Problem running the installer by the SYSTEM account qith /qn

[Pakkessino]

Hi, we have just bought your AI and trying to create our first installer for our main product.
However we are facing some problems and we cannot understand why.

The installer is an exe running our dll before uninstallation and other dll at the end of the installation. No problem if we run it visible.
But our software needs to run the update silently under the SYSTEM account ... by observing the taskmgr.exe we see the installer coming up, then it lays.
We have also activated the "ENABLE VERBOSE LOGGING" flag ... nothing appear on CurrentUser\AppData\Local\Temp\.. dir (but it does if we run it on visible mode)

Would you please be so gently to drive us in the right way in order to (at least) start debugging what is the problem (of course causing by us) which stops the installer to go on when launched by the SYSTEM account with /qn parameter?

Many thanks in advance.

[mihai.petcu]

Hi and welcome to Advanced Installer forums,

Just be sure to schedule the custom actions in the Install Execution Stage because the ones from Wizard Dialogs Stage won't be executed during a silent installation.

Also, on Windows Vista and above, in order to install the package silently the installation package should run elevated. This can be achieved in two ways:
- using the "Run as administrator" context menu option from Windows Explorer when launching the command line shell
- setting the execution level to "Run as administrator" in the Installation Options section of the Install Parameters Page.

This way when launching the installation package the UAC prompt will appear asking for elevated rights.

All the best,
Mihai

[Pakkessino]

Hi Mihai,
many thanks for your reply.

So ... it seems that we cannot run an update apart from asking an user to confirm the UAC prompt?
Before buying your product we used the Astrum Installer, an old installer creating just exe installers without using the Windows Installer features ...

At this point I kindly ask you you how we can solve the following need:
- we have many servers around
- each server comes with our primary product installed
- this product periodically checks our online service for an update. If an update exists, it downloads and installs it
... but the installer seems to fail due to lack of UAC prompt confirmation

Do you have any suggestion? How other people manage this need?

Best regards

[Daniel]

Hello,

First of all I apologize for my delayed reply. We had a few days off here due to the Orthodox Easter holidays and we are a bit rushed at the moment.

So ... it seems that we cannot run an update apart from asking an user to confirm the UAC prompt?

No, this is not true. If the installation setup is launched silently (/qn) from an elevated process then the UAC prompt won't be displayed. I'm not sure if this is the case, but if the installation is launched within a service application, then you should make sure the installation process won't spawn any UI, otherwise it will fail.

- we have many servers around
- each server comes with our primary product installed
- this product periodically checks our online service for an update. If an update exists, it downloads and installs it
... but the installer seems to fail due to lack of UAC prompt confirmation

Just make sure your product/service, which downloads and installs the updates setup package, is already running with highest privileges. This way the UAC prompt during updates installation will be avoided. Also, the best way to debug your updates installation si by creating an installation verbose log using the /L*V command.

If you have any questions let us know.

All the best,
Daniel

[marknalyanya]

Hi Daniel,

We are facing the same problem as described above. We are trying to install a package created from Silent installer build. The installation is by use of Puppet CM and when Puppet runs automatically using Local System account, the installation fails.

However, when I explicitly run the package installation using Puppet running in the context of my account (Admin account), then the installation works. I think it's failing at the first instance as it asks for Admin permission. What can we do to get the installation to run using System account?

[Catalin]

Hello Mark and welcome to Advanced Installer forums,

As mentioned above by my colleagues, if ran from an elevated process (e.g. an elevated cmd prompt), the setup should not require (display) UAC.

Also, the LocalSystem account token includes the NT AUTHORITY\SYSTEM and BUILTIN\Administrators SIDs; these accounts have access to most system objects. Therefore, there should not be any problems in what regards the permissions.

I have tried manually running a setup silently from a cmd prompt that is running under the NT AUTHORITY\SYSTEM and everything worked as expected.

You can try to do the same (run the setup from a cmd prompt that sits under the NT AUTHORITY\SYSTEM account) and see if it works. Most probably, this will work as expected.

The above make me come to the conclusion that it is something related to Puppet that is causing this. It could be the fact that the process that is deployed by Puppet doesn't inherit the privileges from it, but to be fully honest with you I am not quite sure about this since I am not experienced in Puppet. This can be verified by placing a message box in your package (e.g. through the "MessageBox" custom action - one important thing is to place it in the "Install Execution Stage"). After doing so, when running the package and the message box spawns, please verify task manager and see under which user the setup runs (if it inherits the permissions from its father process or not).

Hope this helps somehow.

Best regards,
Catalin