How to overcome 'insufficient privileges' error for a restricted user?

[peterbi]

Hi,

I am working on a package (Basic MSI/IS2008) to update certain data files of an installed product. The product should be installed by administrator users, but the upgrade package should work for restricted users, i.e. users without administrator privileges should be able to install the package and update data files.

Now I run into "Error 1321. The installer has insufficient privileges to modify the file ....." error, when I try to install the package from a restricted user account. I have tried several ways (change setup.exe exec level to administrator; create a same INSTALLDIR and create a full permission to 'Everyone'; enter INSTALLDIR to LockPermission table to allow 'Everyone' GENERIC_ALL), but without luck.

How can I overcome the error? Our tageted OS is XP/W2k3/Vista.


Thanks,
Peter

[peterbi]

First I need to clarify that there are two different packages in this context: first is the product package which should always be installed by admin/previliged users; second is the updating package that updates some data files, it is installed by restricted users ONLY.

It turns out that it is really a 'permission' problem -

On a W2K3 testing system, if I manually change the INSTALLDIR (eg. C:\Program Files\My_prod) to allow 'Full Control' to 'Users (The_Domain\Users)' from an admin user log on, then relog in as a restricted user, and install the updating installer, it works fine.

So I think what I need to do is to make the updating package to change the permission of INSTALLDIR (both packages share the same INSTALLDIR) to allow 'Users(The_Domain\Users)' to have 'Full Control'. I have played with LockPermission table but can't make it work yet. Here is what I have right now:

LockObject Table Domain User Permission
======== ======= ======== ========== ===========
INSTALLDIR Directory Everyone 1879048192
INSTALLDIR Directory [%USERDOMAIN] IUSR_[%USERDOMAIN] 1879048192
INSTALLDIR Directory [%USERDOMAIN] Users 1879048192

I also tried to use 'CreateFolder' for 'Table' entries, and different Permission combinations (537002153, 1880031743, etc.)

Please note that I am trying to do this (changing folder permission) with the updating package, which is run ONLY by restricted users, maybe that's the reason it won't work? If so, are there any workarounds or solutions to it?


Thanks,
Peter

[RobertDickau]

Offhand, I'm not sure you can set up a related package that runs with elevated privileges. Depending on your MSI version and how you package it, a patch might work in some cases; please see, for example, the MSI topics "User Account Control (UAC) Patching" and "Installing a Package with Elevated Privileges for a Non-Admin".

[peterbi]

Hi Robert,

Thank you for your advices.

Now I am trying to make it work for only future releases, so I just make the product (via the updating) install to make INSTALLDIR allow 'Full Control' to 'Everyone' when it is installed by admin users; with that done, a restricted user can install the updating package and update data files. All that happens when the product is installed on a local place, not a mapped drive.

But when I tested the mapped drive (our product allows both local and mapped locations), I run into the 1926 error (see the attached file).

Do you know how to solve/avoid/workaround this (mapped drive) problem?


Thanks,
Peter