Article ID: 835427
This article has been archived. It is offered "as is" and will no longer be updated.
After you modify the Software Installation settings in a Group Policy object (GPO) to revoke users' permissions for an advertised program that you plan to retire, users who have roaming profiles may still be able to install the program. When a roaming profile user logs on to a computer other than the computer that you used when you revoked permissions, the icon for the program appears on the Start menu. If that user clicks the icon for the program, Microsoft Windows Installer installs the program. Or, if that user double-clicks a document that is associated with the program, Windows Installer installs the program.
This problem occurs because Group Policy has to access the program's application advertisement script (.aas) file to remove the icon on the Start menu and to remove the file associations. The .aas file is hosted in the system volume folder (Sysvol). However, because the users' permissions for the package have been removed, Group Policy cannot remove the icon from the Start menu, and it cannot remove the file associations. If the package is still accessible from the deployment location, roaming users can install the program because the Windows Installer package information is present in the users' profile.
To resolve this problem, use one of the following methods instead of revoking users' permissions for the program: