All Windows7 applications blocked via OSX Managed preferences - Parallels 6

C

Chris Tolhurst

Bit poster
Hi guys, I've got an interesting one for you.

I have just set up a Windows 7 Pro VM in Parallels v6.0.11990. Host OS is OS X 10.6.5.
The machine is running in a corporate environment using xServes with Open Directory authentication.

I have set up the Managed preferences to allow a standard user to run the VM and access all the required Parallels files, yet for some bizarre reason, any application I launch within Win7 (IE, Explorer, Calculator, etc) I get an OSX pop-up informing me I do not have access to the application I have opened. The majority of these programs will open and run fine despite this error, however IE will close immedately.

I have tried running the VM with shared application access to the Mac OS, and also tried it with all access between Host and VM locked out. I get the exact same issue every time.

However, running the exact same VM Image under a local admin user in OSX allows me to operate fine with no restrictions, leading me to come to the conclusion it is an access privilege issue.

Anyone aware of what I have missed to allow proper usage of the Windows7 VM?

Cheers in advance,

Chris
 
68 views and no reply?

If anyone else is having this issue, it might be an idea to post up your experiences to see if this can be resolved sooner.

Surely out of 68 people, someone knew either a way around this or was having the same problem.. Why else would you be looking at this post?
 
Thanks for the reply,

I have logged a ticket with the support team. ID: Parallels #1063808

Just thought I'd query the community as well to see if anyone had experienced anything similar

Cheers,

Chris
 
Chris Tolhurst said:
I have logged a ticket with the support team. ID: Parallels #1063808

Just thought I'd query the community as well to see if anyone had experienced anything similar
Click to expand...

I have just run into the exact same issue w/Parallels Desktop for Mac 6.0.11828 w/Windows Vista Home guest OS under Mac OS X 10.6.4 Snow Leopard. We use managed preferences to limit applications and, even with Configure... > Security set to "Isolate Mac from Windows" and ALL Configure... > Applications > "Share Windows Applications with Mac" checkboxes unchecked (yes, even before I set it to "Isolate Mac from Windows"), it still insists on try attempting to launch the fake/proxy Mac app for it, resulting in the application not being allowed to run and the real Windows counterpart being quit. Even if I delete ~/Applications/Windows\ Vista\ Applications, Parallels recreates it and still runs into Managed Preferences wall.

Please tell me there's a solution as we're currently dead in the water!
 
I am still communicating with Parallels Support to find a resolution. I will post here when I get further.

You may be interested in looking into a temporary workaround I have found though.

I have posted this up on the Apple forums here: http://discussions.info.apple.com/thread.jspa?messageID=12789263#12789263

Part of the thread:
This isn't completely related to the issue, but has resolved it to some extent.

I ran FS Eventer (A program that monitors which files are being accessed in the system at any given time) whilst attempting to open an application in the VM, and found that the file ~/Library/Preferences/com.parallels.desktop.plist was being written to. After looking at this file, I noticed that this was where the settings for the VM were stored. For example, Isolating the VM from OSX.

I found that many values were duplicated 4-5 times, and had different values. Possibly causing some conflicts. So i manually changed these with Plist Editor to all the same values to totally isolate the VM.
Click to expand...
After testing this with managed preferences set to allow the "~/Applications/Windows 7 Applications/" I was then able to launch the programs without the pop up errors. Still have the same issue with IE and Media Player crashing unless opened from the Application folder, but at least the annoying errors are gone.

Please be aware that this is NOT a fix, just a work around.

Hope you can get some relief from this.

Cheers,

Chris
 
I appreciate the suggestion.

While I was aware of the potential workaround and have tried it, we have an unrelated issue where whitelisting new applications and directories doesn't seem to take on our Mac OS X 10.6.4 workstations and the applications are still denied with a "You don't have permission to use the application" error. Unfortunately, this is one of the primary reasons we relied upon the ability to disable Mac OS X & Windows application integration under Parallels Desktop 5 for Mac.

I have also submitted a ticket with Parallels Support (#1068630), so hopefully we'll see some hopes of resolution in the near future. I did reference your ticket in mine.
 
Hi, guys,
as far as I understand you want to run guest applications w/o OSX dialogs with managed account on.

