New Domain Default Software Installation

[jertsy]

Hi

 

I have a new 2012R2 domain and a 2012R2 test domain, by default on both domains users appear to be able to run .msi. I have tried installing a .exe and that get's an administrator prompt but not .msi. I have configured Computer configuration >policies>administrative template>Windows components>Windows installer>Turn off windows installer (enabled, for non managed applications only) but to no avail.

I have run group policy modelling and the policy is applying and winning.

 

Any ideas please?

 

Thanks,

Jertsy

[jertsy]

I have just set 'basic user' in userconfig>policies>Windows settings>security settings>Software restriction policies>security levels. It was on 'unrestricted'. I'm currently testing to make sure this does not have any adverse affect on pushing software out.