Running MSI from a NT service problem

Running MSI from a NT service problem

Secure Home | Search | About

Microsoft Applications Security - Microsoft's general security discussions and announcements 

Bookmark this page:  YahooMyWeb Yahoo!  Google Google  Windows Live Favorites Windows Live  del.icio.us del.icio.us  digg digg  Add to Netscape Netscape
Subject Author Date
Running MSI from a NT service problem petr.kizima 09-17-2008
Posted by on September 17, 2008, 9:49 am
If you were  Registered and logged in, you could reply and use other advanced thread options


Hello everybody,

I am developing an updater application which is polling a server
asking for updates. The application is executing as a NT service under
Local System account. Once there is an update, the service application
is downloading it, and runs.

Here problems start to appear. The update is an MSI application which
fails with the weird error:

DIFXAPP: INFO: creating HKEY_USERS\S-1-5-18\Software\Microsoft\Windows
\CurrentVersion\DIFxApp\Components\{35D06518-F300-4A4A-
B802-1AC70C92E08F} (User's SID: 'S-1-5-18') ...
DIFXAPP: ERROR 0x57 encountered while creating subkey for component
''
DIFXAPP: RETURN: ProcessDriverPackages() 87 (0x57)

So, the question is: am I able to launch MSI from a NT service? I read
that the MSI has to have a property ALLUSERS set to 1, i.e. ALLUSERS=1
(read
http://groups.google.com/group/microsoft.public.platformsdk.msi/browse_thread/thread/1008e242ac5ca2e5/1b607cd073a31f5b?lnk=gst&q=nt+service#1b607cd073a31f5b
) but it does not help. If I launch MSI under user there are not
problems.

Thank you for any hints and ideas, Petr.

Posted by Phil Wilson on September 17, 2008, 3:19 pm
If you were  Registered and logged in, you could reply and use other advanced thread options


I believe that you must set ALLUSERS to 1 (such as in the property table or
on the commmand line) to install from local system account. When you say "it
does not help" what exactly did you do?

--
Phil Wilson
Definitive Guide to Windows Installer
http://www.apress.com/book/view/1590592972


> Hello everybody,
>
> I am developing an updater application which is polling a server
> asking for updates. The application is executing as a NT service under
> Local System account. Once there is an update, the service application
> is downloading it, and runs.
>
> Here problems start to appear. The update is an MSI application which
> fails with the weird error:
>
> DIFXAPP: INFO: creating HKEY_USERS\S-1-5-18\Software\Microsoft\Windows
> \CurrentVersion\DIFxApp\Components\{35D06518-F300-4A4A-
> B802-1AC70C92E08F} (User's SID: 'S-1-5-18') ...
> DIFXAPP: ERROR 0x57 encountered while creating subkey for component
> ''
> DIFXAPP: RETURN: ProcessDriverPackages() 87 (0x57)
>
> So, the question is: am I able to launch MSI from a NT service? I read
> that the MSI has to have a property ALLUSERS set to 1, i.e. ALLUSERS=1
> (read
>
http://groups.google.com/group/microsoft.public.platformsdk.msi/browse_thread/thread/1008e242ac5ca2e5/1b607cd073a31f5b?lnk=gst&q=nt+service#1b607cd073a31f5b
> ) but it does not help. If I launch MSI under user there are not
> problems.
>
> