MsiInstaller Event 1008 when trying to install 3DS Max 2011 after Group Policies apply on Domain connected Windows 7 x64 machine

when run setup 3ds max 2011 on windows 7 x64 machine when it's connected domain, program starts initialise, comes following message:

"this installation forbidden system policy. contact system administrator. #1"

followed by

"fatal error during installation."

at point setup.exe bombs out. in application log, message:

"the installation of c:\users\username\appdata\local\temp\_random.tmp\setupres\eval.msi not permitted due error in software restriction policy processing. object cannot trusted"

source: msiinstaller  event id: 1008

when run on machine before adding domain works ok, know it's policy or security setting of sort, can't see how. use applocker policies have been set allow admins run windows installer files, executables , scripts on path. i've unlinked virtually of policies without success in finding problem. applocker event log doesn't show errors suggest it's blocking program.

any gratefully received.

(i have posted question in windows 7 application compatibility forum here, recommended post here also)

hi  after long time isolate issue solve problem  install or uninstall autodesk product.

my situation : work great on 2008 domain until setup , deploy applocker  on windows 7 workstation .the problem have is  error 1008  msiinstaller  pop message ;

" installation of c:\users\username\appdata\local\temp\......eval.msi not permitted due error in software restriction policy processing. object cannot trusted"

when computer reboot take domain computer gpo  call "default applocker default"  dont know why  applocker gpo pushed @ right place  in regedit  . if mark "audit only"  mode  the autocad setup blocked.

steps resolve problem:

first set applocker domain gpo audit

check in registry @ these location:

[hkey_local_machine\software\policies\microsoft\windows\srpv2\script]
"enforcementmode"=dword:00000000 

[hkey_local_machine\software\wow6432node\policies\microsoft\windows\srpv2\script]
"enforcementmode"=dword:00000000

these 2 key above work applocker and  overwritten when startup computer. can check there if value change when change on domain gpo  one you  create.

now trick..  first set applocker domain gpo audit .after on workstation, check @ key below  can save hive before set  these 2 value 0  ... miracle i can install autocad product..!!!!

[hkey_local_machine\system\currentcontrolset\control\srp\gp\msi]
"enforcementmode"=dword:00000000
"enabledattributes"=dword:00000000

after installation can set value... but when reboot take domain gpo value..

in future check give a msi rule exeption work autodesk product (i try folder ,hashing no success..)

Windows Server  >  Group Policy