Allowing users to install fonts in Windows 7 (through GPO)

Question

This is somewhat related to my previous question, Why do installed fonts disappear after reboot?.

Having got the font install issue sorted out under XP just fine, recently we've got a Windows 7 workstation and I've created a special GPO for it. Initially it was UAC that was demanding administrative access to C:\windows\fonts despite the fact the policy dictates that directory is writable (as is the relevant registry entries, on XP anyway). The issue now though is that when I try to copy a font or hit install it claims that the font "does not appear to be a valid font". This happens with every type of font as well.

Is there some new and special consideration when allowing these changes on Windows 7?

Any input would be appreciated.

Many thanks, Doug

score 2 · Accepted Answer · edited Jun 11 '20 at 10:02

So I figured it out.

Having looked at the Resultant Set Of Policy and seeing nothing untoward there, I checked C:\windows\security\logs\winlogon.txt

The Windows 7 client GPO is a copy of the standard XP one that I created, and therefore had entries in it to allow domain users to edit the content of C:\windows\fonts.

However, Windows 7 shows this in winlogon.txt:

----Configure File Security...

Configure c:\windows\fonts.

Warning 5: Access is denied.

Error setting security on c:\windows\fonts.

I checked the GPO and removed the settings for this directory and re-added it, which upon a GPO update and restart gave me this:

----Configure File Security...

Configure c:\windows\fonts.

Configure c:\windows\system32\fntcache.dat.

File Security configuration was completed successfully.

I tried adding a font and voila! Worked as intended.

Hope this helps anyone else who may come across the same issue. No idea why re-adding the same security setting made it work but it did.

score 0 · Answer 2 · answered Dec 27 '21 at 12:54

0

You could try to use the Silent Install Builder from Apreltech at https://www.silentinstall.org/. This program builds MSI or EXE packages containing a font registry scripts. You could deploy Silent Install Builder's MSI through GPO.

answered Dec 27 '21 at 12:54

Altyn Sartaeva

11
1

the windows fonts folder can be read and accessed by users but duw the standard right they wont able to copy something inside. the only solution would be creating a group eith minimum of rights and allow them to do this. So initially your answer requires also administrative attention and privileges ;) – djdomi Dec 31 '21 at 18:01

score 0 · Answer 3 · answered Mar 18 '10 at 05:29

0

Well I can only suggest you have the UAC turned off because I have taken ownership and set the Windows 7 font directory and registry key permissions to allow users change access but the UAC keeps prompting for administrator credentials.

answered Mar 18 '10 at 05:29

Yeah, I have UAC turned off, you are correct. – djk Mar 18 '10 at 10:12

score 0 · Answer 4 · answered Oct 12 '13 at 02:47

This error occurs because the file attribute System is checked. Checked directorys at System cannot have their permissions changed. In my case I try these following command:

attrib -r -s %systemroot%\fonts

To correct these error below:

Warning 5: Access is denied.

Error setting security on c:\windows\fonts

score -2 · Answer 5 · edited Dec 09 '15 at 14:40

-2

Login with Admin account first

Go to Run Command
Type "regedit" click Enter
Now you can see " HKEY_LOCAL_MACHINE" click and explore it
next go to "SOFTWARE" then "MICROSOFT" after then "WINDOWS NT"
Now you can see "Current Version" and go to "Fonts"
Now you right Click on fonts
go to change permissions
make your local user permission for allow access..

edited Dec 09 '15 at 14:40

bummi

162
2
2
9

answered Dec 09 '15 at 14:12

Mohan Kumar P

1

3

How does this create a GPO to give desired result? – Dave M Dec 09 '15 at 15:07

Allowing users to install fonts in Windows 7 (through GPO)

5 Answers5

Linked