MSI file installation fails on computers with logged-inrestricted users

[Nate Allen]

I'm trying to package Flash Player 8b for silent distribution via Microsoft
SMS. My package works correctly on computers where a logged in user is either
a local Administrator or Power user, but fails with an error on computers where
the logged in user has no such rights. The SMS package is set to install with
administrative rights. The computers are Windows 2000 SP4 and Windows XP SP2
workstations. I only have the problem with Windows XP SP2, but those computers
are the only ones without priviledged users. I've confirmed that computers
with logged-in administrative users work properly, like my own Windows XP
machine.

The installer I'm using is "install_flash_player_active_x.msi" and the version
is "8,0,24,0". The digital signature is dated "Friday, March 31, 2006 12:45:10
PM". I am led by other posts to believe that this is the most current version
and that I shouldn't be having these problems with it.

The error that is reported in the log files is:

1: ISMsiServerStartup Failure, Failed to Initialize script support, Error =
0x80070006

I'm using a Visual Basic script in my SMS package. It attempts to run the
"uninstall_flash_player.exe" uninstaller to remove old versions, then tries to
run the installer. It uses the following command line:

install_flash_player_active_x.msi /log %systemroot%\temp\flash_msi.log /qn
allusers=2 reboot=reallysuppress

Originally I did not include the "allusers=2 reboot=reallysuppress", but I was
having another error and various Macrovision and InstallShield support sites
suggested that addition as a fix. That error was "Internal error 2103. 26".

Any ideas? Should this really be so hard to package and distribute?





' This script tries to install/upgrade the Macromedia Flash Player

'************************************************* ******************************
****

On Error Resume Next

Const ForAppending = 8

' Create the filesystem object and open a log file. Create a Shell object.
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objShell = Wscript.CreateObject("Wscript.Shell")

strSystemroot = objShell.ExpandEnvironmentStrings("%SYSTEMROOT%")
strLogFile = strSystemroot & "\Temp\flash.log"
If Not objFSO.FileExists(strLogFile) Then
Set objTextFile = objFSO.CreateTextFile(strLogFile, False)
End If

Set objTextFile = objFSO.OpenTextFile(strLogFile, ForAppending, True)

objTextFile.WriteLine
("------------------------------------------------------------------------------
--")
objTextFile.WriteLine ("Macromedia Flash Player installed/upgraded " & Now &
".")
objTextFile.WriteLine ("See %systemroot%\temp\flash_msi.log for more MSI log
information.")
objTextFile.WriteBlankLines(1)

' Run the Macromedia Flash Player uninstaller if necessary.
Err.Clear
strFlashPath = strSystemroot & "\system32\macromed\flash\"

If objFSO.FileExists(strFlashPath & "flash.ocx") OR
objFSO.FileExists(strFlashPath & "flash8.ocx") OR
objFSO.FileExists(strFlashPath & "flash8a.ocx") Then
objShell.Run(".\uninstall_flash_player.exe /s"),1,True
If Err.Number <> 0 Then
objTextFile.WriteLine("Could not uninstall an old version of the
Macromedia Flash Player. Error: " & Err.Number & " -- " & Err.Description)
Err.Clear
Else
objTextFile.WriteLine("Old versions of Macromedia Flash Player
uninstalled.")
Wscript.Sleep 10000
End If
Else
objTextFile.WriteLine("There is no old version of Flash to uninstall.")
End If

'Run the Macromedia Flash Player 8 installer.
If Not objFSO.FileExists(strFlashPath & "flash8b.ocx") Then
objShell.Run(".\install_flash_player_active_x.msi /log
%systemroot%\temp\flash_msi.log /qn allusers=2 reboot=reallysuppress"),1,True
If Err.Number <> 0 Then
objTextFile.WriteLine("Could not run the Macromedia Flash Player
installer. Error: " & Err.Number & " -- " & Err.Description)
Err.Clear
Else
objTextFile.WriteLine("The current version of the Macromedia Flash Player
was installed.")
Wscript.Sleep 10000
End If
Else
objTextFile.WriteLine("The current version of the Macromedia Flash Player is
already installed.")
End If

