Running MSI from a NT service problem

[petr....@gmail.com]

Hello everybody,

I am developing an updater application which is polling a server
asking for updates. The application is executing as a NT service under
Local System account. Once there is an update, the service application
is downloading it, and runs.

Here problems start to appear. The update is an MSI application which
fails with the weird error:

DIFXAPP: INFO: creating HKEY_USERS\S-1-5-18\Software\Microsoft\Windows
\CurrentVersion\DIFxApp\Components\{35D06518-F300-4A4A-
B802-1AC70C92E08F} (User's SID: 'S-1-5-18') ...
DIFXAPP: ERROR 0x57 encountered while creating subkey for component
'{35D06518-F300-4A4A-B802-1AC70C92E08F}'
DIFXAPP: RETURN: ProcessDriverPackages() 87 (0x57)

So, the question is: am I able to launch MSI from a NT service? I read
that the MSI has to have a property ALLUSERS set to 1, i.e. ALLUSERS=1
(read
http://groups.google.com/group/microsoft.public.platformsdk.msi/browse_thread/thread/1008e242ac5ca2e5/1b607cd073a31f5b?lnk=gst&q=nt+service#1b607cd073a31f5b
) but it does not help. If I launch MSI under user there are not
problems.

Thank you for any hints and ideas, Petr.

[Phil Wilson]

I believe that you must set ALLUSERS to 1 (such as in the property table or
on the commmand line) to install from local system account. When you say "it
does not help" what exactly did you do?

--
Phil Wilson
Definitive Guide to Windows Installer
http://www.apress.com/book/view/1590592972

<petr....@gmail.com> wrote in message
news:2143a4cf-6101-4169...@d77g2000hsb.googlegroups.com...

[petr....@gmail.com]

On Sep 17, 9:19 pm, "Phil Wilson"

<phil.wil...@wonderware.something.com> wrote:
> I believe that you must set ALLUSERS to 1 (such as in the property table or
> on the commmand line) to install from local system account. When you say "it
> does not help" what exactly did you do?
>
> --
> Phil Wilson
> Definitive Guide to Windows Installerhttp://www.apress.com/book/view/1590592972
>

> <petr.kiz...@gmail.com> wrote in message

>
> news:2143a4cf-6101-4169...@d77g2000hsb.googlegroups.com...
>
> > Hello everybody,
>
> > I am developing an updater application which is polling a server
> > asking for updates. The application is executing as aNTserviceunder
> > Local System account. Once there is an update, theserviceapplication
> > is downloading it, and runs.
>

> > Here problems start to appear. The update is anMSIapplication which

> > fails with the weird error:
>
> > DIFXAPP: INFO: creating HKEY_USERS\S-1-5-18\Software\Microsoft\Windows
> > \CurrentVersion\DIFxApp\Components\{35D06518-F300-4A4A-
> > B802-1AC70C92E08F} (User's SID: 'S-1-5-18') ...
> > DIFXAPP: ERROR 0x57 encountered while creating subkey for component
> > '{35D06518-F300-4A4A-B802-1AC70C92E08F}'
> > DIFXAPP: RETURN: ProcessDriverPackages() 87 (0x57)
>
> > So, the question is: am I able to launchMSIfrom aNTservice? I read

> > that theMSIhas to have a property ALLUSERS set to 1, i.e. ALLUSERS=1
> > (read
> >http://groups.google.com/group/microsoft.public.platformsdk.msi/brows...
> > ) but it does not help. If I launchMSIunder user there are not

> > problems.
>
> > Thank you for any hints and ideas, Petr.

Hello Phil,

Thank you for reply. The property is set, and I got the problem with
MSI anyway (see logs in prev. message).

[Stefan Kuhr]

Hi Petr,

petr....@gmail.com wrote:
> <snip>

> DIFXAPP: INFO: creating HKEY_USERS\S-1-5-18\Software\Microsoft\Windows
> \CurrentVersion\DIFxApp\Components\{35D06518-F300-4A4A-
> B802-1AC70C92E08F} (User's SID: 'S-1-5-18') ...
> DIFXAPP: ERROR 0x57 encountered while creating subkey for component
> '{35D06518-F300-4A4A-B802-1AC70C92E08F}'
> DIFXAPP: RETURN: ProcessDriverPackages() 87 (0x57)
>

Does your installation install a driver under the hood? If so, check if
the installation works if you run the msi from SYSTEM with desktop
interaction enabled. For testing purposes run on W2K, XP or W2K3 Server

cmdasuser localsystem

to get a command prompt running as system, then do an msiexec /i msifile
and see if the installation works. If it does, then you probably install
an unsigned driver or a driver with a coinstaller which is something you
can only do from an interactive logon session.

You can get cmdasuser from the IIRC last issue of MSJ, which can be
found on http://www.msj.com. The article link seems to be broken, but
the code is here:

http://download.microsoft.com/download/0/6/7/0678184e-905e-4783-9511-d4dca1f492b4/MSJFeb00.exe

HTH,

--
Stefan

[petr....@gmail.com]

Hello Stefan, Thanks for your reply.

> Does your installation install a driver under the hood? If so, check if
> the installation works if you run the msi from SYSTEM with desktop
> interaction enabled.

