automatic updates

[Trusler]

I have IA Studio 11.

I have the following use-case:

- apps are initially deployed using Group Policies in larger organizations and by local admins in others. Therefore the Group Policy Wizard is used to create the 'outer' MSI files that are made available to all organizations.
- must support installs on XP and up
- users in larger organizations are always limited users, but we cannot assume that organizations have set the 'always install with elevated privileges' policy
- automatic, attended, forced updates are needed such that the latest-available version of the app always runs, without intervention by an administrator
- Users cannot avoid or abort updates, but can see update progress
- updates shouldn't require a reboot when the app's EXE file is updated.

Can IA's web updates support this yet? Last time I encountered this use-case, I had to write my own updater, but it lacks many of IA's features.

Note that scheduled updates do not work for this scenario, since they can't guarantee that a scheduled update occurred since the last update was issued. It seems to me that my application should:

1) call a cached version of the installer in silent mode to determine if an update is available. Is the installer cached for Group Policy 'outer' MSI files? If so, where? Alternatively, I could install (into the application's directory) a stripped-down IA setup with just the updater in it. This method is described in another thread.
2) if an update is available, call the installer in non-silent mode so that the update GUI is visible to the user. My app exits to avoid need for rebooting.
3) When update completes, application is automatically run by updater

My problem is that this would fail for limited users in Vista and Win7, since they run the app without the admin token needed to replace the app's EXE in the ProgramFiles directory.

[FrancescoT]

Dear User,

the problem lies in the fact that you can't bypass UAC restrictions if these are enabled and it is not an InstallAware limitation.
Unfortunately, if your package makes system modifications ( ... and this happens with all most of the setup processes), starting from Vista administrative privileges are required to complete the installation.

I don't if you are refering at the topic below as possible alternative ... but probably it is an option that you could try.
http://www.installaware.com/forum/viewt ... &hilit=UAC

Regards

[Trusler]

Of course it's an InstallAware limitation. There are methods to deal with UAC, but InstallAware's update mechanism doesn't use them. The method I used last time was to install into user profiles, similar to ClickOnce. The downside is that Group Policy installers have to follow instructions properly to avoid installing per-machine. But the most common method is to communicate with a service running with admin privileges for updating. The trade-off is that the service provides an increased attack surface, but that's what good engineering prevents. If IA had an updater service with a proven track record, I would be keen to use it over rolling my own.

I would still appreciate a reply to my earlier questions: Is the installer cached for Group Policy 'outer' MSI files? If so, where?

Thanks,

RT

[FrancescoT]

Dear User,

of course I'll take into account your consideration but instead of refering to it as limitation, I would prefer to consider this as a missing feature.
If I'm not wrong, I believe the same happens with any other deployment tool

I would still appreciate a reply to my earlier questions: Is the installer cached for Group Policy 'outer' MSI files? If so, where?

For what I know the installer package files are cached during installation on client machine only.
The location of these cached files is stored by "UninstallString" key under REGISTRY at:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\<PRODUCTCODE ID>
Are you refering to this?

Regards