'Copy the config file to disable Auto Update Notifications.
objFSO.CopyFile ".\mms.cfg", strFlashPath
If Err.Number <> 0 Then
objTextFile.WriteLine("Could not copy the mms.cfg configuration file.
Error: " & Err.Number & " -- " & Err.Description)
Err.Clear
Else
objTextFile.WriteLine("Configuration file copied.")
End If

' Close the text file.
objTextFile.Close
objTextFile.WriteBlankLines(1)

'END OF SCRIPT
************************************************** *******************

[Bentley Wolfe [Adobe]]

Nate Allen wrote:

> I'm trying to package Flash Player 8b for silent distribution via Microsoft
> SMS. My package works correctly on computers where a logged in user is either
> a local Administrator or Power user, but fails with an error on computers where
> the logged in user has no such rights. The SMS package is set to install with
> administrative rights. The computers are Windows 2000 SP4 and Windows XP SP2
> workstations. I only have the problem with Windows XP SP2, but those computers
> are the only ones without priviledged users. I've confirmed that computers
> with logged-in administrative users work properly, like my own Windows XP
> machine.
>
> The installer I'm using is "install_flash_player_active_x.msi" and the version
> is "8,0,24,0". The digital signature is dated "Friday, March 31, 2006 12:45:10
> PM". I am led by other posts to believe that this is the most current version

That is NOT the most recent version of the MSI. It was refreshed on
4/6/06 with fixes for exactly this issue. Grabbing a new installer from
the licensed distribution installer information should resolve this
issue for you.

Bentley Wolfe
Senior Support Engineer, Flash/Flash Player
*Macromedia, now a division of Adobe Systems

[Nate Allen]

Bentley,

Thank you for your response. I tried re-downloading the .MSI installer but
the file is exactly the same as the one I'm attempting to distribute. I used
the link in the licensing response system to get to the download page:


[url]http://www.macromedia.com/cfusion/entitlement/index.cfm?loc=en%5Fus&k=31599404%2[/url]
Dd9d1%2D7e4d%2D02ab395ca6e90736

Is that not the correct link? How can I tell if the .MSI file I have is the
correct file?

Thanks for your help!

[Bentley Wolfe [Adobe]]

Nate Allen wrote:

> Bentley,
>
> Thank you for your response. I tried re-downloading the .MSI installer but
> the file is exactly the same as the one I'm attempting to distribute. I used
> the link in the licensing response system to get to the download page:
>
>
> [url]http://www.macromedia.com/cfusion/entitlement/index.cfm?loc=en%5Fus&k=31599404%2[/url]
> Dd9d1%2D7e4d%2D02ab395ca6e90736
>
> Is that not the correct link? How can I tell if the .MSI file I have is the
> correct file?

Nate..

Please open a support case via
[url]http://www.macromedia.com/support/flashplayer[/url] (or use the licensing
address provided in your license..)

Bentley Wolfe
Senior Support Engineer, Flash/Flash Player
Adobe

[Nate Allen]

Bentley,

I've opened case 8546662 and referenced this thread for more information. I
responded to the automated support message asking to keep the case open.

Is the version I have the proper version, or is there another, newer version
of the .MSI file that haven't been able to find? I've looked all over this
site and Google for a newer version than the one I keep downloading.

Thanks!

[Nate Allen]

Bentley,

I don't think I'm getting anywhere with Support. First they sent me a link to
the KB article that references the 'new' installer, then they sent me a link to
download that same file again. Although I've asked directly several times, no
one seems willing to answer this simple question: "Do I have the correct
version of the MSI installer?"

Can you help? Do I have the correct version of the MSI installer? It has a
digital signature dated "Friday, March 31, 2006 12:52:16 PM", has a file size
of 4,624,384 bytes, and has a revision number of
{DE82756D-0BC2-486A-92BE-012EB168AA54}.

If I have the right installer, can you help me find out why it will not
install on computers with logged-in restricted users?

--Nate

[Bentley Wolfe -ADOBE]

I've confirmed that you do have the correct installer.

