Answered by:
Give users permission to install fonts under Windows 7
Question
-
I want to give non-admin users permission to install fonts in Windows 7. Ive tried giving permission to the fonts folder and fontcache.dat file as seen in the policy below, but it is not working.
Any help is greatly appreciated.
-John
File System hideC:\WINDOWS\FONTS hideWinning GPO StudentsInstallFonts Configure this file or folder then: Propagate inheritable permissions to all subfolders and filesOwner PermissionsType Name Permission Apply To Allow CREATOR OWNER Full Control Subfolders and files only Allow NT AUTHORITY\SYSTEM Full Control This folder, subfolders and files Allow BUILTIN\Administrators Full Control This folder, subfolders and files Allow EXP\students Modify This folder, subfolders and files Allow BUILTIN\Users Read and Execute This folder, subfolders and files Allow inheritable permissions from the parent to propagate to this object and all child objects Disabled Auditing
No auditing specifiedC:\WINDOWS\SYSTEM32\FNTCACHE.DAT hideWinning GPO StudentsInstallFonts Configure this file or folder then: Propagate inheritable permissions to all subfolders and filesOwner PermissionsType Name Permission Apply To Allow CREATOR OWNER Full Control Subfolders and files only Allow NT AUTHORITY\SYSTEM Full Control This folder, subfolders and files Allow BUILTIN\Administrators Full Control This folder, subfolders and files Allow EXP\students Modify This folder, subfolders and files Allow BUILTIN\Users Read and Execute This folder, subfolders and files Allow inheritable permissions from the parent to propagate to this object and all child objects Disabled
Answers
-
I managed to get this working in XP by giving everyone write access to the registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Fonts - not sure if this works in Windows 7 though.
- Marked as answer by Mervyn ZhangModerator Thursday, April 22, 2010 8:54 AM
All replies
-
Hi,
it seems like there is no official and easy way to do this. Apparently, you have to be local administrator to do that. Have you seen the following discussion on this:
hope that helps,
Gunter- Proposed as answer by Hetti Arachchige V Aravinda Sunday, August 4, 2013 10:14 AM
-
-
Hi,
there is currently another discussion with the same topic:
hope that helps.
Gunter
-
Please try the following suggestions:
How To Install Fonts in Windows Without Administrator Power
http://www.dailygyan.com/2008/05/how-to-install-fonts-in-windows-without.htmlPlease Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.
Thanks.
This posting is provided "AS IS" with no warranties, and confers no rights. -
I managed to get this working in XP by giving everyone write access to the registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Fonts - not sure if this works in Windows 7 though.
- Marked as answer by Mervyn ZhangModerator Thursday, April 22, 2010 8:54 AM
-
-
Using what I read in other threads I figured out this solution and tested it working today on Windows 7 Enterprise.
Let me know if it helps.
-----------------------------------------------------------------------------------------
Log on as administrator. Open command prompt as admin.
attrib -r -s %systemroot%\fonts
takeown /f "%systemroot%\fonts" /r /d n
(optional - gives administrators full rights on the fonts folder): icacls "%systemroot%\fonts" /grant administrators:F /t
You can now add or change permissions on the Fonts folder like any regular folder.
Give user(s) modify access to %systemroot%\Fonts
icacls "%systemroot%\fonts" /grant USERNAMEorGROUP:M /t
Give user(s) modify access to %systemroot%\system32\FNTCACHE.dat
icacls "%systemroot%\system32\FNTCACHE.dat" /grant USERNAMEorGROUP:M /t
Give user(s) modify access to HKLM\Software\Microsoft\Windows NT\Current Version\Fonts- Proposed as answer by BelushiLomax Wednesday, March 28, 2012 2:22 AM
-
-
-
No this does not work with uac. I've only found 1 solution to use UAC and admin rights. I've done alot of searching and I don't think anyone has been able to get both.
