"this installation is forbidden by system policy"

harikaram · Postby **harikaram** » Thu Mar 17, 2011 12:41 pm

I'm an end user of a product which uses InstallAware (Native Instruments Service Center). I'm nearly broken by this issue as is their support... I'm hoping someone can give me a clue as to what to try next...

When installing this benign and simple product I get an error message, right at the end of installation - "this installation is forbidden by system policy". My account is an admin. Despite this, I've tried actively setting the various software and group policies, booting in safe mode as user "Administrator" (rather than just my personal account, which is in the Administrator group). No other software is having installation problems.

I've peered deep into a procmon log (attached) and I can't really make heads or tales of it. I managed to get the installer to run with a log file:

...
MSI (s) (00:D0) [18:53:04:516]: MSI_LUA: Credential prompt not required, user is an admin
MSI (s) (00:D0) [18:53:04:516]: PROPERTY CHANGE: Adding ProductState property. Its value is '1'.
MSI (s) (00:D0) [18:53:04:517]: Using cached product context: machine assigned for product: AB5658B05DAB23741B22F57DE8CF059A
MSI (s) (00:D0) [18:53:04:518]: Using cached product context: machine assigned for product: AB5658B05DAB23741B22F57DE8CF059A
MSI (s) (00:D0) [18:53:04:519]: Entering CMsiConfigurationManager::SetLastUsedSource.
MSI (s) (00:D0) [18:53:04:520]: Using cached product context: machine assigned for product: AB5658B05DAB23741B22F57DE8CF059A
MSI (s) (00:D0) [18:53:04:521]: Note: 1: 1402 2: UNKNOWN\Net 3: 5
MSI (s) (00:D0) [18:53:04:521]: MSI_LUA: Elevation prompt disabled for silent installs
This installation is forbidden by system policy. Contact your system administrator.
...(rollback)

Might "Note: 1: 1402 2: UNKNOWN\Net 3: 5 " have anything to do with it? Or perhaps the line below it? Can anyone offer any insights??

My Specs:
Win 7x64, Intel i7920, Asus P6TDeluxe v2, lots of ram, disk space, etc...

thanks in advance for any help
Gratefully,
Harikaram Singh

Postby **giaviv** » Fri Mar 18, 2011 3:41 am

Dear Harikaram,

I apologize for your issues. Have you ran this in a different machine? Does it work elsewhere?

StyX · Postby **StyX** » Fri Mar 18, 2011 4:44 am

I've seen this issue happening when the Group Policy denies regular users to install software on their computer and UAC is turned on.

The problem we had was to get the process running the installer to elevate so that it actually runs as an admin and not as a regular user. The way we solved this was by running the installer silent using an elevated command prompt (start -> cmd -> Run as Admin).

We've since addressed this issue by requiring the installer to always elevate.

harikaram · Postby **harikaram** » Fri Mar 18, 2011 5:09 am

Thanks for the help but the thing is, UAC is off, my account is an admin, and the group policies have been actively set to allow installation in all cases...

Haven't tried a different machine yet but it worked under my machine in its previous XP incarnation. Nothing else has problems installing.

I've attached the full log file of the failed installation. You can see that it recognises that this is an admin account and doesnt require elevation...

BobSchaefer · Postby **BobSchaefer** » Tue Mar 22, 2011 1:33 pm

I have fought with this problem in the past, and never quite figured out what actually caused the particular install to get in this state, but did figure out how to get out of it. In your case, its going to be a little more difficult, because you don't know everything that's going on in your installer.

However, based on what your log file says, I'm going to give it a try as to how to get around the problem. It looks like one of the components that the installer is installing is being detected as an upgrade. The product in question has a GUID of {0B8565BA-BAD5-4732-B122-5FD78EFC50A9}, this is what's causing the problem. How I have worked around this problem, is to find out what this package is, and what its trying to upgrade, the package that it is trying to upgrade is not in the install database (on your machine) correctly, in other words, if you were to find this in the Add/Remove programs and attempted to remove it, it would fail with an error. How I work around this, is to find its entries in the uninstall portion of the registry and delete those keys, Windows now thinks the application is gone and should be able to install the application for you.

Look under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall and you should find entries for the package in question. If after cleaning this area of those references, it still won't work, do a search of the registry for those values as they may also be hiding in other locations. Also, note that the GUID I list above may not be the package that is installed, that's the package that sees something it wants to upgrade. You need some details as to what that package actually is, and what it may be trying to upgrade.

