To set permissions for Group Policy Software Installation
  1. Open the Group Policy object (GPO) that you want to edit.

  2. In the console tree, right-click the icon or name of the GPO, and then click Properties.

  3. Click the Security tab, and in the Group or user names box, click the security group for which you want to set permissions.

  4. Do any of the following:

    • To change the set of security groups that has permissions on this GPO, click Add or Remove to add or remove security groups.

    • If the security group represents administrators (who manage software for users and computers in the organization), in the Permissions box for the selected security group, select the Allow check box for Full Control, and then click OK.

    • If the security group represents users (who use software that is assigned or published by an administrator), in the Permissions box for the selected security group, select the Allow check box for both Apply Group Policy and Read, and then click OK.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • The permissions that you set in this procedure pertain only to the GPO. In addition, the network must have a shared folder (a software distribution point) containing the packages to be installed. Administrators must have Full Control of the software distribution point, and users must have Read permission.