To do so, you can use one of two possibilities:
#1 Go to
System Preferences > Parental Controls > Apps tab and check necessary applications in Allowed Apps list.

#2 You can allow any application permanently by choosing "Always allow" button in "You don't have permission..." OSX dialog (i.e. using general OSX behavior)
 
NikZ said:
Hi, guys,
as far as I understand you want to run guest applications w/o OSX dialogs with managed account on.

To do so, you can use one of two possibilities:
#1 Go to
System Preferences > Parental Controls > Apps tab and check necessary applications in Allowed Apps list.

#2 You can allow any application permanently by choosing "Always allow" button in "You don't have permission..." OSX dialog (i.e. using general OSX behavior)
Click to expand...

The problem is that disabling "Share Windows Applications with Mac" should prevent Windows from creating the ~/Applications/Windows\ XXX\ Applications folder and launching the proxy apps contained therein when launching the counterpart in Windows, but doesn't. We've run into numerous VM configuration settings that when changed in the GUI, are reflected as changed in the GUI, but don't "take".

For us, the aforementioned "Share Windows Applications with Mac" as well as the "Require password to change VM state" preferences have been disabled, and the GUI shows them disabled, but the functionality is still in effect. For the former, this is hardly noticeable unless you're using Managed Preferences/Parental Controls at which point it's difficult to work around (esp. if the applications need to be signed for security reasons, which is the problem we have). The latter would be a little more apparent to everyone as it requires admin authentication to start/suspend/stop the VM. Obviously, both of these issues become major roadblocks in a managed environment.
 
Let me explain, how PD works under managed account.

For OSX to control guest applications just like the host ones we force shared applications to be on. Ground of this decision is that managed account rules for host applications must also be extended for guest ones for security reasons. If one is not allowed to launch resticted host application, he won't be allowed to launch resticted guest application either.
Forcing shared applications to be on permanently is the only way for guest applications to be controlled with OSX means.

The problems with launching applications mentioned before can be solved by using my previous advice. The only way to disable shared applications is to turn off parental control and then turn off shared applications in VM configuration.
 
NikZ said:
Let me explain, how PD works under managed account.

For OSX to control guest applications just like the host ones we force shared applications to be on. Ground of this decision is that managed account rules for host applications must also be extended for guest ones for security reasons. If one is not allowed to launch resticted host application, he won't be allowed to launch resticted guest application either.
Forcing shared applications to be on permanently is the only way for guest applications to be controlled with OSX means.

The problems with launching applications mentioned before can be solved by using my previous advice. The only way to disable shared applications is to turn off parental control and then turn off shared applications in VM configuration.
Click to expand...

The problem I have (and obviously a couple others have run into this as well) is that there's no indication in the GUI that this setting is being overridden in parallels. I following is the only mention of this "feature":

"Mac OS Parental Controls are automatically applied to the virtual machine for managing children’s computer usage. Any restrictions set for Mac OS will be also enforced in the virtual machine as well."
Click to expand...

In my case, this "feature" became a bug when (1) it is not reflected in the GUI that shared applications are enabled even though it is and (2) because the fake/proxy Mac OS Applications in "~/Applications/Windows XX Applications" are created on the fly by Parallels, they cannot reliably be signed w/Workgroup Manager to even be allowed by the managed account.

I have two open bug reports: one with Apple and one with Parallels. Unfortunately, there is no workaround for this issue other than not having the account be managed, which is not an option.
 
We've received the following feedback from the developers (through our support ticket) which provides a workaround by disabling "Share Windows Applications with Mac" from the Windows side:

We have received a reply from our Development team. Please apply the following workaround to disable Windows Shared Applications under managed account:

1) Open Cmd.exe in a Virtual Machine and type:

cd c:\Program Files\Parallels\Parallels Tools

prl_cc.exe /stop

2) Go to c:\Program Files\Parallels\Parallels Tools\Plugins and rename SharedGuestApps.dll to SharedGuestApps.dl_

3) Type:

prl_cc.exe /start

Please let us know your results of applying the workaround. Meanwhile, our Development team is aware of the issue and is working on a permanent solution.
Click to expand...

I hope that this helps anyone else who may have found this "feature" to be a "block".
 
You must log in or register to reply here.
Back
Top