Urgent since upgrading to Elevated privileges not working

Add-in Express™ Support Service
That's what is more important than anything else

Urgent since upgrading to Elevated privileges not working
 
Tim Kempster


Guest


Dear AIE

Help this is urgent! Since we upgraded to the latest version the MSI installers we are creating can't run with elevated privileges and so are not able to properly install our AddIn.

See the log file below. I'm pretty sure this didn't happen before and is a result of going to the the latest version of AIE.

Please help this is a production issue.

----------
Add-in Express Registrator Log File: 02/18/2016 12:42:18

Installation directory: C:\Program Files (x86)\TraySelector\One\
Registrator version: 8.1.4350.0
Operating System: Microsoft Windows 7 Ultimate Edition Service Pack 1 (build 7601), 64-bit
Process Owner: Administrator
Command Line: "C:\Program Files (x86)\TraySelector\One\adxregistrator.exe" /install="TraySelector.dll" /privileges=admin
Run 'As Administrator': No
Process Elevated: No
Integrity Level: Medium
UAC (User Account Control): On
--------------------------------------------------------------
12:42:18 0192 Starting the add-in registration process.
12:42:18 0192 Loading mscoree.dll
12:42:18 0192 Success.
12:42:18 0192 .NET Framework installation directory:
12:42:18 0192 The latest version of .NET Framework: 'v4.0.30319'
12:42:18 0192 Loading CLR: v4.0.30319.
12:42:18 0192 Calling CLRCreateInstance method.
12:42:18 0192 Success.
12:42:18 0192 Calling GetRuntime method.
12:42:18 0192 Success.
12:42:18 0192 Checking if the hosting API of .NET Framework v4.0 beta is installed.
12:42:18 0192 The hosting API is up to date.
12:42:18 0192 Calling GetInterface method for the CorRuntimeHost interface.
12:42:18 0192 Success.
12:42:18 0192 Starting CLR...
12:42:18 0192 Success.
12:42:18 0192 Getting the CLR version.
12:42:18 0192 The CLR v4.0.30319 has been initialized successfully.
12:42:18 0192 Creating a new domain setup.
12:42:18 0192 Success.
12:42:18 0192 Getting the add-in directory.
12:42:18 0192 Success. The directory is 'C:\Program Files (x86)\TraySelector\One\'
12:42:18 0192 The 'shadow copy' is disabled.
12:42:18 0192 Creating a new application domain.
12:42:18 0192 Success.
12:42:18 0192 Getting the base directory for the domain.
12:42:18 0192 Success. The directory is 'C:\Program Files (x86)\TraySelector\One\'.
12:42:18 0192 Searching for the Add-in Express core library.
12:42:18 0192 Success. The 'AddinExpress.MSO.2005.dll' file is found.
12:42:18 0192 Creating an instance of the 'AddinExpress.Deployment.ADXRegistrator' class.
12:42:18 0192 Assembly identity is 'AddinExpress.MSO.2005'.
12:42:18 0192 Success.
12:42:18 0192 Unwrapping the instance of the 'AddinExpress.Deployment.ADXRegistrator' class.
12:42:18 0192 Success.
12:42:18 0192 Calling the managed registration procedure (DISPID = 1610743823).
12:42:19 0192 Managed Error:
Date and Time: 2/18/2016 12:42:18 PM
Machine Name: HP-PC
IP Address: fe80::f50b:4de4:54b4:912a%14
Current User: HP-PC\HP

Application Domain: C:\Program Files (x86)\TraySelector\One\
Assembly Codebase: file:///C:/Windows/assembly/GAC_MSIL/AddinExpress.MSO.2005/8.1.4350.0__4416dd98f0861965/AddinExpress.MSO.2005.dll
Assembly Full Name: AddinExpress.MSO.2005, Version=8.1.4350.0, Culture=neutral, PublicKeyToken=4416dd98f0861965
Assembly Version: 8.1.4350.0

Exception Source: AddinExpress.MSO.2005
Exception Type: System.ComponentModel.Win32Exception
Exception Message: Access is denied
Exception Target Site: CreateSubKey

---- Stack Trace ----
AddinExpress.Projects.Common.ADXRegistryKey.CreateSubKey(subKeyName As String)
AddinExpress.MSO.2005.dll: N 0132 (0x84) IL
AddinExpress.Projects.Common.Utilities.RegisterManagedType(rootKey As ADXRegistryKey, type As Type, strAsmName As String, strAsmVersion As String, strAsmCodeBase As String, strRuntimeVersion As String, targetHive As ADXTargetRegistryHive, createVersionKey As Boolean)
AddinExpress.MSO.2005.dll: N 0082 (0x52) IL
AddinExpress.Projects.Common.Utilities.RegisterType(t As Type, createVersionKey As Boolean, allUsers As Boolean, targetHive As ADXTargetRegistryHive, callRegMethod As Boolean)
AddinExpress.MSO.2005.dll: N 0206 (0xCE) IL
AddinExpress.Projects.Common.Utilities.RegisterAssembly(assembly As Assembly, createVersionKey As Boolean, allUsers As Boolean, targetHive As ADXTargetRegistryHive, callRegMethod As Boolean)
AddinExpress.MSO.2005.dll: N 0040 (0x28) IL
AddinExpress.Deployment.AddinDomainAdapter.RegisterForComInterop(register As Boolean, dllType As String, dllPath As String, showExceptions As Boolean)
AddinExpress.MSO.2005.dll: N 0205 (0xCD) IL
AddinExpress.Deployment.ADXRegistrator.RegisterAssembly(commandLine As String)
AddinExpress.MSO.2005.dll: N 0705 (0x2C1) IL



12:42:19 0192 The add-in registration process is completed with HRESULT = -2147467259.
Posted 18 Feb, 2016 07:59:16 Top
Andrei Smolin


Add-in Express team


Posts: 18823
Joined: 2006-05-11
Hello Tim,

You need to start the installer elevated. To do so, start setup.exe, not .MSI. If this doesn't trigger the UAC warning *immediately*, right-click setup.exe and choose "Run as administrator" on the context menu.


