All Windows7 applications blocked via OSX Managed preferences - Parallels 6

Hi guys, I've got an interesting one for you.

I have just set up a Windows 7 Pro VM in Parallels v6.0.11990. Host OS is OS X 10.6.5.
The machine is running in a corporate environment using xServes with Open Directory authentication.

I have set up the Managed preferences to allow a standard user to run the VM and access all the required Parallels files, yet for some bizarre reason, any application I launch within Win7 (IE, Explorer, Calculator, etc) I get an OSX pop-up informing me I do not have access to the application I have opened. The majority of these programs will open and run fine despite this error, however IE will close immedately.

I have tried running the VM with shared application access to the Mac OS, and also tried it with all access between Host and VM locked out. I get the exact same issue every time.

However, running the exact same VM Image under a local admin user in OSX allows me to operate fine with no restrictions, leading me to come to the conclusion it is an access privilege issue.

Anyone aware of what I have missed to allow proper usage of the Windows7 VM?

Cheers in advance,

Chris

 

68 views and no reply?

If anyone else is having this issue, it might be an idea to post up your experiences to see if this can be resolved sooner.

Surely out of 68 people, someone knew either a way around this or was having the same problem.. Why else would you be looking at this post?

 

Hi Chris,
Please create a ticket at http://www.parallels.com/support/request/ and let me know the ticket ID.
I don't think that you'll get some valuable advice w/o checking the logs and VM configuration, as well as host settings.

 

Thanks for the reply,

I have logged a ticket with the support team. ID: Parallels #1063808

Just thought I'd query the community as well to see if anyone had experienced anything similar

Cheers,

Chris

 

I have just run into the exact same issue w/Parallels Desktop for Mac 6.0.11828 w/Windows Vista Home guest OS under Mac OS X 10.6.4 Snow Leopard. We use managed preferences to limit applications and, even with Configure... > Security set to "Isolate Mac from Windows" and ALL Configure... > Applications > "Share Windows Applications with Mac" checkboxes unchecked (yes, even before I set it to "Isolate Mac from Windows"), it still insists on try attempting to launch the fake/proxy Mac app for it, resulting in the application not being allowed to run and the real Windows counterpart being quit. Even if I delete ~/Applications/Windows\ Vista\ Applications, Parallels recreates it and still runs into Managed Preferences wall.

Please tell me there's a solution as we're currently dead in the water!

 

I am still communicating with Parallels Support to find a resolution. I will post here when I get further.

You may be interested in looking into a temporary workaround I have found though.

I have posted this up on the Apple forums here: http://discussions.info.apple.com/thread.jspa?messageID=12789263#12789263

Part of the thread:

After testing this with managed preferences set to allow the "~/Applications/Windows 7 Applications/" I was then able to launch the programs without the pop up errors. Still have the same issue with IE and Media Player crashing unless opened from the Application folder, but at least the annoying errors are gone.

Please be aware that this is NOT a fix, just a work around.

Hope you can get some relief from this.

Cheers,

Chris

 

I appreciate the suggestion.

While I was aware of the potential workaround and have tried it, we have an unrelated issue where whitelisting new applications and directories doesn't seem to take on our Mac OS X 10.6.4 workstations and the applications are still denied with a "You don't have permission to use the application" error. Unfortunately, this is one of the primary reasons we relied upon the ability to disable Mac OS X & Windows application integration under Parallels Desktop 5 for Mac.

I have also submitted a ticket with Parallels Support (#1068630), so hopefully we'll see some hopes of resolution in the near future. I did reference your ticket in mine.

 

Hi, guys,
as far as I understand you want to run guest applications w/o OSX dialogs with managed account on.

To do so, you can use one of two possibilities:
#1 Go to
System Preferences > Parental Controls > Apps tab and check necessary applications in Allowed Apps list.

#2 You can allow any application permanently by choosing "Always allow" button in "You don't have permission..." OSX dialog (i.e. using general OSX behavior)

 

The problem is that disabling "Share Windows Applications with Mac" should prevent Windows from creating the ~/Applications/Windows\ XXX\ Applications folder and launching the proxy apps contained therein when launching the counterpart in Windows, but doesn't. We've run into numerous VM configuration settings that when changed in the GUI, are reflected as changed in the GUI, but don't "take".

For us, the aforementioned "Share Windows Applications with Mac" as well as the "Require password to change VM state" preferences have been disabled, and the GUI shows them disabled, but the functionality is still in effect. For the former, this is hardly noticeable unless you're using Managed Preferences/Parental Controls at which point it's difficult to work around (esp. if the applications need to be signed for security reasons, which is the problem we have). The latter would be a little more apparent to everyone as it requires admin authentication to start/suspend/stop the VM. Obviously, both of these issues become major roadblocks in a managed environment.

 

Let me explain, how PD works under managed account.

For OSX to control guest applications just like the host ones we force shared applications to be on. Ground of this decision is that managed account rules for host applications must also be extended for guest ones for security reasons. If one is not allowed to launch resticted host application, he won't be allowed to launch resticted guest application either.
Forcing shared applications to be on permanently is the only way for guest applications to be controlled with OSX means.

The problems with launching applications mentioned before can be solved by using my previous advice. The only way to disable shared applications is to turn off parental control and then turn off shared applications in VM configuration.

 

The problem I have (and obviously a couple others have run into this as well) is that there's no indication in the GUI that this setting is being overridden in parallels. I following is the only mention of this "feature":

In my case, this "feature" became a bug when (1) it is not reflected in the GUI that shared applications are enabled even though it is and (2) because the fake/proxy Mac OS Applications in "~/Applications/Windows XX Applications" are created on the fly by Parallels, they cannot reliably be signed w/Workgroup Manager to even be allowed by the managed account.

I have two open bug reports: one with Apple and one with Parallels. Unfortunately, there is no workaround for this issue other than not having the account be managed, which is not an option.

 

We've received the following feedback from the developers (through our support ticket) which provides a workaround by disabling "Share Windows Applications with Mac" from the Windows side:

I hope that this helps anyone else who may have found this "feature" to be a "block".