InstallAware

Posted: **Tue Sep 27, 2016 11:15 pm**

Hi,

I have need to be able to install my product for all users with a restricted user account, how do I do this without administrative rights?
I've tried to use the scripts below to grant rights to the user but to no avail:

1. Create registries in HKLM

Code: Select all

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\My Product]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{61C90942-0021-4230-8662-661D06AE0878}]

2. Grant full permissions of those registries to the user

Code: Select all

subinacl /subkeyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\My Product" /grant=authorizedagent=F

subinacl /subkeyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{61C90942-0021-4230-8662-661D06AE0878}" /grant=authorizedagent=F

cacls "C:\ProgramData" /t /e /g authorizedagent:F

But that wasn't enough, below is the installation log

Code: Select all

Action start 18:27:53: InstallFinalize.
MSI (s) (BC:AC) [18:27:53:143]: Running Script: C:\Windows\Installer\MSI2710.tmp
MSI (s) (BC:AC) [18:27:53:184]: PROPERTY CHANGE: Adding UpdateStarted property. Its value is '1'.
MSI (s) (BC:AC) [18:27:53:227]: Machine policy value 'DisableRollback' is 0
MSI (s) (BC:AC) [18:27:53:278]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 
MSI (s) (BC:AC) [18:27:53:328]: Executing op: Header(Signature=1397708873,Version=500,Timestamp=1228575604,LangId=1033,Platform=0,ScriptType=1,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=0)
MSI (s) (BC:AC) [18:27:53:427]: Executing op: ProductInfo(ProductKey={61C90942-0021-4230-8662-661D06AE0878},ProductName=My Product,PackageName=Test.msi,Language=1033,Version=16777216,Assignment=1,ObsoleteArg=0,,PackageMediaPath=\PROGRA~2\mia8534.tmp\,PackageCode={707C50AA-F9F3-4FA3-8DD5-BC219972E301},,,InstanceType=0,LUASetting=0,RemoteURTInstalls=0,ProductDeploymentFlags=2)
MSI (s) (BC:AC) [18:27:53:469]: Note: 1: 2205 2:  3: Error 
MSI (s) (BC:AC) [18:27:53:519]: Note: 1: 2228 2:  3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1925 
Error 1925. You do not have sufficient privileges to complete this installation for all users of the machine.  Log on as administrator and then retry this installation.
MSI (s) (BC:AC) [18:30:30:578]: Note: 1: 2205 2:  3: Error 
MSI (s) (BC:AC) [18:30:30:620]: Note: 1: 2228 2:  3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1709 
MSI (s) (BC:AC) [18:30:30:661]: Product: My Product -- Error 1925. You do not have sufficient privileges to complete this installation for all users of the machine.  Log on as administrator and then retry this installation.

Please tell me what more permissions will I need to grant for the user to install for all users.

Much appreciated,
Dean

Posted: **Wed Sep 28, 2016 10:37 am**

Dear Dean,

unfortunately you cannot install your product for all users without having administrative rights. This doesn't depend on InstallAware but it's due the system UAC restrictions.

You must specify an Administrative elevation level with the UAC settings.

Hope this helps you.

Regards

Posted: **Thu Sep 29, 2016 5:37 am**

Dear Francesco,

We are now exploring other possibilities to fulfill our requirements. We'd like to know that if a per-machine installation was made by an administrator, can the product be patched later on by non-admin users?

I have found that if we follow some rules described in the link below, we should be able to allow for UAC Patching for our product.
Ref: https://msdn.microsoft.com/en-us/library/aa372388.aspx

Is the above statement true for InstallAware? If not, what are my choices on this?

Thanks for the response,
Dean

Posted: **Mon Oct 03, 2016 9:24 am**

Dear Dean,

you may try to set "DisableLUAPatching" on the target machine.
https://msdn.microsoft.com/en-us/library/aa368302.aspx

Regards

Posted: **Tue Oct 04, 2016 10:10 pm**

Dear Francesco,

I have tried to install a patch of a per-machine installation with a non-admin user account, the error "Installation forbidden by system policy..." was shown in the attempt.

Both the original full setup file and the patch file was signed, as configured in the Authenticode node of the project settings. The certificate used was installed on the target machine in the trusted CA category.

Also, as you've suggested, i've checked the policies registry and found that the value DisableLUAPatching was not set, but i've set it to 0 anyways.

Please advise,
Dean

Posted: **Wed Oct 05, 2016 1:59 pm**

Dear Dean,

let me check ...I never used the "DisableLUAPatching" setting.

Regards

InstallAware

ALLUSERS Installation without administrator permissions

ALLUSERS Installation without administrator permissions

Re: ALLUSERS Installation without administrator permissions

Re: ALLUSERS Installation without administrator permissions

Re: ALLUSERS Installation without administrator permissions

Re: ALLUSERS Installation without administrator permissions

Re: ALLUSERS Installation without administrator permissions