(Msg. 9) Posted: Mon Jun 30, 2008 3:06 am
Post subject: RE: Legacy application installations Add to elertz [Login to view extended thread Info.] Archived from groups: microsoft>public>windows>vista>security (more info?)
Hello Mike,
Thanks for the reply.
Since you don't have permission to modify the GPO settings, I would like to
suggest that you disable UAC on each client manually by performing the
following steps:
1. Logon the system as administrator
2. Open "Control Panel\User Accounts", and then choose "Turn user Account
Control on or off"
3. Un-select the Checkbox of "Use User Account Control (UAC) to help
protect your computer"
4. Click on Ok and then reboot the computers.
5. Then you may the command line to check if you can install the msi file
with non-administrator account.
(Msg. 10) Posted: Mon Jun 30, 2008 3:06 am
Post subject: RE: Legacy application installations Add to elertz [Login to view extended thread Info.] Archived from groups: per prev. post (more info?)
David,
We are testing our processes to see what we need to modify to migrate to
Vista.
In a production, we are not allowed to turn off UAC.
The installer does have admin privileges on the individual pc, but the
installation only works properly if we run the MSI directly, not if we run
the command file. And the only thing the command file does is to call msiexec
with the appropriate parameters.
- Mike
"David Shen [MSFT]" wrote:
> Hello Mike,
>
> Thanks for the reply.
>
> Since you don't have permission to modify the GPO settings, I would like to
> suggest that you disable UAC on each client manually by performing the
> following steps:
>
> 1. Logon the system as administrator
>
> 2. Open "Control Panel\User Accounts", and then choose "Turn user Account
> Control on or off"
>
> 3. Un-select the Checkbox of "Use User Account Control (UAC) to help
> protect your computer"
>
> 4. Click on Ok and then reboot the computers.
>
> 5. Then you may the command line to check if you can install the msi file
> with non-administrator account.
>
> Hope it helps.
>
> David Shen
> Microsoft Online Partner Support
>
>
(Msg. 11) Posted: Thu Jul 03, 2008 7:42 am
Post subject: RE: Legacy application installations Add to elertz [Login to view extended thread Info.] Archived from groups: per prev. post (more info?)
Hello Mike,
Thanks for your reply.
According to the research, here is some information just for your reference.
Analysis and Suggestion:
======================
Installation programs are applications designed to deploy software, and
most write to system directories and registry keys. These protected system
locations are typically writeable only by administrator users; this
restriction means that standard users do not have sufficient access to
install most programs. Windows Vista heuristically detects installation
programs and requests administrator credentials or administrator approval
in order to run with access privileges.
Windows Vista heuristically detects updater and un-installation programs. A
design goal of UAC is to prevent installations from being executed without
the user's knowledge and explicit consent since installations write to
protected areas of the file system and registry.
This is reason that we suggested you disabling UAC on Vista clients. In
this way, we need to disable the UAC feature on Windows Vista box so that
the MSI file can be installed successfully.
I understand that you want to keep UAC enabled on production environment.
If you don't want to disable the UAC feature on Windows Vista box, another
option is that you may customize a manifest file in the same location as
the executable, with the same name as the executable with .manifest
appended to the filename.
(Msg. 12) Posted: Thu Jul 03, 2008 7:42 am
Post subject: RE: Legacy application installations Add to elertz [Login to view extended thread Info.] Archived from groups: per prev. post (more info?)
Thanks, David.
We will be looking into the references you supplied and I will get back to
you.
- Mike
"David Shen [MSFT]" wrote:
> Hello Mike,
>
> Thanks for your reply.
>
> According to the research, here is some information just for your reference.
>
> Analysis and Suggestion:
> ======================
>
> Installation programs are applications designed to deploy software, and
> most write to system directories and registry keys. These protected system
> locations are typically writeable only by administrator users; this
> restriction means that standard users do not have sufficient access to
> install most programs. Windows Vista heuristically detects installation
> programs and requests administrator credentials or administrator approval
> in order to run with access privileges.
>
> Windows Vista heuristically detects updater and un-installation programs. A
> design goal of UAC is to prevent installations from being executed without
> the user's knowledge and explicit consent since installations write to
> protected areas of the file system and registry.
>
> This is reason that we suggested you disabling UAC on Vista clients. In
> this way, we need to disable the UAC feature on Windows Vista box so that
> the MSI file can be installed successfully.
>
> For more information, please refer to:
>
> Override Installer Detection using Manifests, the following articles
> explain:
> http://technet2.microsoft.com/WindowsVista/en/library/00d04415-2b2f-422c-b70 > e-b18ff918c2811033.mspx?mfr=true
> (Please look at the section on Installer Detection Technology)
>
> I understand that you want to keep UAC enabled on production environment.
