Hold the elevated privilege UAC as late as possible

[akshay karambale]

Hi,
We have created the Bootstrapper project and in this project we are added one functionality which will search for particular software installed on the machine or not.
If software is not instlled then it shows error message that is software is not found, installation can not be performed.
Now our requirement is,
When we try to install this bootstrapper it should detects first that software, if software is not installed on the machine then before the elevated privilege UAC that error message should be displayed, but in our case it display that error message after elevated privilege UAC.
So how to achieve this requirement.
And also how to delay that elevated privilege UAC as late as possible?

If you have any doubt then please ask me.

Thanks
Akshay

[Catalin]

Hello Akshay,

There are two points (pretty much) when the UAC can be spawned.

The first point is at the start of the installation (if you have checked the "Run as administrator" option in the "Install Parameters" page).

The second point is when the "Install" button is pressed.

Normally, the searches are executed before the "Install" button is pressed, therefore please make sure that you do not have the "Run as administrator" option checked in the "Install Parameters" page.

Best regards,
Catalin

[Balaji]

Hi Catalin,
Hope you are safe and doing well!!
Thanks for your reply.
Yes, we are using "Run as administrator" option checked in the "Install Parameters" page.
To install prerequisites successfully, we have checked this option. Without checking this option we could not install prerequisites successfully.
As per your suggestion, we have to uncheck this option right?
Also, we are unaware how to give administrative privileges when install button is pressed.
Can you help us to achieve second option?

Thanks,
Balaji

[Catalin]

Hello Balaji,

I am doing well indeed, thank you! I hope you guys are doing well, too.

Also, we are unaware how to give administrative privileges when install button is pressed.

You do not have to do anything here. If the package has the installation type of "Per-machine" or "per-user (fails if user is not administrator)", it mostly means that it will try to install in locations that require privilege (for instance, the Windows Directory, e.g. C:\). In order to have privileges to install to those locations, the setup will automatically require administrator privileges when the installation process starts (i.e. when the "Install" button is pressed).

If the installation type is different from those specified above and you still want to require administrator privileges when the installation is performed, you could proceed as it follows:

- go to "Dialogs" page

- select the "VerifyReadyDlg"

- select the "Install" button and from the right pane, under "Attributes", set the "Elevation Shield" attribute to "true"

Hope this helps.

Best regards,
Catalin

[Balaji]

Hi Catalin,
Thanks we are doing well !!
case1 :

Yes, as you have suggested, set the "Elevation Shield" attribute to "true". We have already did this setting.
But, on execution of bootstrapper we are not able to install prerequisites. It is giving warning 4154 : prerequisite was not installed correctly.

Case 2:

When we are using "Run as administrator" option checked in the "Install Parameters" page, it is working fine. But, it asks privileges at the start of the bootstrapper.
Could you help us to resolve this issue?

Thanks,
Balaji

[Balaji]

Hi Catalin,
I have created one sample bootstrapper.
Please check it at your end.

Bootstrapper :

BootstrapperPrj.aip

(81.59 KiB) Downloaded 315 times

Prerequisite MSI :

Prereq_MSI2.aip

(60.3 KiB) Downloaded 323 times

Please let me know your comments on it.

Thanks and regards!
Balaji

[Catalin]

Hello Balaji,

Thank you for the provided files.

I have tested this and I was indeed able to replicate this behavior.

This is happening because the installation of the prerequisite starts at an earlier point than when the UAC prompt appears.

To be more precise, the elevation happens when the main installation happens. The feature based prerequisites are installed right before that point (since two installations can not happen at the same time - this is a known Windows Installer limitation).

An installation process consists of two processes:

- the client process --> where the dialogs are spawned

- the server process --> where the changes are done to the machine

The elevation (when the "Run as administrator" option is not checked) is done when the installation process goes from client to server (when the "Install" button is pressed). However, when the "Install" button is pressed, right before entering the "server" process, the feature-based prerequisites are installed (basically, they are installed during the "client" process).

The only solution in our case would be to also run the client process elevated and the only way to do so is by checking the "Run as administrator" option.

Best regards,
Catalin

[Balaji]

Hi Catalin,
Thanks for the confirmation. I am going forward with your opinion that in our current scenario the only solution is check "Run as administrator" option.

Also, I am not able to install prerequisite MSI using "Post-install" type. It is only installing bootstrapper and not it's prerequisite?
Also, tried custom actions but I have same observations.
Please let me know your comment on this.

Thanks and regards!
Balaji

[Catalin]

Hello Balaji,

Thanks for the confirmation. I am going forward with your opinion that in our current scenario the only solution is check "Run as administrator" option.

You are always welcome.

Also, I am not able to install prerequisite MSI using "Post-install" type. It is only installing bootstrapper and not it's prerequisite?