First you need a 3rd party Font installer/viewer AMP Font viewer is good its free infact its better than what windows has http://www.ampsoft.net/utilities/FontViewer.php
Once installed right click the short cut and then click left compatibility and select run as administrator.
Second you need to use script logic privilege authority. http://www.scriptlogic.com/ I use this program a lot to give basic users rights to certain .exe or folder paths. It uses GPO so it can push its policy right away to many machines its awesome. A good example is I allow users with this program to update adobe reader and Java since I can give them admin rights to those 2 things and NOT the whole machine.
In privilege authority you create a policy to give admins rights to the AMP .exe.
Now they can open the program it will run as admin and I have given them rights to do so. This allows them not to have full admin rights to the whole PC and it allows that 1 program to install fonts even with uac enbled.
-
@tacktick This basically worked, but after completing your steps, you cannot install fonts by copying them to c:\windows\fonts. To remedy this, run this command at the end:
attrib +s %systemroot%\fonts
@h0dg3s, I'm also only able to get this working with TTF/OTF fonts. Type 1 fonts (.PFM,.PFB) are only able to be installed by a user with admin rights. Annoying, but since most of my font install requests are from users with .TTF's, this still saves me some headaches.
My complete steps are as follows:
Run this first:
attrib -r -s %systemroot%\fonts
Now, go into the security tab for C:\Windows\Fonts
Grant <DOMAIN>\administrator: Full control
Grant everyone: r/w & modify permissionsGo into security tab for C:\Windows\system32\FNTCACHE.dat
Grant <DOMAIN>\administrator: Full control
Grant everyone: r/w & modify permissionsOpen Regedit and navigate to:
HKLM\Software\Microsoft\Windows NT\Current Version\Fonts
On that folder, right click > Permissions
Grant everyone: full controlFinally, run this to reenable installing fonts by copying to C:\Windows\Fonts
attrib +s %systemroot%\fonts
-
This is a good solution but without using UAC. If you want UAC to be enabled then there you have to play with other software to replace fontview.exe because using ACT and modifying shim database doesn't help.
Here are the screenshots: http://tompopov.blogspot.com/2011/05/allowing-non-admin-users-to-install.html
-
-
-
> Apparently it is not possible to set the rights on the fonts folder> through GPO. This was possible under WXP.That's true, because beginning with Vista, the Trusted Installer ownsthe Fonts folder, not SYSTEM. This results in GPO being unable to changeACLs.
Martin
NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :)) -
-
-
-
If you use SCCM I have created a solution
http://fritschetom.blogspot.com/2014/11/configmgr-install-fonts-as-application.html
-
Maybe this has already been addressed with all the abbreviations and short-cut speak, so I will not use any of that and simply give you the information I've learned will work for Windows 7 Professional Home edition.
Administrator accounts are obviously, NOT full administrator accounts anymore (I think I read it was after XP that they enabled the rotten and quite annoying UAC <-- that one, I know. ;) ), and in order to get it working the way you need to when accomplishing tasks, you have to do something that will globally elevate the account. This elevation will then grant global rights to modify as needed.
Control Panel | Administrative Tools | Computer Management
Once this comes up, a list will appear in the left pane. Click on Local Users and Groups, and then USERS in the middle pane. Once you see Administrators, right-click it and choose Properties. If this is the first time you're seeing it, chances are "Account is disabled" will still be checked. UNCHECK THAT. (It's also where you can grant these permissions to all the other accounts the administrator has in his or other groups.)
NOTE: This will leave your system vulnerable to malicious files that you may not catch UPON INSTALLATION. I downloaded from a trusted source last Thanksgiving and missed unchecking the EULA box and ended up with malware I had a heck of a time getting rid of, so you need to be EXTRA CAREFUL when unchecking this option.
However, once you do, you will then have FULL and REAL administrative rights over all file modifications, and yes, you'll be able to install fonts into your System Font folder. I don't know, however, about anything other than TTF.
HTH and good-luck. :)
Opus