2 replies to this topic

[Scott Mayham]

Folks,

I have a strange issue. I have an installer which has all the things necessary to require that it the user running it has Administrator Rights. However, unless one runs it by right-clicking and doing a "Run-As-Administrator", it hangs. So, clearly there is some sort of Delta between being an Administrator and Run-As-Administrator.

What is that Delta, and how do I detect it (or, more to the point, detect its absence) from inside an MSI?

The installer is ever only run on Windows 7 and W2008R2, both 64-bit.

I have already done these things:

- Set up a Launch Condition on the "Privileged" Property.
- Added the Property MSIREALADMINDETECTION and set its value to 1.

Still, if an Admin runs the install, it stalls. If the same Admin does a Run-As-Administrator, the install succeeds. Why?

Regards,
ScottM

[akerl]

Have you got a verbose log?

[Scott Mayham]

Folks,

I found the answer - "Run Elevated."

In the presence of UAC, even Adminstrators are denied certain rights, for our own safety, I suppose. To overcome this, certain software, including many per-system installers, must have ALL of the Administrator's rights in order to succeed. Run-As Administrator does that. Another technique is to place a Manifest in the Setup.EXE bootstrapper with the requestedExecutionLevel item set to level ="requireAdministrator". This can't be done in the VisualStudio IDE, but a quick edit of the vdproj file does the trick. In the msiBootstrapper section, there is a setting "RequiresElevation" = "11:FALSE". Change this to "RequiresElevation" = "11:TRUE".

Since Installers produced by VisualStudio always seem to consist of the MSI and the Setup.EXE bootstrapper, and since the elevation is accomplished by the bootstrapper, a way has to be found to deprive the users from double-clicking on the MSI. We do this with a little free program called MsiExeCombiner, which combines the two into one EXE, which is what we deploy. I have tested this approach and it works.

The exact behavior varies, depending on the target systems' UAC settings and Policies. At high UAC settings, even administrators may be challenged for at least an approval of the install, or even credentials. However, for administrators, once the UAC stuff has been attended to, the install proceed with elevated rights and succeeds.

For non-administrators, if UAC is turned on, they will be challenged for Administrator's credentials (aka Over-The-Shoulder approval); if UAC is turned off, the only way to prevent the installer from proceeding (and probably failing), is to ensure that the MSI has LaunchConditions set on the "Privileged" Property, and that the "USEREALADMINDETECTION" Property is set. That way, since UAC won't stop things, your LaunchConditions will.

Regards,
ScottM