3 replies to this topic

[Scott Mayham]

Folks,

First of all, this question has nothing to do with InstallShield - in fact, for various reasons, IS is explicitly excluded (for now). The Devp team I work for produces MSIs directly out of MS VisualStudio 2010. The target systems are Window2008R2 exclusively, so we are only dealing with MSI v5.0. The installs are intended to be per-system always, and never per-user.

We would like to make these MSIs require that the person running the install be a member of the Administrator's group, and if not, gracefully exit the installer with a pleasant message. If the person is an Administrator, depending on how the target system is configured, he may still be challenged by UAC for either approval or credentials, either of which is ok. What I want to avoid is allowing the install to proceed if the person is not an Administrator.

Oh, and doing so in the launcher (setup.exe), or by a command-line switch, is also excluded (again, for now).

Lots of MSDN literature discusses what an Administrator can do to manage UAC and MSIs; very little seems to address this question: how does an installation author REQUIRE administrative rights?

The MSIs, as produced by VS, have ALLUSERS set to 2, which I am changing to be ALLUSERS=1, in order to enforce per-system install. Implicitly, that would seem to require Admin rights. I'm having a hard time believing that's all there is too it; what else must I do, if anything?

Any thoughts, suggestions, links?

Thanks and Regards,

[Stefan Krueger]

By default, Windows INstaller will try to run the user interface sequence without requesting admin rights, and then show the UAC dialog when switching to the execute sequence.

To require admin rights you could add a launch condition that checks the AdminUser propprty. In addition you must also set the MSIUSEREALADMINDETECTION property to 1 in your Property table to disable Windows Installer's mitigation for packages that errorneously request admin rights.

[Scott Mayham]

Stefan,

Thanks for the reply. You mentioned AdminUser, I was using the property "Privileged" - according to MSDN, for Vista and following (W7, W2008R2), this is equivalent to AdminUser, so I think I am ok there.

I completely forgot about MSIUSEREALADMINDETECTION! That may be the key to what I am seeing in some scenarios. I will definitely add that property and set it to 1.

Thanks again,
ScottM

[Stefan Krueger]

I think they are only the same if MSIUSEREALADMINDETECTION is not set.