Good luck and hopefully this will help you out of your situation.

harikaram · Postby **harikaram** » Wed Mar 23, 2011 3:37 am

Thanks for the help. I'm glad to hear someone else has come up against this too...

The only instance of {0B8565BA-BAD5-4732-B122-5FD78EFC50A9} I could find was in HKEY_LOCAL_MACHINE\SOFTWARE\MimarSinan\InstallAware\Ident.Cache\ - Nothing in \Uninstall. It referenced a folder, c:\ProgramData\{902029B2-957E-4066-85FA-30DA31731718} which contained a cached copy of the installation files.

I removed this folder and the key and tried again. Same error and even the same log file I think (attached). Also, it did NOT recreate the {90202... folder or the {0B856... key!

Any more ideas? I really appreciate your help as I'm running out of options...

harikaram · Postby **harikaram** » Wed Mar 23, 2011 9:36 am

What's the deal with AB5658B05DAB23741B22F57DE8CF059A? That value appears as a folder name it quite a few spots in my registry:

HKCR\Installer\Features\AB5658B05DAB23741B22F57DE8CF059A
HKCR\Installer\Products\AB5658B05DAB23741B22F57DE8CF059A
HKCR\Installer\UpgradeCodes\AB5658B05DAB23741B22F57DE8CF059A
...and their equivalents in HKCR\Wow6432Node\ and HKLM\SOFTWARE\Classes (I presume these are all clones of the HKCR ones?)

I've tried deleting them but the one under \Products\ keeps reappearing. I've just read that deleting them is a bad idea :cry:

I've tried enabling full logging for MSI in the group policies. It gives a few more lines but nothing too out of the ordinary.

It mentioned:
MSI (s) (04:30) [15:41:06:027]: No System Restore sequence number for this installation.

and I had System Restore set to off, so I thought I'd try enabling it. No luck.

BobSchaefer · Postby **BobSchaefer** » Wed Mar 23, 2011 12:38 pm

It sounds like whatever that key points to is what is causing the problem. What do the values under the entries reference? They may eventually lead you to the GUID that points to the real installation. One thought does come to mind though, based on what you listed it sounds like you're on a 64bit OS, and the currently installed app is a 32bit application. Is it possible that the upgrade is to a 64bit version and that is what is causing the problem? Have you contacted the developer to ask them what the other key is and what it installs/upgrades to help isolate what's going on?

harikaram · Postby **harikaram** » Wed Mar 23, 2011 1:31 pm

Thanks Bob. I've attached the key that I can't delete (it reappears). One interesting thing is that it contains a couple key folders that are not accessible. I try to read them and get an error:

"Media cannot be opened. An error is preventing this key from being opened. Details: Access is denied."

I presume because it's to do with Windows Installer's internals.

There is another value in there "2B920209E759660458AF03AD13377181" but it doesn't come up anywhere else in the registry. I've tried manually running msiexec /x on all these key codes and MSI file names. Nothing productive.

I'm trying to communicate with the supplying company but they are a bit slow.

It seems that either a piece is stuck in the registry that needs to be removed or there is a corruption in the Windows Installer on my system. Or perhaps its a 32/64bit issue.

Next stop will be the MS community support forums

Thank you for all your help and patience. If anything else dawns on you to try, please let me know!

Gratefully,
Harikaram Singh

harikaram · Postby **harikaram** » Mon Jul 04, 2011 9:03 am

Any other ideas? Is there a way to speak to the developers at InstallAware? Someone who writes the code must be able to deduce the action that causes the installation failure from the logs?

I'm trying at MS Support too:
http://answers.microsoft.com/en-us/wind ... 9792064024

Much obliged for any help, especially from InstallAware's support... Really hoping to not have to reinstall my entire machine for this little piece of licensing software!!

Gratefully,
Hari Karam Singh

Postby **giaviv** » Mon Jul 04, 2011 10:52 am

Hari,

Are you able to send the reproducing project to support at installaware.com?

Thanks!

harikaram · Postby **harikaram** » Tue Jul 05, 2011 12:42 pm

Try this link: http://www.amritvela.com/Service%20Center%202.2.5%20Setup%20PC.zip

It's just their licensing software and it's freely available on their website, in case anyone is worried