As a domain admin, encountering "The System Administrator has set policies to prevent this installation" when trying to install an MSI package (like Git Extensions for Visual Studio) is particularly ironic. Let's break down why this happens even with admin privileges.

Windows Server 2012 implements several layers of installation control through Group Policy. The most relevant settings are:

// Common GPO paths that affect MSI installations:
1. Computer Configuration → Policies → Administrative Templates → Windows Components → Windows Installer
2. User Configuration → Policies → Administrative Templates → Windows Components → Windows Installer

These specific policies often trigger our error:

• Disable Windows Installer (Enabled = blocks all MSI installs)
• Always install with elevated privileges (Disabled = requires manual elevation)
• Prohibit non-administrators from applying vendor-signed updates (Enabled = blocks some updates)

Check current policy settings with PowerShell:

# Check applied GPOs
Get-GPResultantSetOfPolicy -ReportType Html -Path "C:\temp\gpresult.html"

# Check Windows Installer service status
Get-Service msiserver | Select Status,StartType

# View effective policies (requires RSAT)
Get-GPO -All | Where { $_.DisplayName -like "*Installer*" }

For lab environments only, you can force the installation using msiexec with logging:

msiexec /i "GitExtensions-4.0.1.12134.msi" /lvx* "C:\install.log" /qn

For domain-joined servers, modify Group Policy through:

1. gpmc.msc → Find the offending GPO
2. Navigate to: Computer Configuration → Policies → Administrative Templates → Windows Components → Windows Installer
3. Set "Disable Windows Installer" to Not Configured or Disabled
4. gpupdate /force

For enterprise environments, consider packaging the MSI in a System Center Configuration Manager application with proper deployment rights:

<Application>
  <MSI ProductCode="{YOUR-GUID}" 
        DeploymentType="Install" 
        BypassDisablePolicy="True"/>
</Application>

After making changes:

1. Run gpupdate /force
2. Restart the Windows Installer service: Restart-Service msiserver
3. Check event logs: Get-WinEvent -LogName Application | Where {$_.ProviderName -eq "MsiInstaller"}

---

When attempting to install Git Extensions for Visual Studio (or any MSI package) on Windows Server 2012 as a domain administrator, you might encounter the frustrating policy restriction error. Despite having admin privileges, the system blocks the installation with message: "The system administrator has set policies to prevent this installation."

Through my troubleshooting experience, I've found these common policy-related causes:

1. Software Restriction Policies (SRP) in Group Policy
2. Windows Installer Group Policy settings
3. AppLocker configurations
4. Unexpected inheritance of restrictive policies

First, let's verify the actual policy settings in play:

# Check applied Group Policies
gpresult /H gpresult.html

# Examine Windows Installer policies
reg query HKLM\Software\Policies\Microsoft\Windows\Installer

# Check Software Restriction Policies
reg query HKLM\Software\Policies\Microsoft\Windows\Safer

For most cases where you're certain it's not an intentional security policy, try this registry modification:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer]
"DisableMSI"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers]
"TransparentEnabled"=dword:00000000

After making these changes, restart the Windows Installer service:

net stop msiserver
net start msiserver

If you suspect domain Group Policy is overriding local settings, you'll need to either:

1. Contact your domain admin to modify the GPO
2. Temporarily disconnect from the domain (not recommended for production)
3. Use the local Group Policy Editor (gpedit.msc) to override domain policies

When policy changes aren't possible, consider these workarounds:

# Using msiexec with elevated privileges
msiexec /i "package.msi" /qn /norestart ALLUSERS=1

# Extracting MSI contents manually
msiexec /a "package.msi" /qb TARGETDIR="C:\extracted_files"

Enable verbose logging to pinpoint the exact policy blocking installation:

reg add HKLM\Software\Policies\Microsoft\Windows\Installer /v Logging /t REG_SZ /d "voicewarmupx" /f

# Install with logging
msiexec /i package.msi /L*v install.log

Search the log file for "policy" to find relevant entries about restrictions.

After applying fixes, verify the changes took effect:

# Check effective installer policies
reg query HKLM\Software\Policies\Microsoft\Windows\Installer /v DisableMSI

# Test with a sample MSI
msiexec /i test.msi /qn