Group Policy MSI problems

[rosstrusler]

My app is installed into the user's profile, and therefore the installer does not need admin privileges, so UAC elevation within IA 11 is set to asInvoker, and limited users are not asked to elevate. This works perfectly as a single-file EXE build.

However, I purchased IA11 so that I could distribute a single MSI file for sysadmins to deploy centrally, and for any user to be able to install individually.

However, as soon as I use the Group Policy Wizard to create the MSI file, a few bad things start happening:

1) The (outer) MSI file isn't signed! Is there a good reason for this?
2) Users start are asked for admin credentials, i.e. the MSI is not running asInvoker. Given that IA specifically has a way of instructing it to use asInvoker, this seems like a bug that this is not applied to the outer MSI.

Combine the two,and now my users are freaking out with the big yellow 'unknown publisher' box, which requires an over-the-shoulder elevation from their IT department. Double whammy.

Obviously, I can sign the outer MSI file manually. But when I do this, I get even stranger results.
For limited users, nothing changes: it still acts as if it's unsigned, even if it is signed!

msi_weirdness_limited_user.png (112.92 KiB) Viewed 9653 times

And for admin users, it bypasses the notice for the outer MSI, but now I get a notice for what I think is the inner MSI.

msi_weirdness_admin_user.png (34.66 KiB) Viewed 9653 times

So my question is: how do I get the MSI file to run asInvoker, and how do I get the signature to be recognized on a limited user's machine?

[giaviv]

Hi,

Are you signing both the inner MSI as well as the outer one?

It will be best to use the standard MSI code signing tools that ship with InstallAware.

I am a little confused as to why the second thing you brought up is necessary - the internal MSI will simply be elevated as it was set when you built it.
With Group Policy deployment, there shouldn’t be a need to have to ever manually elevate - what are your thoughts?

[rosstrusler]

To answer your questions:

a) Yes, I used IA's signing tools to sign the inner MSI (and the single EXE the outer MSI uses). IA won't sign the outer MSI, unfortunately. I had to sign the outer MSI manually, yet as you can especially see in the first screenshot, signing is not having the usual effect for limited users.

b) It's true: during Group Policy deployment there is no need for elevation, as it runs with the privileges of the SMS user. But if an individual downloads my MSI file and installs our software on their desktop (i.e. not using Group Policies), the MSI file is requesting elevation, and the limited user cannot install the software. This is bad because:
i) my installer never needs elevation, since it installs only into the user's profile
ii) I told IA to apply asInvoker

[rosstrusler]

To answer your questions:

A lot of spam above, which I've reported. Could I get a response now that I answered your questions?

Thanks.

[giaviv]

Hi - I emailed you directly (at the email you used to sign up to the forum).

Anyways:
a) I understand - you indeed have to invoke the tools manually in order to sign the outer MSI.

b) Setups generated with the Group Policy Wizard should be used in that setting. Therefore, a user that wishes to install your program not using group policy should be provided with an exe created in another method (web, cd or single file deployment).

[rosstrusler]

b) Setups generated with the Group Policy Wizard should be used in that setting. Therefore, a user that wishes to install your program not using group policy should be provided with an exe created in another method (web, cd or single file deployment).

Why is this limitation necessary? i.e. why isn't the MSI made compatible with the settings used for IA targets (e.g. elevation)?

It's a pain to have to supply two installers, and instruct customers on which one to use. More support calls are inevitable. I should point out that InstallAware frequently touts Embarcadero's use-case of reducing many installers down to one - it seem odd that our comparatively trivial installation will require two installers.

[giaviv]

Again, MSI is only used in group policy deployment, which is why you need to deploy your installer through an exe.