Does SA support NC/WSAM if the client PC dont have administrator Privilege

[husni1984_]

Hi All,

As per subject

Does SA support NC/WSAM if the client PC dont have administrator Privilege?

Thanks and Regards,

Cunny

[Jickfoo_]

I believe it does. To install NC or WSAM you'll need to either have Admin rights or the 'Juniper Installer Service" installed.

[husni1984_]

THanks Jickfoo,

I've Already try to install manually using "Juniper Installer Service", but somehow it failed and prompted me "privilage bla bla bla.." warning, Is there any solution about this?

Because for some case users want to access the resources using ssl vpn via internet cafe which is they dont need to "install anything".

Please advice

Thanks and Regards

[Jickfoo_]

I believe the Installer Service is meant to be installed ahead of time with Admin Privledges. There's also an Active X component that is suppose to handle the installation of the Installer Service. I'd make sure you have the domain name in the 'trusted sites' of your browser. That might help.

Also, it would be tough to get Network Connect installed on kiosk type machines. It needs to install network adapters which will require some serious privledges. Also, not sure you want a kiosk with full blown IP Access to your network. Could be some nastyware on those machines.

Anyway you could get by with web-rewriting for these Kiosk users ? Allow them to get to Outlook Web Access and the like. That's typically considered safe and doesnt require any installs.

Just my 2 cents. Good Luck.

[husni1984_]

Thanks for your explanation, but I'm still curious about this cause I've read this KB (http://kb.pulsesecure.net/KB9084)

""Juniper Installer Service interacts with the Windows Installer Service on behalf of the user to install the client components, thus bypassing the need for administrator rights on the PC. The manual installer can be downloaded from the IVE (Instant Virtual Extranet) by signing in as an administrator to the IVE and navigating to System > Installers"

so my conclusion, JIS only usefull if only we update the client component , not to bypass the administrator rigths to conduct either NC/WSAM right and install it?

please advice

Thanks and Regards,

Husni

[MattS_]

The Juniper Installer Service interacts with the Windows Installer Service on behalf of the user to install the client components, thus bypassing the need for administrator rights on the PC.

http://kb.pulsesecure.net/KB2657 details how to install it in silent mode. For future upgrades, JIS is forward compatible as long as the client has the correct Java version (http://kb.pulsesecure.net/KB15210).

[husni1984_]

Hi Matt,

Thanks for the reply, I've already done this but still it can't. Windows still prompt me the password of the administrator.

Please advice

Thanks and Regards,

Cunny

[rdit_]

Hey Cunny,

I think its not possible with absolutely no admin previleges. Thats the alltime problem of this solution. You can provide bookmarks and everything else that doesnt requires the installation of any applets or software. So when you try to connect from an internet-cafe to the SSL VPN gateway, you'll surely have SSL, but not really a VPN, cause you wont be able to run network connect. ;-) and also you should not configure any host checker policy then, cause this one will also fail because of not being able to install hostchecker components. same for securemeeting and any other applications like that.

means, if you have a client for which you have absolutely no control, even installerservice wont help you in that case - cause this one needs root-previleges aswell to once install the components.

sorry for not being able to give you another solution for that. would be great to have some kind of hostchecker portable or network connect portable as other apps from portableapps.com. this would be just perfect for SSL VPN, you could just launch everything from your usb-device, anywhere you are (depending on HC-policy definedby the IVE) and independend from client-side previleges. but i think that isnt possible for network connect, cause it installs a service, a network adapter and drivers for it.

but would be something to think about in my opinion ;-)

best regards and good luck cunny

[Tessian_ · Accepted solution]

Just as others have said, Juniper Installer Service must be installed beforehand by someone with administrative privileges, once you do that any user on that computer, regardless of their permissions, can install/upgrade/use the Juniper software. There's no way around that, JIS can only be installed by an admin.

Alternatively, you could technically install WSAM/NC manually as an administrator beforehand too, but this will only work until you upgrade the IVE then you'd have to repeat, which is why JIS is recommended instead.

If you can't install JIS beforehand with admin rights on the machines then your only option would be to use features of the VPN that don't require admin rights... basically Web / File bookmarks and maybe Terminal Services / SSH sessions. NC / WSAM / JSAM / Host Checker all require either a) admin rights or b) JIS installed prior by an admin in order to work.

[jr94_]

Hello,

I have the same type of problem, with no more success... I have installed the "Juniper Installer Services" with admin rigths, no problem. Then I have tried to installed the network connect client... and it does not work. I have a message telling me that I need admin priviledges .

I have to notice the fact that users do not have rigths on the "c:/Program Files" folder. So, I have give rigths on the "c:/Program Files/Juniper Networks" and "c:/Document and settings/All Users/Application Data/Juniper Networks" folders, also on the "HKLM/Software/Juniper Networks" key.

What the minimum necessary rigths when we wanna upgrade/install a network connect client?

jr94