I'm trying to get some software installed on my company laptop (Business Intelligence SSDT for Visual Studio). As a developer, I have administrator rights, and have never run into an issue installing software before. The software has been approved by my company.
SSDI needs to install Microsoft SQL Server Data Tools, which fails during setup due to "Rule 'Setup account privileges' failed." I've traced this issue back to a group policy setting for "Debug programs":
- Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment
In the list of policies, the "Debug programs" security settings does not have "Administrators" listed. And although I am part of the administrators group, I am unable to add groups to this policy.
Is there some way I can "temporarily" disable or remove these group settings, install the software I need, then re-enable everything afterwards? Or better yet - add the administrator group to the policy?
I've seen several options, but I don't want to proceed with half-baked ideas that could affect my laptop's access to the company network.
For example, could I:
- Right-click into my Local Computer Policy > Properties, and select the option to "Disable Computer Configuration settings"?
- Edit the registry to remove group policy settings?
- Create a non-domain user (a true "local admin" user?) that has no GPO restrictions, disconnect from any network, and install the software from there?
Are there risks to the above options that I would not be able to reverse myself? Or are there other better options?
Side note: My first step troubleshooting this was to contact my system admin, who informed me that I should have "full control" over all my local policies, including the "Debug programs". According to him, there should be no permission / group policy restrictions for administrators.
His thought is that the issue is coming from some sort of permission (or as he put it, "sysadmin" access) to our SQL servers, and he would have to reach out to the server team and get back to me in a few days. I have permission to "explore" my own solutions in the mean time.