This is quite strange.

I have tested this just now and everything worked as expected on my end. As you can see in the below screenshot, the prerequisite was installed as expected:

prereq.png (175.47 KiB) Viewed 8277 times

Did you test this scenario with the "Run as administrator" option checked in the "Install Parameters" page? If not, please check that option and let me know if everything works as expected.

Best regards,
Catalin

[Balaji]

Hi Catalin,
Yes, you are correct. It is installing prerequisites along with bootstrapper (using Post-install) only when we check "Run as administrator" option.
As I have unchecked that option it is not installing prerequisite.

Thanks,
Balaji

[Catalin]

Hello Balaji,

It is installing prerequisites along with bootstrapper (using Post-install) only when we check "Run as administrator" option.

I am glad to hear that everything works as expected when the option is checked.

As I have unchecked that option it is not installing prerequisite.

This is happening becuase you are trying to install the prerequisite silently. Please note that in order to install a setup silently, administrative privileges should be provided.

Best regards,
Catalin

[Justin]

Hi Catalin,
1. Could you explain why checked the "Run as administrator" option in the "Install Parameters" page will change the build file from .msi to .exe
2. I'm building the .msi version, I got prompt asking for the credentials at begin install stage, but it will ask again when I need access registry in custom action. Do you have any idea how to let the first elevated privilege over the whole installation and don't ask for credential again.

Best Regards,
Justin

[Catalin]

Hello Justin,

1. Could you explain why checked the "Run as administrator" option in the "Install Parameters" page will change the build file from .msi to .exe

The reason behind this is the fact that an MSI file does not have the "Run as administrator" option, by default, as an EXE does. In order to execute an MSI file elevated, you should:

- open an elevated command prompt

- run the MSI from there (the MSI will inherit the rights from its' parent process, the command prompt):

Code: Select all

msiexec /i <path_to_your_msi>

Our EXE setup package is a bootstrapper over the MSI file that, behind the scenes, launches the MSI elevated as explained above.

In the past, a lot of our users have asked for the posibility to have the "Run as administrator" option for an MSI package, therefore we made that possible. However, there are some drawbacks regarding the signing of the setup package when this method is used, therefore I'd advise against that.

2. I'm building the .msi version, I got prompt asking for the credentials at begin install stage, but it will ask again when I need access registry in custom action. Do you have any idea how to let the first elevated privilege over the whole installation and don't ask for credential again.

If possible, could you please give me some more details about your custom action so I can further investigate this (e.g. some screenshots of the custom action and its' settings)?

Best regards,
Catalin

[Justin]

Hi Catalin,
My custom action is to save registry and restore registry. Below are save and restore part.

Code: Select all

newFolderName = Session.Property("TempFolder")
regFile = newFolderName & "\7062779c-c0db-4ad2-b784-4dfa17030b28.reg"
regKey = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband"
sCmd = "regedit.exe /S /E:A """ & regFile & """ " & """" & regKey & """"
oShell.Run sCmd, 0, True
Dim dteWait
dteWait = DateAdd("s",0.2, Now())
Do Until (Now() > dteWait)
Loop	

Code: Select all

oldFolderName = Session.Property("TempFolder")
regFile = oldFolderName & "\7062779c-c0db-4ad2-b784-4dfa17030b28.reg"
If fso.FileExists(regFile) Then
	oShell.Run "regedit.exe /S & """ & regFile & """ ", 0, True
End If
If fso.FileExists(regFile) Then
	fso.DeleteFile(regFile)
End If

In addition to avoid elevated privilege again, do you think any other idea way I can do for saving and restore registry. Thanks!
Best Regards,
Justin

[Catalin]

Hello Justin,

Thank you for providing more details about your custom actions.

First of all, I'd like to point out some things I've noticed (in your first script - since this is the one I've used for testing):

Code: Select all

newFolderName = Session.Property("TempFolder")
regFile = newFolderName & "\7062779c-c0db-4ad2-b784-4dfa17030b28.reg"

Please note that, by default, the TempFolder ends with a backslash character ("\"), therefore when creating the "regFile" variable, the "\" from the .reg string is no longer needed.

Code: Select all

oShell.Run sCmd, 0, True

This would require the object to be created first, i.e.:

Code: Select all

Set oShell = CreateObject ("WScript.Shell")

In what regards the issue encountered here, unfortunately I was not able to replicate it.

In my tests, the custom action never requested administrator privileges.

Could you please give me some more details about how you are launching this VBScript? By any chance, are you launching it through a "Launch File" custom action?

Please note that we have a predefined custom action for VBScripts:

Vbscript.png (147.82 KiB) Viewed 7416 times

Hope this helps!

Best regards,
Catalin