Windows Installer internal error code 2203

[JohnApps]

Windows Server 2003 Enterprise Edition with SP1
Any form of install or uninstall using Windows Installer (latest version)
results in a message indicating inability to access a "xxx.ipi" file followed
by an internal error 2203 message.
The error occurs with something as 'simple' as the "Windows Installer
Cleanup Utility" to MS Office 2003 "Detect and Repair".
Windows Installer, when started, shows a title of Office Update; I'm
wondering if that is a clue?
Since I do not wish to reinstall Windows, I'm hoping someone can help me out
here.
--
Any remarks made by me are not necessarily supported by my employer

[Gary Chang[MSFT]]

Hi John,

>Any form of install or uninstall using Windows Installer (latest version)
>results in a message indicating inability to access a "xxx.ipi" file
>followed by an internal error 2203 message.

Based on the description, the problem is you could not run any Windows
Installer package on your Win2003 machine due to an internal error 2203,
please let me know if I have misunderstood anything.

This problem is usually caused by the system's Windows Installer service
cannot access its installation database, such as the ACLs on the current
user's %temp% folder that do not give NT AUTHORITY\System full access to
the folder. I suggest you can use the command-line utility cacls.exe to
view (and set) the ACLs on the folder. Make sure that "NT
AUTHORITY\System" has full control to that folder.

The following is my machine's ACLs on the %temp% folder:

C:\WINDOWS\system32>cacls %temp%
C:\DOCUME~1\cnapier\LOCALS~1\Temp MyDomain\MyName:F
MyDomain\MyName:(OI)(CI)(IO)F
NT AUTHORITY\SYSTEM:F
NT AUTHORITY\SYSTEM:(OI)(CI)(IO)F
BUILTIN\Administrators:F
BUILTIN\Administrators:(OI)(CI)(IO)F

Thanks!

Best regards,

Gary Chang
Microsoft Community Support
--------------------
Get Secure! ：C www.microsoft.com/security
Register to Access MSDN Managed Newsgroups!
http://support.microsoft.com/default.aspx?scid=/servicedesks/msdn/nospam.asp
&SD=msdn

This posting is provided "AS IS" with no warranties, and confers no rights.

[JohnApps]

Would you have an example "cacls" statement for me, please?
My %temp% directory is defined to be C:\TEMP rather than off "C:\documents
and settings".
I've tried setting the CACL the way you suggest, but still get the 2203
error. I am wondering if there are other directories whose permission is
incorrect?

Many thanks for the help so far!

Cheers, john

--
Any remarks made by me are not necessarily supported by my employer

[doc]

What ever path is in the Temp env var is where Windows installer will
create its temp files. If you've pointed it to c:\temp then that is
where it will write the temp files.

[JohnApps]

Turns out some software I'd installed had defined TEMP to be in
%homedrive%\temp at the user level, i.e., Administrator. After removing that
and leaving just the temp=C:\temp at the system level, all is now OK and
working again.

Many thanks for all the help!

--
Any remarks made by me are not necessarily supported by my employer

[Gary Chang[MSFT]]

Hi John,

Addition to the %Temp% directory, I suggest you also check the folder that
occurred in the internal error 2203 message and %System%/Installer folder,
those folders should also give the NT AUTHORITY\System account full access
right which I mentioned in my previous response.

By the way, it those folders' ACLs setting are also OK, would you please
provide us the detailed error 2203 message and the ACLs settings on your
machine's %temp% and the folders I suggested above...

[Gary Chang[MSFT]]

Hi John,

>Would you have an example "cacls" statement for me...

If you want to add the Full Control access to the NT AUTHORITY\SYSTEM
accout to the %SystemRoot%/Installer filder, you can use the following
command-line:

C:\WINDOWS\system32>cacls %SystemRoot%/Installer /E /G SYSTEM:F

Wish this helps!

[Gary Chang[MSFT]]

That's great, John, I am glad to help you on this issue.

Hav a nice weekend!

[JohnApps]

Hello Gary,
here's an exerpt from the MSI.LOG showing where the error occurred. I'm
pretty sure all protection was correct as I've changed no ACLs; just deleted
the incorrect definitions of the TEMP environment variable.
___________________________________________
DEBUG: Error 2203: Database: C:\WINDOWS\Installer\251dcf6.ipi. Cannot open
data
base file. System error -2147024629
DEBUG: Error 2835: The control ErrorIcon was not found on dialog ErrorDialog
Internal Error 2835. ErrorIcon, ErrorDialog
Internal Error 2203. C:\WINDOWS\Installer\251dcf6.ipi, -2147024629
MSI (s) (60:74) [20:58:45:630]: Product: Windows Installer Clean Up --
Internal
Error 2203. C:\WINDOWS\Installer\251dcf6.ipi, -2147024629

Action ended 20:58:45: InstallInitialize. Return value 3.
___________________________________________
Once again, many thanks for the help and all the best for the holidays!

Cheers, john
--
Any remarks made by me are not necessarily supported by my employer

[Gary Chang[MSFT]]

Hi John,

>I'm pretty sure all protection was correct as I've changed
>no ACLs; just deleted the incorrect definitions of the TEMP
>environment variable.

Based on the error message and your solution, the problem must be caused by
the target msi database file has been stored in the normal TEMP folder, but
some software you mentioned had just redefined TEMP folder to another
location, on this point, the Windows Installer Service could not find the
msi database file again via the %TEMP% path...

Good Luck!

[andrew....@gmail.com]

I had a similar problem on a system on which the System-level TEMP and TMP variables had been set to a folder on a drive that was no longer mapped. Once I removed those variable settings, my installer problems went away.