Yes, the MSI is installing the driver. I tried with cmdasuser and I
got the failure anyway. Here goes a logs when I run it via cmdasuser
in Windows 2000 SP4:

DIFXAPP: INFO: creating HKEY_USERS\S-1-5-18\Software\Microsoft\Windows
\CurrentVersion\DIFxApp\Components\{35D06518-F300-4A4A-
B802-1AC70C92E08F} (User's SID: 'S-1-5-18') ...
DIFXAPP: ERROR 0x57 encountered while creating subkey for component
'{35D06518-F300-4A4A-B802-1AC70C92E08F}'

So, I decided to look further into this issue. I decompiled the
difxapp, and found the following code which fails:

.text:04049D5 push 80000001h ; hKey
.text:004049DA call ds:__imp__RegCreateKeyExW@36 ;
RegCreateKeyExW(x,x,x,x,x,x,x,x,x)
.text:004049E0 mov [ebp-0CCh], eax
.text:004049E6 test eax, eax
.text:004049E8 jz short loc_404A40
.text:004049EA push dword ptr [ebp-0D4h]
.text:004049F0 push eax
.text:004049F1 push offset aDifxappError_5 ;
"DIFXAPP: ERROR 0x%X encountered while c"...
.text:004049F6 push ebx
.text:004049F7 call ?
LogCustomActionInfo@@YAXKPBGZZ ; LogCustomActionInfo(ulong,ushortconst
*,...)

Which proves that the failure is caused by a failure of
RegCreateKeyExW function. So I put a simple code into my NT service
and it reproduces the problem. I hope it would help people from
Microsoft to isolate and fix this problem:

std::wstring szKey = TEXT("S-1-5-18\\Software\\Microsoft\\Windows\
\CurrentVersion");
HKEY componentRegKey = 0;

LONG uiStat = RegCreateKeyEx(HKEY_USERS, szKey.c_str(), 0, NULL,
REG_OPTION_NON_VOLATILE, KEY_READ | KEY_WRITE, NULL, &componentRegKey,
NULL);

When running in NT service in Windows 2k the code above always fails.
Could please someone shed light why, or I should decompile and dig
further into RegCreateKeyEx?

Thanks. Petr.

[Pavel A.]

Have you tried to create this reg. key manually?

On a clean machine, key
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\DIFxApp\ does not
exist, therefore creation of subkey under it will fail.

--PA

[petr....@gmail.com]

Pavel,

This key do exists. I even tried to open HKU\S-1-5-18 (which for sure
have to exist!) - also no luck.

Petr.

[Pavel A.]

petr....@gmail.com wrote:
> Pavel,
>
> This key do exists. I even tried to open HKU\S-1-5-18 (which for sure
> have to exist!) - also no luck.

What error you get when you open HKU\S-1-5-18 ?
( 0x57 is "The parameter is incorrect" - not access denied... )

-- PA

[petr....@gmail.com]

I use the following code in my NT service in Windows 2000 SP4 (with
latest updates on):

std::wstring szKey = TEXT("S-1-5-18");
HKEY componentRegKey = 0;

LONG uiStat = RegCreateKeyEx(HKEY_USERS, szKey.c_str(), 0, NULL,
REG_OPTION_NON_VOLATILE, KEY_READ | KEY_WRITE, NULL, &componentRegKey,
NULL);

The GetLastError() gives 0 and uiStat contains 0x57. I know that its
strange, thats why I am posting this issue here. Please, note that
this code fails only when I run it in service in Windows 2000. In XP,
Vista its OK, no errors.

With best wishes, Petr.

[GP]

Hello!

> LONG uiStat = RegCreateKeyEx(HKEY_USERS, szKey.c_str(), 0, NULL,
> REG_OPTION_NON_VOLATILE, KEY_READ | KEY_WRITE, NULL, &componentRegKey,
> NULL);
>
> The GetLastError() gives 0 and uiStat contains 0x57. I know that its
> strange, thats why I am posting this issue here. Please, note that
> this code fails only when I run it in service in Windows 2000. In XP,
> Vista its OK, no errors.

All parameters seem to be ok, the only thing I can think of is that
lpdwDisposition may not have been optional in W2k? Try to pass a valid
pointer.

GP

[petr....@gmail.com]

It does not help.

Btw, I verified that even if I run the same code (see prev. message)
in a non-service application, i.e. in win32 application, the function
fails with the same error.

[Volodymyr M. Shcherbyna]

Well, this could be a bug of difxapp when it runs under Local System on
Windows 2k. Instead of accessing HKEY_USERS\SIDOFLOCALCSYSTEM it should
rather access it via .DEFAULT profile name (please read description here:
http://blogs.msdn.com/oldnewthing/archive/2007/03/02/1786493.aspx ).

I bet if you run your example application poiting to .DEFAULT it will
succeed (even under Local System using method suggested by Stefan). Since
you do not have sources of difxapp you are very unlucky.

--
Volodymyr, blog: http://www.shcherbyna.com/
(This posting is provided "AS IS" with no warranties, and confers no
rights)

<petr....@gmail.com> wrote in message
news:344f99c1-c5b5-4a6b...@a1g2000hsb.googlegroups.com...

[petr....@gmail.com]

Yep, you are absolutly right!

I checked the code with .DEFAULT, and it works. So I will try to see
what can I do with difxapp or msi to cancel using Local System SID at
Windows 2k.

Спасибо :). Petr.