My apologies as this is only indirectly related to package development, but it's close enough that I'm sure someone can provide some input.

I'm dealing with a problem on numerous machines where IE can't spawn new windows. Regmon reveals Access Denied failures when Users read a few of the HKCR\Typelib keys, while local admins have no problems. It's a user security level issue only. Looks like a bunch of the keys denying user reads are Office XP components, maybe some apps as well.

So, I think I pinpointed my problem but I can't figure out how machines ended up in this condition. Office XP wasn't repackaged. Any thoughts as to how or why HKCR\Typelib security became set to Admin access only???
0 Comments   [ + ] Show comments


Rating comments in this legacy AppDeploy message board thread won't reorder them,
so that the conversation will remain readable.

All Answers

the typelib component always has problems with adobe packages such as illustrator
just a guess but im not sure if something like adobe reader may set the permission on this?
Answered 08/16/2005 by: ictu packager
Orange Belt

This sounds like it might be an MS Hotfix permission change or something along those lines. Most vendor apps don't change permissions on workstations.

What permissions are actually on the keys?
Answered 08/16/2005 by: MSIMaker
Second Degree Black Belt

For one of the two dozen or so keys SetACL reported:
BUILTIN\Administrators,full,allow,no_inheritance:NT AUTHORITY\SYSTEM,full,allow,no_inheritance

Adding BUILTIN\Users:Read to all the keys fixes the issue with the web app, but the HotFix thing was a concern of mine. Am I unraveling anything important with that fix? Ugh.
Answered 08/17/2005 by: VikingLoki
Second Degree Brown Belt

I've seen apps that do a "set value" or "create key" (from regmon) on HKLM and HKCR. Typically those are the ones you have to open up to Users.

I've not seen any apps that deny access to users or restrict reg permissions, though I could see somethign like that happening in a (buggy) hotfix or SP.

Good luck,
Answered 08/18/2005 by: aogilmor
Ninth Degree Black Belt

Hi VikingLoki,

I had this same problem about 2 years ago (with IE5 mind you) and the regmon/filemon traces led me nowhere. It turned out to be I needed to register c:\windows\system32\SHLWAPI.DLL. I don't know if that will help you or not but I hope it does :)


Answered 08/18/2005 by: plangton
Second Degree Blue Belt