Andrei Smolin
Add-in Express Team Leader
Posted 18 Feb, 2016 08:06:07 Top
Tim Kempster


Guest


Hi Andrei

But we ship our installer from the internet as a .MSI file www.trayselector.com/download/download-files/ and sometimes send this installer for users to install. When they download they click to install but it doesn't warn them about admin. Are you saying now we need to ship the setup.exe and give instructions about running as Admin ?

Is this something new or has this always been the case?

Tim
Posted 18 Feb, 2016 08:12:38 Top
Andrei Smolin


Add-in Express team


Posts: 18823
Joined: 2006-05-11
This has always been the case. To check if everything is correct on your side, follow the steps listed in section "Deploying a per-machine Office extension via an MSI installer", see the PDF file in the folder {Add-in Express}\Docs on your development PC.

Installing a per-machine add-in requires administrative permissions. The custom actions in the installer are run with the privileges of the user who starts the .MSI. If the installer is started non-elevated, the custom actions don't have permissions to create/delete required keys in HKLM; this is your case.

Another way is to get permissions is to start the Command Prompt elevated and execute MSIEXEC.EXE to install your .MSI.


Andrei Smolin
Add-in Express Team Leader
Posted 18 Feb, 2016 08:30:26 Top
Tim Kempster


Guest


I'm afraid I think something has changed here. I've just pulled an adxregistrator.txt log file from a machine which had installed using an older version where the .msi file would have been run directly and everything seems fine. In particular the /privaledge=admin is set in the log file and directly afterwards we see it reporting running as administrator and UAC On.

Also if nothing had changed then my users would not have started reporting the issue before they were all running the .msi with no issues for installation.

I note that now this is not the case even though it is a user with admin privileges running the msi.

I also note that it is possible to set a property on the adxregistrator.exe under the compatibility tab under settings to be "Run this program as administrator" which solves the problem. Could it be in the old version that this property was set on the adxregistrator.exe file that is shipped with the installer? If not then why not set this as this would solve the problem?

Tim
Posted 18 Feb, 2016 09:34:17 Top
Andrei Smolin


Add-in Express team


Posts: 18823
Joined: 2006-05-11
Tim Kempster writes:
Also if nothing had changed then my users would not have started reporting the issue before they were all running the .msi with no issues for installation.


Your logic is correct.

Tim Kempster writes:
I also note that it is possible to set a property on the adxregistrator.exe under the compatibility tab under settings to be "Run this program as administrator" which solves the problem. Could it be in the old version that this property was set on the adxregistrator.exe file that is shipped with the installer? If not then why not set this as this would solve the problem?


This only relates to starting adxregistrator.exe using the Windows UI. When you run the .MSI, adxregistrator.exe is started in a different fashion (see my previous post).

So it looks like you register the add-in in a way which is not described in the Add-in Express manual, is this correct?


Andrei Smolin
Add-in Express Team Leader
Posted 18 Feb, 2016 09:51:00 Top
Tim Kempster


Guest


"So it looks like you register the add-in in a way which is not described in the Add-in Express manual, is this correct?"

No I've checked the steps in the manual and I'm following them exactly. The registration is the Custom Actions->Install step as follows :-

name: adxregistrator.exe
Arguments: /install="TraySelector.dll" /privileges=admin

AIUI that step should run with elevated privileges but clearly that's not happening now.

Tim
Posted 18 Feb, 2016 10:07:14 Top
Andrei Smolin


Add-in Express team


Posts: 18823
Joined: 2006-05-11
Hello Tim,

Another idea: they might have turned UAC on.


Andrei Smolin
Add-in Express Team Leader
Posted 19 Feb, 2016 01:22:33 Top
Tim Kempster


Guest


Hi Andrei

But UAC is on by default right? In which case at the point adxregistrator.exe is run during install it should have promoted to elevate permissions and that should have produced a different log file from the one we started seeing.

It is a bit of a mystery. For now at least I've wrapped the setup.exe and .msi up inside a new .exe using makesfx.exe and marked it new .exe to require running as admin. That seems to work. Some of our users prefer to distribute with the .msi but I guess we just have to make sure that it will only work if they are running with admin permissions.

It would be much better if adxregistrator.exe if running with /privileges=admin turned on could check it had the required permissions and warn the users if it does not and exit because at present the installer just runs and exits with no warnings but the add in does not install which causes a lot of confusion. If there was a way to check this perhaps even with a condition in the installer that would be very useful in my opinion.

Regards

Tim
Posted 19 Feb, 2016 03:31:30 Top
Andrei Smolin


Add-in Express team


Posts: 18823
Joined: 2006-05-11
Hello Tom,

Yes, UAC is on by default. But if it is off, adxregistrator.exe will be run with administrative permissions (if run by an administrator).

Tim Kempster writes:
It would be much better if adxregistrator.exe if running with /privileges=admin turned on could check it had the required permissions and warn the users if it does not and exit because at present the installer just runs and exits with no warnings but the add in does not install which causes a lot of confusion. If there was a way to check this perhaps even with a condition in the installer that would be very useful in my opinion.


Thank you for the suggestion.


Andrei Smolin
Add-in Express Team Leader
Posted 19 Feb, 2016 08:11:11 Top