Error Message Trying to Install Software in Domain

ID: Q233587

The information in this article applies to:

Microsoft Windows 2000 Advanced Server

SYMPTOMS

When an administrator from domain A attempts to install software on a computer in domain B within the same forest, the administrator receives various error messages either preventing installation or indicating that the software installation was unsuccessful. These error messages vary depending upon the software being installed, but may include the following error messages (from attempting to install either the Windows 2000 Resource Kit or Microsoft Office 97).

Installing Microsoft Office 97 may result in the following error messages:

Setup Initialization Error
Setup has encountered an error in the Registration Database.

Setup Error 168
Setup has encountered a problem updating your system registry.

Error 168 may be displayed numerous times in succession.

If the installer clicks OK for these error messages while installing Office 97, Setup proceeds with the installation process and copies files to the hard disk. When Setup finishes, it displays a message stating that the installation was unsuccessful.

After an unsuccessful installation of Office 97, if the Office Setup program is used to remove the Office files, the following message is displayed numerous times:

Failed to unregister .srg file

Installing the Windows 2000 Resource Kit may result in the following error messages:

Desktop
Access to the specified device, path, or file is denied.

Error 1925

Although there is no text displayed with error 1925, it is defined as "You do not have sufficient privileges to complete this installation for all users of the machine. Log on as administrator and then retry this installation."

CAUSE

The administrator account being used has not been granted the necessary authority required by the Setup program to write to the system files and/or registry on the computer. Depending on the software being installed, this could also include lacking the permission necessary to write information to Active Directory.

This issue is similar to that between domains with Microsoft Windows NT 4.0, in that either a specific user's account, or a group in which that user belongs, may be granted the necessary permissions to perform a task in the second domain. Typically, the Global Domain Administrators group from one domain is placed in the Local Domain Administrators group of the other domain (and if two-way authority is desired, vice-versa). This gives a member of the Domain Administrators group from one domain authority to administer the domain controllers in the second domain. However, with Windows 2000, both the groups and the "flow" of default permissions are different from that in Windows NT 4.0.

For additional information about groups and trusts, please see the following article in the Microsoft Knowledge Base:

Q199162 Issues with Global Groups, Local Groups, and Trusts

RESOLUTION

Add either the domain A administrator account or the enterprise administrator account to the domain B built-in Administrators group, or vice-versa, or do both.

Windows 2000 gives enterprise and domain administrators more detailed options for assigning user permissions for various tasks and allowing administrators control only over those areas they need to be able to administrator.

In the situation described in this article, and for a more detailed approach, the user's account could also be given just the necessary permissions to write to the specific Active Directory Organizational Unit (OU) or container object to which the software needs to write.

For additional information, please see the following articles in the Microsoft Knowledge Base:

Q221241 Access Control Entry Inheritance for Active Directory Objects

Q218596 Assigning Access Control Permissions on Properties of AD Object

Q178170 ACL Editor and Inheritance of Permissions

Additional query words: permission sw

Keywords : kbenv kberrmsg
Version : WINDOWS:2000
Platform : WINDOWS
Issue type : kbprb