I'm going to have a higher level agent take over and contact you. We don't
generally support distributions, so we may just have to escalate to Engineering
and find out what they have to say. Make sure you take a look at the required
permissions technote as well ([url]http://www.adobe.com/go/tn_19148[/url]).

Bentley

[RichMosca]

We have the same exact problem running with SMS on some machines. Has this been resolved in any way.

Thanks, Rich

[Nate Allen]

No, not really. I don't have hours to spend troubleshooting this problem so
I'm setting the Flash Player package's install program to only run when no one
is logged in to the computer. It will take much longer to distribute that way,
but at least it works.

I suspect we'll have more people reporting this problem now that the May patch
summary from Microsoft is out, as it recommends that people get their Flash
Players upgraded to resolve its many and varied security flaws.

--Nate

[RichMosca]

Just finished with the SMS crew at Premier. What happens is when the MSI runs
it starts with the SMS software install account and if a user is logged on
somewhere in the middle the msi switches to the logged on user account. If
permissions on the temp directory are not correct it can't create a directory
under temp and continue to unload and run. If no user is logged on it continues
and appears to go ok. We altered our install script which is just a wrapper
around the msi to check permissions on temp and give users full control on the
temp directory using cacls. Good to go after that. Will do more testing
tomorrow.

[Nate Allen]

Rich,

Which temp directory is it using? %systemroot%\temp?

Bentley, can your dev folks take a look at this and see why the MSI switches
to the logged-in user as Rich describes? If it installed using the system
account it shouldn't have any trouble accessing the temp directory.

--Nate

[RichMosca]

Nate, this is what MS sent us. How we confirmed, we gave users full control
on the window\temp and then monitored the install with task manager. At some
point you see the isxxx process jump in with the logged on user account. Hope
this helps.
FROM MS: <I believe this is an extract from a customer>
When the 8.0.24.0 Flash MSI runs as LocalSystem, it extracts some files into
a directory under C:\WINDOWS\TEMP (named with a GUID). It then switches to the
currently logged-on user account and attempts to do some things (not sure what)
as that account in which it attempts to access those files it extracted into
that subdirectory of C:\WINDOWS\TEMP. This, of course, it cannot do, because
Microsoft wisely and craftily set the permissions on C:\WINDOWS\TEMP so that
anyone can create files and folders therein, but so that access to those files
and folders are restricted to the account that created them.
-The workaround is either to avoid running the MSI while there is a
user logged on that lacks admin privs or to adjust the permissions on
C:\WINDOWS\TEMP before and after running the MSI

[NancyLee123]

Rich,
I'm having the same problem and agree with Bentley that the MSI installation
as a SYSTEM account shouldn't have problems accessing windows\temp during the
installation. If the installation switches context to a non-admin user during
the installation, then perhaps the necessary files should be located elsewhere.
Please follow-up with your findings as I don't think that changing rights to
c:\windows\temp is an acceptable solution.

Thanks

[stonneway]

I 2nd that. Changng perms on tonnes of machines just for Flash is a nonsense.

I wish Macromedia would do some ***** testing before they send products out !

Olly

[Bentley Wolfe [Adobe]]

Nate Allen wrote:

> Rich,
>
> Which temp directory is it using? %systemroot%\temp?
>
> Bentley, can your dev folks take a look at this and see why the MSI switches
> to the logged-in user as Rich describes? If it installed using the system
> account it shouldn't have any trouble accessing the temp directory.

I'll see if I can dig anything up.

Bentley

[Skuld-Chan]

I actually tested this scenario today - just for kicks. I usually install most
things via system, however when I tested in my SMS-2003, XP-SP2 test
environment it worked just fine.

However - in researching this problem I found people who had similar problems
with ISScript - with the exact error your getting.

The only thing I can think is that I had installed ISSCript 10.1 earlier for
some other test. What is the exact version of issscript that you are using?

[Bentley Wolfe [Adobe]]

Skuld-Chan wrote:

> I actually tested this scenario today - just for kicks. I usually install most
> things via system, however when I tested in my SMS-2003, XP-SP2 test
> environment it worked just fine.
>
> However - in researching this problem I found people who had similar problems
> with ISScript - with the exact error your getting.
>
> The only thing I can think is that I had installed ISSCript 10.1 earlier for
> some other test. What is the exact version of issscript that you are using?