> If you don't want to disable the UAC feature on Windows Vista box, another
> option is that you may customize a manifest file in the same location as
> the executable, with the same name as the executable with .manifest
> appended to the filename.
>
> The following link explains:
> http://msdn.technetweb3.orcsweb.com/heaths/rss.aspx?Tags=Installation/VS+200 > 5+SP1/UAC&AndTags=1
>
> If you want to detailed support on customizing the manifest file, you may
> initial a new post in our MSDN forum.
>
> For your convenience, I have list the link to MSDN forum as followed.
>
> http://forums.microsoft.com/MSDN/default.aspx?SiteID=1 >
> Hope the issue will be resolved soon.
>
> David Shen
> Microsoft Online Partner Support
>
>
(Msg. 13) Posted: Tue Jul 08, 2008 2:03 am
Post subject: RE: Legacy application installations Add to elertz [Login to view extended thread Info.] Archived from groups: per prev. post (more info?)
Hello Mike,
I haven't received any responses from you lately, and I am wondering if I
can provide further assistance or if the issue has been resolved.
(Msg. 14) Posted: Tue Jul 08, 2008 2:28 am
Post subject: RE: Legacy application installations Add to elertz [Login to view extended thread Info.] Archived from groups: per prev. post (more info?)
David,
Thanks for checking back. I did look into your suggestions and it does not
appear to be of any help. As I understand it my only real choice is to make a
..manifest file for the "executable". However the files are arbortext.msi and
testInstall-ArborText_5-3.cmd.
I copied the exact text and created .manifest files for each of the above.
Installation still fails.
- Mike
"David Shen [MSFT]" wrote:
> Hello Mike,
>
> I haven't received any responses from you lately, and I am wondering if I
> can provide further assistance or if the issue has been resolved.
>
> David Shen
> Microsoft Online Partner Support
>
>
(Msg. 15) Posted: Tue Jul 08, 2008 3:06 am
Post subject: RE: Legacy application installations Add to elertz [Login to view extended thread Info.] Archived from groups: per prev. post (more info?)
David,
I took one more shot at it.
I had previously tested by running the .cmd file (using "Run as
Administrator") which did not work.
So I started a "Run as Administrator" cmd window. I then tried to cd to the
mapped network drive where the install package is stored. No go.
So I then mapped a drive (using the same drive letter as is mapped in
Windows Explorer) to the network share. I then cd'd to the appropriate place
on the mapped drive and ran the command file.
This did install the software, but we need to do some testing if all
installed ok.
If this worked, this leads to a follow-on question. If "Run as
Administrator" removes access to mapped drives, what is the solution since
all of our installations run from a mapped drive?
- Mike
"Mike_g" wrote:
> David,
> Thanks for checking back. I did look into your suggestions and it does not
> appear to be of any help. As I understand it my only real choice is to make a
> .manifest file for the "executable". However the files are arbortext.msi and
> testInstall-ArborText_5-3.cmd.
> I copied the exact text and created .manifest files for each of the above.
> Installation still fails.
> - Mike
>
>
>
> "David Shen [MSFT]" wrote:
>
> > Hello Mike,
> >
> > I haven't received any responses from you lately, and I am wondering if I
> > can provide further assistance or if the issue has been resolved.
> >
> > David Shen
> > Microsoft Online Partner Support
> >
> >
(Msg. 16) Posted: Tue Jul 08, 2008 6:21 am
Post subject: Re: Legacy application installations Add to elertz [Login to view extended thread Info.] Archived from groups: per prev. post (more info?)
On Tue, 8 Jul 2008 03:06:13 -0700, Mike_g wrote:
> If this worked, this leads to a follow-on question. If "Run as
> Administrator" removes access to mapped drives, what is the solution since
> all of our installations run from a mapped drive?
How are the original drive mappings being done? When you use "runas" you're
getting a command prompt that is running in a new security context, and
essentially a new user profile. Anything that is available in the security
context of the currently logged in user, such as mapped drives, will not be
available in the new security context.
--
Paul Adare
MVP - Identity Lifecycle Manager
http://www.identit.ca
Computer programmers do it byte by byte.
All times are: Eastern Time (US & Canada) (change) Goto page Previous1, 2, 3, 4
Page 2 of 4
You can post new topics in this forum You can reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
Home
Forums
Home
FAQ
Search
Profile
Private Messages
Log in/Register/Password
Windows Vista