PDA

View Full Version : Elevated privileges: running standard project EXEs in a locked down environment?



alastair.camero
04-15-2002, 09:00 AM
Developer 7.02, Standard Project.

Our product is in the alpha testing stage, and is due to go in to beta shortly.

During beta, the product will need to be installed on "locked down" Windows 2K/XP PCs. The users of these computers log in to a domain and have user profiles set up. They will not have administrative privileges, and so will not be able to install our product.

Our product setup is a per-machine (ALLUSERS=1) install, and includes MDAC 2.7 as well as Windows NT Services, etc. Currently that means you need administrative privileges to install.

However, from what I've read of elevated privileges and Windows Installer, this might work for us too.

Can somebody give me an idea of how elevated privileges work, whether they need to be configured as part of the user policy by our computer/network support department, what options exist for rolling out the setup centraally, etc.

Thanks.

Alastair

Happy Days
04-15-2002, 09:30 AM
Hi,

When you build your release in Developer 7, the builder creates an msi package named iscript.msi, which setup.exe launches to install the Installscript engine files. When a setup is run with elevated privileges, this msi package also inherits the elevated privileges.

In order to run an installation on a target machine and have it work regardless of user privileges, the following must be done before the install is launched:
The registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated must have a string value of "1". The system administrator must perform this.

The registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated must have a string value of "1". Any user can perform this.
When the above values are set correctly, an installation can run correctly regardless of user privileges.

Thanks. Please note that all this is taken from the IS KB :)