Allowing users to install fonts in Windows 7 (through GPO)

Question

This is somewhat related to my previous question, Why do installed fonts disappear after reboot?.

Having got the font install issue sorted out under XP just fine, recently we've got a Windows 7 workstation and I've created a special GPO for it. Initially it was UAC that was demanding administrative access to C:\windows\fonts despite the fact the policy dictates that directory is writable (as is the relevant registry entries, on XP anyway). The issue now though is that when I try to copy a font or hit install it claims that the font "does not appear to be a valid font". This happens with every type of font as well.

Is there some new and special consideration when allowing these changes on Windows 7?

Any input would be appreciated.

Many thanks, Doug

Solution

So I figured it out.

Having looked at the Resultant Set Of Policy and seeing nothing untoward there, I checked C:\windows\security\logs\winlogon.txt

The Windows 7 client GPO is a copy of the standard XP one that I created, and therefore had entries in it to allow domain users to edit the content of C:\windows\fonts.

However, Windows 7 shows this in winlogon.txt:

----Configure File Security...

Configure c:\windows\fonts.

Warning 5: Access is denied.

Error setting security on c:\windows\fonts.

I checked the GPO and removed the settings for this directory and re-added it, which upon a GPO update and restart gave me this:

----Configure File Security...

Configure c:\windows\fonts.

Configure c:\windows\system32\fntcache.dat.

File Security configuration was completed successfully.

I tried adding a font and voila! Worked as intended.

Hope this helps anyone else who may come across the same issue. No idea why re-adding the same security setting made it work but it did.

Comments

[zeratool]

Yeah, I have UAC turned off, you are correct.

[Dave M]

How does this create a GPO to give desired result?

[djdomi]

the windows fonts folder can be read and accessed by users but duw the standard right they wont able to copy something inside. the only solution would be creating a group eith minimum of rights and allow them to do this. So initially your answer requires also administrative attention and privileges ;)