I have someone looking into this. It is some sort of ISSCript issue, and
we might be able to provide some guidance later this week...

Bentley Wolfe
Senior Support Engineer, Flash/Flash Player
Adobe

[Skuld-Chan]

I did find a solution to this odd problem. It does seem to be a dcom
priveledges issue. I suspect the reason it isn't seen on pre-sp2 is because
Microsoft made some changes to post xp-sp2 to tighten security. So ISSCript it
called via dcom. Installsheilds default runas is "Interactive User" somewhere
between SMS client running as user with admin rights causes this to break. I
found that if you remove the runas string it will execute in whatever security
context the program that called is running in. Since the SMS client has full
control of the machine it works. I've attached a script that basically makes an
array of dcom appid using wmi, removes the ones that don't have the column
"InstallShield InstallDriver" in them - store those in a an array then remove
the runas line from each. I actually found this script on the InstallShield
site - I left the credits intact :) - however I've already thought of a few
ways to improve on this script.

The other problem is that Flash Player 10 installs the InstallSheild Driver on
launch - which effectively restores the runas string. So I found there's a
custom action called "EngineStartup.4F635B62_07BF_4779_B74E_D80C29D508E 3" - to
disable this I simply made a transform and removed this row in the
InstallExecuteSequence table. Then it all works :).

Keep in mind - if your target machines do not have Install Shield Driver 10 on
them you'll need to install that in your script before installing Flash Player
10. To do this make a transform for isscript10.msi and remove the Registry601
row - so it does not create the runas key on install.

Or... You could just do the install as system :).

' Authors: Ryan Gray / Chris Kuhl
' Date: 2003-12-30
' Version 1.0
'
' This script enumerates the Dcom appID's for the InstallShield dcom apps
' Then taking that id deletes the run as property of the key to set the
' run as identity to run as launching user.
' This corrects several permissions issues experienced by NI installed MSI's
' using installshield technology.

Const HKEY_CLASSES_ROOT = &H80000000
'On Error Resume Next
Set objShell = CreateObject("WScript.Shell")
strComputer = "."
Set objReg = GetObject("winmgmts:{impersonationLevel=impersonat e}!\\" &
strComputer & "\root\default:StdRegProv")
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery("Select * from
Win32_DCOMApplicationSetting",,48)
For Each objItem in colItems
If objItem.Description <> "" Then
arrFind=Split(objItem.Description)
For i=0 To UBound(arrFind)
If lcase(arrFind(i))="installshield" then

'Wscript.Echo "Description: " & objItem.Description
'Wscript.Echo "AppID: " & objItem.Description

strKeyPath = "AppID\" & objItem.AppID
strEntryName = "RunAs"
strValue = ""
objReg.DeleteValue HKEY_CLASSES_ROOT,strKeyPath,strEntryName
End if
Next
End If
Next

objShell.run "msiexec.exe /i install_flash_player_active_x.msi
transforms=install_flash_player_active_x.mst /qb /L*v c:\flash_test.out
ALLUSERS=1",0,true

[sfodd_lethal]

Good work on that script! I've been able to successfully test it on my machine.
However, I wanted to test it again to be sure it worked 100% before I started
deploying to numerous computers. With that being said, I uninstalled Flash
using uninstall_flash_player.exe and restarted the machine. I then tried to
install flash again using your script, however this time the installshield
quickly pops up and dissapears and then nothing happens. After this happened I
could no longer succesfully install flash using your script. When I looked in
the task manager there were two msiexec.exe's and two wmiprvse's. I ended those
processes and tried again to no avail. Are there possibly any other processes I
would need to end in order for the installation to complete succesfully again
without restarting the PC? Any ideas why this happened in the first place?

[NancyLee123]

All,

Bentley Wolfe indicated that Adobe would provide more information and/or new
install later this week. I'm hoping that they are still on the case and
working toward a resolution. Bentley, can we still expect something from you?

Nancy