Software restrictions preventing transform installs
Ok, here's a strange one.
I'm using a third party distribution tool (which you probably won't be familiar with) to deploy windows installer packages. The distribution tool is launched by autoexnt and basically looks at the server for a computer's corresponding ini file to see what action needs to be taken (install/uninstall/repair). It uses a system account to install MSI/MSTs.
I am also using software restrictions: default enforcement is disallowed and is applying to all users except administrators. Banned extensions include MSI and MST for obvious reasons.
Ok, as long as group policy successfully applies before autexnt starts then there's no problem installing MSIs with or without transforms. If autoexnt starts before policy has applied, it will install MSIs, but will fail to install MSTs.
The error in event viewer is:
---
Event Type: Error
Event Source: MsiInstaller
Event Category: None
Event ID: 1007
Date: 11/08/2004
Time: 12:33:10
User: N/A
Computer: F6ST07
Description:
The installation of \\server\share\Applications\MS Office XP SP2\v1.1.0.0\Laptop XP Pro.mst is not permitted by software restriction policy. The Windows Installer only allows execution of unrestricted items. The authorization level returned by software restriction policy was 0x0 (status return 0x0).
---
The error I get in the verbose installer log is ERROR_INSTALL_TRANSFORM_REJECTED.
So as I understand it, if group policy has yet to apply, it should be using the policy it last downloaded. So why should it be installing MSIs but preventing transforms?
Any suggestions or ideas gratefully received.
Mike
I'm using a third party distribution tool (which you probably won't be familiar with) to deploy windows installer packages. The distribution tool is launched by autoexnt and basically looks at the server for a computer's corresponding ini file to see what action needs to be taken (install/uninstall/repair). It uses a system account to install MSI/MSTs.
I am also using software restrictions: default enforcement is disallowed and is applying to all users except administrators. Banned extensions include MSI and MST for obvious reasons.
Ok, as long as group policy successfully applies before autexnt starts then there's no problem installing MSIs with or without transforms. If autoexnt starts before policy has applied, it will install MSIs, but will fail to install MSTs.
The error in event viewer is:
---
Event Type: Error
Event Source: MsiInstaller
Event Category: None
Event ID: 1007
Date: 11/08/2004
Time: 12:33:10
User: N/A
Computer: F6ST07
Description:
The installation of \\server\share\Applications\MS Office XP SP2\v1.1.0.0\Laptop XP Pro.mst is not permitted by software restriction policy. The Windows Installer only allows execution of unrestricted items. The authorization level returned by software restriction policy was 0x0 (status return 0x0).
---
The error I get in the verbose installer log is ERROR_INSTALL_TRANSFORM_REJECTED.
So as I understand it, if group policy has yet to apply, it should be using the policy it last downloaded. So why should it be installing MSIs but preventing transforms?
Any suggestions or ideas gratefully received.
Mike
0 Comments
[ + ] Show comments
Answers (7)
Please log in to answer
Posted by:
MSIMaker
19 years ago
Have you set the Windows Installer service to install with Elevated Priviledges in your Group Policy?
Posted by:
meastaugh1
19 years ago
I resolved this by manually creating the GPO where software software restrictions were set. Must have been some sort of corruption. I thought GPs either worked or didn't. Strange, but it's fixed now.
Thanks for your reply
Thanks for your reply
Posted by:
meastaugh1
19 years ago
ps... yes I'm pretty sure it was set to install with elevated priveleges.
Posted by:
meastaugh1
19 years ago
Hi,
This problem's come up again, in fact I'm not entirely convinced it went away (due to the sporadic nature of the issue). Further to my original post, I've noticed that when this does happen (intermittently) following a reboot the application event log reflects MSIs being installed, then a message from SceCli stating that Group policy was successfully applied, then MSIs will fail with the error messages in original post, until the next reboot.
I'm not experiencing any other infrastructure related problems on this network.
This problem's come up again, in fact I'm not entirely convinced it went away (due to the sporadic nature of the issue). Further to my original post, I've noticed that when this does happen (intermittently) following a reboot the application event log reflects MSIs being installed, then a message from SceCli stating that Group policy was successfully applied, then MSIs will fail with the error messages in original post, until the next reboot.
I'm not experiencing any other infrastructure related problems on this network.
Posted by:
meastaugh1
19 years ago
Yep I've been speaking to the vendor for the past year. They're trying their best but I don't think any other customers have had this issue.
Posted by:
meastaugh1
19 years ago
Coincidentally I've just had an instance of this happen while a user was logged on (during an expected MSI self-heal ie first user run), so delaying won't seem to fix afterall. Logging the user off and on again cured.
This problem just gets more frustrating. Thanks all for your contributions so far!
This problem just gets more frustrating. Thanks all for your contributions so far!
Posted by:
meastaugh1
18 years ago
It looks like this was caused by 3rd party print auditing software. The client would open a TCP connection, but not correctly close it, resulting in an excessive number of open connections.
Rating comments in this legacy AppDeploy message board thread won't reorder them,so that the conversation will remain readable.