Jump to content


This is a ready-only archive of the InstallSite Forum. You cannot post any new content here. / Dies ist ein Archiv des InstallSite Forums. Hier können keine neuen Beiträge veröffentlicht werden.
Photo

"The system administrator has set policies to prev


9 replies to this topic

Barvaz

Barvaz
  • Full Members
  • 37 posts

Posted 02 May 2012 - 08:37

Hi,

I try to run setup on the Win XP 64bit machine and it falls with the following errors:


=== Verbose logging started: 5/1/2012 13:53:35 Build type: SHIP UNICODE 4.05.6001.00 Calling process: C:\WINDOWS\system32\MSIEXEC.EXE ===
MSI © (9C:C0) [13:53:35:231]: Resetting cached policy values
MSI © (9C:C0) [13:53:35:231]: Machine policy value 'Debug' is 0
MSI © (9C:C0) [13:53:35:231]: ******* RunEngine:
******* Product: C:\DOCUME~1\user1\LOCALS~1\Temp\{C4E7C8AE-9ACA-422B-BB23-0C87FF9FC608}\TEST.msi
******* Action:
******* CommandLine: **********
MSI © (9C:C0) [13:53:35:231]: Machine policy value 'DisableUserInstalls' is 0
MSI © (9C:C0) [13:55:38:668]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'C:\DOCUME~1\user1\LOCALS~1\Temp\{C4E7C8AE-9ACA-422B-BB23-0C87FF9FC608}\TEST.msi ' against software restriction policy
MSI © (9C:C0) [13:55:38:684]: Note: 1: 2262 2: DigitalSignature 3: -2147287038
MSI © (9C:C0) [13:55:38:684]: SOFTWARE RESTRICTION POLICY: C:\DOCUME~1\ user1\LOCALS~1\Temp\{C4E7C8AE-9ACA-422B-BB23-0C87FF9FC608}\ TEST.msi is not digitally signed
MSI © (9C:C0) [13:55:38:762]: SOFTWARE RESTRICTION POLICY: SaferIdentifyLevel reported failure. Assuming untrusted. . . (GetLastError returned 5)
MSI © (9C:C0) [13:55:38:762]: The installation of C:\DOCUME~1\user1\LOCALS~1\Temp\{C4E7C8AE-9ACA-422B-BB23-0C87FF9FC608}\TEST.msi is not permitted due to an error in software restriction policy processing. The object cannot be trusted.

MSI © (9C:C0) [13:55:38:762]: Note: 1: 1718 2: C:\DOCUME~1\user1\LOCALS~1\Temp\dd83f3.msi
MSI © (9C:C0) [13:55:38:996]: MainEngineThread is returning 1625
=== Verbose logging stopped: 5/1/2012 13:55:39 ===

The installation failed only if I run the setup in UI mode with user 'user1'!!!
If I run the same installation on the same machine with the same user in Silent Mode it completed successfully!
Even if i run UI installation on the same machine, but with different user it completed successfully!

Please advice,
Thanks


Stefan Krueger

Stefan Krueger

    InstallSite.org

  • Administrators
  • 13,269 posts

Posted 02 May 2012 - 11:43

I'm not sure if this knowledge base article is related:
http://support.micro....com/kb/925336/

However it doesn't explain why running as another user or in silent mode works.

This line:
CODE
MSI (c) (9C:C0) [13:55:38:684]: Note: 1: 2262 2: DigitalSignature 3: -2147287038

means that hte DigitalSignature stream wasn't found in the msi file. Is your msi file digitally signed?

Barvaz

Barvaz
  • Full Members
  • 37 posts

Posted 02 May 2012 - 11:57

I thought so - please see attached.

Media --> Releases --> Release 1 --> Signing (TAB):
Digital Cartificate File -> Link to .spc file
Private Key File -> link to .pvk file
Sign Output File -> Setup.exe and Windows installer Package

What do you think?

It difficult to characterized the problem because the behavior is not fixed - on most of WinXP machines the installation successfully installed, few of them it failed.
I took a problematic machine and made method 2 as defined in this link:

The system administrator has set policies to prevent this installation

Then i reboot and installed the problematic file again without a problem!

Attached Images

  • Capture.JPG

Edited by Barvaz, 02 May 2012 - 12:51.


Stefan Krueger

Stefan Krueger

    InstallSite.org

  • Administrators
  • 13,269 posts

Posted 02 May 2012 - 13:12

So essentially the same workaround as in the KB article. We still don't know exactly *why* the verification of the digital signature fails. Could be a damaged download, permission issue, low disk space, malware infection (virus changing the msi file), anti-virus software, or something completely different. I still wonder why silent install works. Is this a multi-language install (then it could be a problem with the langauge transform).

Stefan Krueger

Stefan Krueger

    InstallSite.org

  • Administrators
  • 13,269 posts

Posted 02 May 2012 - 13:13

Oh, and it could be a problem with the location where the msi file is stored or extracted (e.g. temp folder). Windows Installer doesn't like compressed folders for instance.

Barvaz

Barvaz
  • Full Members
  • 37 posts

Posted 02 May 2012 - 13:18

QUOTE (Stefan Krueger @ 2012-05-02 13:13)
Oh, and it could be a problem with the location where the msi file is stored or extracted (e.g. temp folder). Windows Installer doesn't like compressed folders for instance.

What do you mean problem where the msi i extracted?
My setup is compressed and extracted under %temp% folder.
What is the problem with that? and if there is a problem, there is solution for that?


Stefan Krueger

Stefan Krueger

    InstallSite.org

  • Administrators
  • 13,269 posts

Posted 03 May 2012 - 08:08

I'm just guessing. If there's not enough space on the drive with the temp folder, or if the hard disk is very fragmented, or if the temp folder is compressed (NTFS option) this could cause problems.

Barvaz

Barvaz
  • Full Members
  • 37 posts

Posted 17 May 2012 - 15:23

Hi,

We are considering the following two options:

1. We tried using REQUIRED EXECUTION LEVEL = "invoker".
This worked - the error did not appear. However we are afraid that by doing so, we will allow non-admin user installing the application. Since we are updating the registry and the Program Files, non-admin will fail in the middle of the setup.

2. We can use the REQUIRED EXECUTION LEVEL = "administrator", but then the above error message will appear. Do you know how frequent this error is? specific configurations?
In this case, we would like to give the users a proper reference to the workaround (which will be written in the installation manual).
>>How can we edit the error message?

Please let us know of your opinion.
Also, if you have a better and safer method to check admin privileges (e.g. inside the Basic MSI logics).

Thank you!





Stefan Krueger

Stefan Krueger

    InstallSite.org

  • Administrators
  • 13,269 posts

Posted 18 May 2012 - 09:01

I'm running out of ideas.
Doies the user launching the install have admin rights, or are you switching accounts on the UAC dialog?
Are there any restrictions/security policies set up for this user?

Barvaz

Barvaz
  • Full Members
  • 37 posts

Posted 20 May 2012 - 15:52


Following are the answer for your questions:

1) Only on XP, we have admin rights.
2) No