Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am creating a script to automate a deployment of Office 2010. Office 07 was not installed in a way that provides a clean upgrade path, and in an attempt to do things the right way I am clearing it out with the offscrub07.vbs script provided by Microsoft.

For some reason, when ran as part of the startup script it generates the error "Insufficient registry access permission" as seen in this screencap. This is causing the script to exit without removing Office 07. Here is the code snippit that is calling the vb script.

call cscript "%DeployServer%\Offscrub07.vbs" ProPlus /bypass 1 /q /s /NoCancel

The installer for Office 2010 is launched as part of the same script and succeeds on a clean test machine, so it would seem that it should have sufficient privleges. I had remembered reading that UAC could prevent some logon scripts from running, but I can't find anywhere that says this applies to startup scripts.

Is there a GPO setting I need to change to allow called scripts to run with elevated privleges, or some other way of doing this. I'm stuck with a case of not knowing what I don't know and my google-fu is failing me.

share|improve this question
up vote 1 down vote accepted

Took a while, and it would figure as soon as I ask a question I would shortly find an answer.

Only the script explicitly assigned as part of the GPO is run with elevated privleges. Calls to other scripts run as the built-in administrator account but will generate a UAC request which fails automatically because no user is logged in to prompt.

In order to process external calls, the built in administrator account must be able to elevate without prompting. This setting can be changed in the following location:

Computer Configuration | Policies | Windows Settings | Security Settings | Local Policies | Security Options | User Account Control: Admin Approval Mode for the Built-in Administrator account: Disabled

Oddly, disabled is the default, but it doesn't work unless manually set.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .