9 replies to this topic

[Barvaz]

Hi,

I try to run setup on the Win XP 64bit machine and it falls with the following errors:


=== Verbose logging started: 5/1/2012 13:53:35 Build type: SHIP UNICODE 4.05.6001.00 Calling process: C:\WINDOWS\system32\MSIEXEC.EXE ===
MSI © (9C:C0) [13:53:35:231]: Resetting cached policy values
MSI © (9C:C0) [13:53:35:231]: Machine policy value 'Debug' is 0
MSI © (9C:C0) [13:53:35:231]: ******* RunEngine:
******* Product: C:\DOCUME~1\user1\LOCALS~1\Temp\{C4E7C8AE-9ACA-422B-BB23-0C87FF9FC608}\TEST.msi
******* Action:
******* CommandLine: **********
MSI © (9C:C0) [13:53:35:231]: Machine policy value 'DisableUserInstalls' is 0
MSI © (9C:C0) [13:55:38:668]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'C:\DOCUME~1\user1\LOCALS~1\Temp\{C4E7C8AE-9ACA-422B-BB23-0C87FF9FC608}\TEST.msi ' against software restriction policy
MSI © (9C:C0) [13:55:38:684]: Note: 1: 2262 2: DigitalSignature 3: -2147287038
MSI © (9C:C0) [13:55:38:684]: SOFTWARE RESTRICTION POLICY: C:\DOCUME~1\ user1\LOCALS~1\Temp\{C4E7C8AE-9ACA-422B-BB23-0C87FF9FC608}\ TEST.msi is not digitally signed
MSI © (9C:C0) [13:55:38:762]: SOFTWARE RESTRICTION POLICY: SaferIdentifyLevel reported failure. Assuming untrusted. . . (GetLastError returned 5)
MSI © (9C:C0) [13:55:38:762]: The installation of C:\DOCUME~1\user1\LOCALS~1\Temp\{C4E7C8AE-9ACA-422B-BB23-0C87FF9FC608}\TEST.msi is not permitted due to an error in software restriction policy processing. The object cannot be trusted.

MSI © (9C:C0) [13:55:38:762]: Note: 1: 1718 2: C:\DOCUME~1\user1\LOCALS~1\Temp\dd83f3.msi
MSI © (9C:C0) [13:55:38:996]: MainEngineThread is returning 1625
=== Verbose logging stopped: 5/1/2012 13:55:39 ===

The installation failed only if I run the setup in UI mode with user 'user1'!!!
If I run the same installation on the same machine with the same user in Silent Mode it completed successfully!
Even if i run UI installation on the same machine, but with different user it completed successfully!

Please advice,
Thanks

[Stefan Krueger]

I'm not sure if this knowledge base article is related:
http://support.micro....com/kb/925336/

However it doesn't explain why running as another user or in silent mode works.

This line:

[Barvaz]

I thought so - please see attached.

Media --> Releases --> Release 1 --> Signing (TAB):
Digital Cartificate File -> Link to .spc file
Private Key File -> link to .pvk file
Sign Output File -> Setup.exe and Windows installer Package

What do you think?

It difficult to characterized the problem because the behavior is not fixed - on most of WinXP machines the installation successfully installed, few of them it failed.
I took a problematic machine and made method 2 as defined in this link:

The system administrator has set policies to prevent this installation

Then i reboot and installed the problematic file again without a problem!

Attached Images

• 

Edited by Barvaz, 02 May 2012 - 12:51.

[Stefan Krueger]

So essentially the same workaround as in the KB article. We still don't know exactly *why* the verification of the digital signature fails. Could be a damaged download, permission issue, low disk space, malware infection (virus changing the msi file), anti-virus software, or something completely different. I still wonder why silent install works. Is this a multi-language install (then it could be a problem with the langauge transform).

[Stefan Krueger]

Oh, and it could be a problem with the location where the msi file is stored or extracted (e.g. temp folder). Windows Installer doesn't like compressed folders for instance.

[Barvaz]

[Stefan Krueger]

I'm just guessing. If there's not enough space on the drive with the temp folder, or if the hard disk is very fragmented, or if the temp folder is compressed (NTFS option) this could cause problems.

[Barvaz]

Hi,

We are considering the following two options:

1. We tried using REQUIRED EXECUTION LEVEL = "invoker".
This worked - the error did not appear. However we are afraid that by doing so, we will allow non-admin user installing the application. Since we are updating the registry and the Program Files, non-admin will fail in the middle of the setup.

2. We can use the REQUIRED EXECUTION LEVEL = "administrator", but then the above error message will appear. Do you know how frequent this error is? specific configurations?
In this case, we would like to give the users a proper reference to the workaround (which will be written in the installation manual).
>>How can we edit the error message?

Please let us know of your opinion.
Also, if you have a better and safer method to check admin privileges (e.g. inside the Basic MSI logics).

Thank you!

[Stefan Krueger]

I'm running out of ideas.
Doies the user launching the install have admin rights, or are you switching accounts on the UAC dialog?
Are there any restrictions/security policies set up for this user?

[Barvaz]

Following are the answer for your questions:

1) Only on XP, we have admin rights.
2) No