davidjhomer
Posts: 55
Joined: Wed Jun 08, 2016 3:58 pm
Contact:  Website Facebook Skype Twitter

Uninstall fails to elevate UAC permissions correctly

Fri Jun 09, 2017 12:56 pm

We have a major issue with uninstalls failing to work

1. Create a new project that has a folder called "Secure" set the NTFS permissions so that only SYSTEM and Administrators can access the folder.

2. Place in the folder cacls.exe (this is just an example our project this would be a Windows service executable).

3. Login as an Administrator **NOT** Administrator, in our example we created a user called sysadmin who is a Domain Admin.

4. Install the product, this works correctly and the folder is created, sysadmin cannot access the folder without elevating.
Hooli.png
Hooli.png (20.31KiB)Viewed 7655 times
5. The cacls file is executed on Uninstall (in our real project this runs the service to automatically uninstall itself), the cacls.exe file is found in the secured folder.

6. If you run the installer from the desktop setup.exe it works correctly.

7. ** BUG ** if you attempt to uninstall from Programs and Features the product fails to uninstall, our trial customers are furious they cannot remove the product it looks like we are blocking them from removing it.
We CANNOT use the built in feature to uninstall the service because we cannot set the uninstall to only run on a full uninstall, it uninstalls the service on an upgrade and loses the credentials.
CantUninstall.png
CantUninstall.png (25.15KiB)Viewed 7654 times

** NOTE **
1 Performing the uninstall as Administrator works as can bypass UAC
2. Running msiexec /x "{1DC4FABB-B9C2-4A3B-A97F-86845DABAFDF}" in an elevated command prompt works

When you run the uninstall from Programs and Features you see the UAC prompt, why isn't this elevating correctly?
Attachments
BreakingApp.aip
(19.68KiB)Downloaded 274 times
CENTREL Solutions Ltd
Server audit and documentation tools.
http://www.centrel-solutions.com

Dan
Posts: 4513
Joined: Wed Apr 24, 2013 3:51 pm

Re: Uninstall fails to elevate UAC permissions correctly

Fri Jun 09, 2017 3:41 pm

Hello,

Yes, I can reproduce and confirm this issue. A fix will be available in Advanced Installer, thank you for bringing it to our attention. Also, more details will come once I have a conclusive report from the dev team.

Please let me know if there is anything else I can help you with.

Best regards,
Dan
Dan Ghiorghita - Advanced Installer Team
Follow us: Twitter - Facebook - YouTube

davidjhomer
Posts: 55
Joined: Wed Jun 08, 2016 3:58 pm
Contact:  Website Facebook Skype Twitter

Re: Uninstall fails to elevate UAC permissions correctly

Fri Jun 09, 2017 3:49 pm

Thank you for the reply, please let me know as soon as possible when there is a solution. Our customers cannot remove our software unless they have the specific Administrator user credentials.


Thanks,


Dave
CENTREL Solutions Ltd
Server audit and documentation tools.
http://www.centrel-solutions.com

davidjhomer
Posts: 55
Joined: Wed Jun 08, 2016 3:58 pm
Contact:  Website Facebook Skype Twitter

Re: Uninstall fails to elevate UAC permissions correctly

Fri Jun 16, 2017 9:28 am

Hello,

At the request of support the installer has been modified so that the uninstall custom action occurs before the "Remove Resources" stage. This does NOT fix the issue.

The .aip file is attached.

Here is the application compiled
http://www.centrel-solutions.com/temp/breakingapp.exe



Thanks,


Dave
Attachments
BreakingApp.aip
(19.68KiB)Downloaded 353 times
CENTREL Solutions Ltd
Server audit and documentation tools.
http://www.centrel-solutions.com

davidjhomer
Posts: 55
Joined: Wed Jun 08, 2016 3:58 pm
Contact:  Website Facebook Skype Twitter

Re: Uninstall fails to elevate UAC permissions correctly

Fri Jun 16, 2017 9:39 am

I tried calling support, no-one answers and left a voicemail.

