ALLUSERS Installation without administrator permissions

[seeker103]

Hi,

I have need to be able to install my product for all users with a restricted user account, how do I do this without administrative rights?
I've tried to use the scripts below to grant rights to the user but to no avail:

1. Create registries in HKLM

Code: Select all

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\My Product]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{61C90942-0021-4230-8662-661D06AE0878}]

2. Grant full permissions of those registries to the user

Code: Select all

subinacl /subkeyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\My Product" /grant=authorizedagent=F

subinacl /subkeyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{61C90942-0021-4230-8662-661D06AE0878}" /grant=authorizedagent=F

cacls "C:\ProgramData" /t /e /g authorizedagent:F

But that wasn't enough, below is the installation log

Code: Select all

Action start 18:27:53: InstallFinalize.
MSI (s) (BC:AC) [18:27:53:143]: Running Script: C:\Windows\Installer\MSI2710.tmp
MSI (s) (BC:AC) [18:27:53:184]: PROPERTY CHANGE: Adding UpdateStarted property. Its value is '1'.
MSI (s) (BC:AC) [18:27:53:227]: Machine policy value 'DisableRollback' is 0
MSI (s) (BC:AC) [18:27:53:278]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (BC:AC) [18:27:53:328]: Executing op: Header(Signature=1397708873,Version=500,Timestamp=1228575604,LangId=1033,Platform=0,ScriptType=1,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=0)
MSI (s) (BC:AC) [18:27:53:427]: Executing op: ProductInfo(ProductKey={61C90942-0021-4230-8662-661D06AE0878},ProductName=My Product,PackageName=Test.msi,Language=1033,Version=16777216,Assignment=1,ObsoleteArg=0,,PackageMediaPath=\PROGRA~2\mia8534.tmp\,PackageCode={707C50AA-F9F3-4FA3-8DD5-BC219972E301},,,InstanceType=0,LUASetting=0,RemoteURTInstalls=0,ProductDeploymentFlags=2)
MSI (s) (BC:AC) [18:27:53:469]: Note: 1: 2205 2:  3: Error
MSI (s) (BC:AC) [18:27:53:519]: Note: 1: 2228 2:  3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1925
Error 1925. You do not have sufficient privileges to complete this installation for all users of the machine.  Log on as administrator and then retry this installation.
MSI (s) (BC:AC) [18:30:30:578]: Note: 1: 2205 2:  3: Error
MSI (s) (BC:AC) [18:30:30:620]: Note: 1: 2228 2:  3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1709
MSI (s) (BC:AC) [18:30:30:661]: Product: My Product -- Error 1925. You do not have sufficient privileges to complete this installation for all users of the machine.  Log on as administrator and then retry this installation.


Please tell me what more permissions will I need to grant for the user to install for all users.

Much appreciated,
Dean

[FrancescoT]

Dear Dean,

unfortunately you cannot install your product for all users without having administrative rights. This doesn't depend on InstallAware but it's due the system UAC restrictions.

You must specify an Administrative elevation level with the UAC settings.

Hope this helps you.

Regards

[seeker103]

Dear Francesco,

We are now exploring other possibilities to fulfill our requirements. We'd like to know that if a per-machine installation was made by an administrator, can the product be patched later on by non-admin users?

I have found that if we follow some rules described in the link below, we should be able to allow for UAC Patching for our product.
Ref: https://msdn.microsoft.com/en-us/library/aa372388.aspx

Is the above statement true for InstallAware? If not, what are my choices on this?

Thanks for the response,
Dean

[FrancescoT]

Dear Dean,

you may try to set "DisableLUAPatching" on the target machine.
https://msdn.microsoft.com/en-us/library/aa368302.aspx

Regards

[seeker103]

Dear Francesco,

I have tried to install a patch of a per-machine installation with a non-admin user account, the error "Installation forbidden by system policy..." was shown in the attempt.

Both the original full setup file and the patch file was signed, as configured in the Authenticode node of the project settings. The certificate used was installed on the target machine in the trusted CA category.

Also, as you've suggested, i've checked the policies registry and found that the value DisableLUAPatching was not set, but i've set it to 0 anyways.

Please advise,
Dean

[FrancescoT]

Dear Dean,

let me check ...I never used the "DisableLUAPatching" setting.

Regards