0

I'm trying to get some software installed on my company laptop (Business Intelligence SSDT for Visual Studio). As a developer, I have administrator rights, and have never run into an issue installing software before. The software has been approved by my company.

SSDI needs to install Microsoft SQL Server Data Tools, which fails during setup due to "Rule 'Setup account privileges' failed." I've traced this issue back to a group policy setting for "Debug programs":

  • Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment

In the list of policies, the "Debug programs" security settings does not have "Administrators" listed. And although I am part of the administrators group, I am unable to add groups to this policy.

Is there some way I can "temporarily" disable or remove these group settings, install the software I need, then re-enable everything afterwards? Or better yet - add the administrator group to the policy?

I've seen several options, but I don't want to proceed with half-baked ideas that could affect my laptop's access to the company network.

For example, could I:

  1. Right-click into my Local Computer Policy > Properties, and select the option to "Disable Computer Configuration settings"?
  2. Edit the registry to remove group policy settings?
  3. Create a non-domain user (a true "local admin" user?) that has no GPO restrictions, disconnect from any network, and install the software from there?

Are there risks to the above options that I would not be able to reverse myself? Or are there other better options?


Side note: My first step troubleshooting this was to contact my system admin, who informed me that I should have "full control" over all my local policies, including the "Debug programs". According to him, there should be no permission / group policy restrictions for administrators.

His thought is that the issue is coming from some sort of permission (or as he put it, "sysadmin" access) to our SQL servers, and he would have to reach out to the server team and get back to me in a few days. I have permission to "explore" my own solutions in the mean time.

  • however your question is also on topic here you may get better answer on serverfault.stackexchange.com – Máté Juhász Oct 25 '16 at 13:02
  • Is there a way to cross-post over there? I'm hesitant to double post... – BlueOrbit Oct 25 '16 at 13:03
  • unfortunately there isn't a way for that:( – Máté Juhász Oct 25 '16 at 13:15
  • "Is there some way I can "temporarily" disable or remove these group settings, install the software I need, then re-enable everything afterwards?" - Sounds like whle you have local Administrator permissions you are NOT an Administrator on the domain itself otherwise you would be able to modify this group policy. If this will make you feel better, you seem to know, more then your System Administrator does though. – Ramhound Oct 25 '16 at 13:56
0

As opposed to working around group policy, you might be able to add yourself or the Administrators group directly to the "Debug Privilege" right.

There's a command-line utility called NTRIGHTS which can do this:

Ntrights.exe -u Administrators +r SeDebugPrivilege

NTRights is part of the W2K3 resource kit, but it still works on more recent windows versions. See Windows 7 equivalent for ntrights.exe and http://ss64.com/nt/ntrights.html (I don't have a direct link on where to download it, but with some google sleuthing, or getting your hands on the W2K3 resource kit install, you'd have it).

  • you might have to log off and back on for the rights change to be effective – William Oct 25 '16 at 14:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.