We've clearly presented a bug in UAC elevation during uninstallation but no one in support is willing to listen. I'm getting very nervous now with the large number of security related bugs we are reporting to you with this product.
CENTREL Solutions Ltd
Server audit and documentation tools.
http://www.centrel-solutions.com

Dan
Posts: 4513
Joined: Wed Apr 24, 2013 3:51 pm

Re: Uninstall fails to elevate UAC permissions correctly

Fri Jun 16, 2017 12:18 pm

Hi Dave,

We've replicated the described behaviour using your installer. Right now this is under investigation and as soon as we have a conclusive answer, I will get back to you.

Thank you for your understanding.

Best regards,
Dan
Dan Ghiorghita - Advanced Installer Team
Follow us: Twitter - Facebook - YouTube

Dan
Posts: 4513
Joined: Wed Apr 24, 2013 3:51 pm

Re: Uninstall fails to elevate UAC permissions correctly

Fri Jun 16, 2017 2:42 pm

Hi Dave,

We have further investigated this issue and we can say that the installation fails because of your custom actions that do not have enough privileges. This issue is not related to Advanced Installer.

Note that cacls.exe requires administrative privileges when it receive C:\windows as parameter. The installer only fails during the Uninstall from the Control Panel because the custom action is executed under the LocalSystem account, while when you uninstall through the elevated command line the custom action runs using administrative privileges.

The installation should fail as well during installation because it is executed under the LocalSystem account. However, it does not fail because you have enabled the Run as admin option from the Install Parameters page. This will make the custom action to run with admin privileges.

You can check by yourself this behaviour if you run the cacls.exe with your command line under the LocalSystem account. For this, please proceed as follow:
  • use the PsExec to launch the cmd.exe under the System account.
    Here's the command line that can launch the cmd.exe under the System account:

    Code: Select all

    PsExec.exe -s -i cmd.exe
    
  • call cacls.exe with your command line
    e.g.

    Code: Select all

    calcs.exe "C:\Windows"
    
You will be prompted wit the following error:
error.png
error.png (24.75KiB)Viewed 7573 times
There is a workaround for this behaviour, to also run the installation using admin privileges during the uninstall not just during the installation. In the Settings tab from the Themes page and enable the Extend EXE user interface on uninstall and maintenance option.

EXE user interface will be used when installing the application as well as when performing "Modify" or "Uninstall" from Control Panel. Basically, you will force the installer to run in Maintenance mode.

Please let me know if you have any questions.

Best regards,
Dan
Dan Ghiorghita - Advanced Installer Team
Follow us: Twitter - Facebook - YouTube

davidjhomer
Posts: 55
Joined: Wed Jun 08, 2016 3:58 pm
Contact:  Website Facebook Skype Twitter

Re: Uninstall fails to elevate UAC permissions correctly

Fri Jun 16, 2017 3:22 pm

Yes, exactly what I was looking for!

"This issue is not related to Advanced Installer."
Well it is related to Advanced Installer because it doesn't elevate unless you tick this box.

This works with the sample, we will now fully test this with our main application and confirm that this is now resolved.


Thanks,


Dave
CENTREL Solutions Ltd
Server audit and documentation tools.
http://www.centrel-solutions.com

davidjhomer
Posts: 55
Joined: Wed Jun 08, 2016 3:58 pm
Contact:  Website Facebook Skype Twitter

Re: Uninstall fails to elevate UAC permissions correctly

Wed Jun 21, 2017 11:40 am

Hello,

Yes this has resolved the issue and has been tested our client and server products, thank you!

I would definitely recommend that this is mentioned in the UI or the help because this setting does suggest that the setup will be run as Administrator, whereas this doesn't apply to Add/Remove programs.
Admin.png
Admin.png (61.99KiB)Viewed 7531 times


Thanks,


Dave
CENTREL Solutions Ltd
Server audit and documentation tools.
http://www.centrel-solutions.com

Daniel
Posts: 8237
Joined: Mon Apr 02, 2012 1:11 pm
Contact:  Website

Re: Uninstall fails to elevate UAC permissions correctly

Mon Jun 26, 2017 8:58 am

Hello Dave,

Thank you for your feedback. We will update our user guide with this info in a future version. Thank you for the heads up.

All the best,
Daniel
Daniel Radu - Advanced Installer Team
Follow us: Twitter - Facebook - YouTube

Return to “Common Problems”