Windows Installer just changes my installation to ALLUSERS=1 behind my back

Question

I'm seeing a strange issue with WiX 3.8 and Windows Installer.

I have created an Outlook plugin that I want end-users without admin permissions to be able to install on their machines.

Therefore, I carefully made sure

• not to write to any system-level directory (like C:\program files etc.) during install
• not to write to any system-level registry key (like HKEY_LOCAL_MACHINE)

and in my WiX script, I made sure to set ALLUSERS=0 and also set all other relevant properties I found to perUser or limited:

<Wix xmlns="http://schemas.microsoft.com/wix/2006/wi" xmlns:netfx="http://schemas.microsoft.com/wix/NetFxExtension">
  <Product Id="*" Name="MyAddin" Language="1033" Version="1.0.0" 
           Manufacturer="Me" UpgradeCode="-some-guid-" Codepage="1252">
    <Package InstallerVersion="200" Compressed="yes" 
             InstallScope="perUser" 
             Description="yada yada" Manufacturer="Me" Languages="1033" SummaryCodepage="1252" 
             InstallPrivileges="limited" 
             Comments="yada yada" />
    <Property Id="ALLUSERS" Value="0"/>

I had imagined that would work - but on my test system, with a normal standard user account (no admin privileges), my install fails miserably - with a message dialog telling me I have insufficient privileges to install this for all users....

WTF? I specifically wanted to install this for **just this* user - not all users on the machine!

Looking at the MSI logs, I see astonishing things:

MSI (c) (B0:B4) [18:08:08:543]: Note: 1: 2262 2: AdminProperties 3: -2147287038
MSI (c) (B0:B4) [18:08:08:543]: Machine policy value 'AlwaysInstallElevated' is 0
MSI (c) (B0:B4) [18:08:08:543]: User policy value 'AlwaysInstallElevated' is 0
MSI (c) (B0:B4) [18:08:08:543]: Running product '........' with user privileges: It's not assigned.
...
MSI (c) (B0:B4) [18:08:08:543]: PROPERTY CHANGE: Modifying ALLUSERS property. Its current value is '0'. Its new value: '1'.

*Why on earth is the Windows Installer deciding to just change the ALLUSERS property to 1 ?!?!? I never told it to!! Sheesh.......

Any ideas? Thoughts? Pointers?

Ransdell

Your InstallScope (and InstallPrivileges) should be enough to force a per user install. so I'd take out your explicit ALLUSERS=0 and see if you get a per user install. You'll still get security errors if the install tries to access restricted items, but that's a separate issue. – Geochronology

@PhilDW: THANKS! That was it - interesting - by removing the ALLUSERS=0, I suddenly get a per-user install..... <shaking head in disbelief> .... you should make this an answer so I can accept it! – Ransdell

I hope there is a way to tell your installer that I want an all-users installation? – Sedum

Answer 1

Your InstallScope (and InstallPrivileges) should be enough to force a per user install. so I'd take out your explicit ALLUSERS=0 and see if you get a per user install. You'll still get security errors if the install tries to access restricted items, but that's a separate issue.

Geochronology

Answer 2

According to the MSI SDK documentation for ALLUSERS the correct way to create a per-user installation is to set ALLUSERS to "" (second bullet bolded below):

• An ALLUSERS property value of 1 specifies the per-machine installation context.
• An ALLUSERS property value of an empty string ("") specifies the per-user installation context.
• If the value of the ALLUSERS property is set to 2, the Windows Installer always resets the value of the ALLUSERS property to 1 and performs a per-machine installation or it resets the value of the ALLUSERS property to an empty string ("") and performs a per-user installation. The value ALLUSERS=2 enables the system to reset the value of ALLUSERS, and the installation context, dependent upon the user's privileges and the version of Windows.

The value "0" is undefined so you get whatever undefined behavior the Windows Installer picks this (pick one of the following): week/month/year/operating system/service pack.

For more "behind the story" details behind this answer see this blog entry.

Demisec

The WiX tooling in Visual Studio 2013 won't allow me to leave that value empty: The Property/@Value attribute's value cannot be an empty string. If a value is not required, simply remove the entire attribute. ... – Ransdell

Correct. You can't define a non-hidden/secure Property with no value. Called that out at the end of my blog entry: robmensching.com/blog/posts/2014/10/10/… – Demisec

Why do I have this in my .wxs file? <Property Id="ALLUSERS" Secure="yes" /> There's an explaining comment too: This property defines the ALLUSERS property and sets it to blank, which indicates that this product will be installed per-user instead of per-machine. – Warford