run the database in user mode to check the changes made. We enter under the user Accountant Petrova and edit the document Sales of Goods and Services, press the book. burn:
For the administrator, editing the document will pass without problems.
The above program code can be put in the 1C 8.3 configuration extension for any document and directory, and this will allow you not to change the typical configuration, but at the same time solve the problem of access to database objects for different users.
How to provide access to a report option with individual settings for other users in 1C 8.3 ZUP, see our video: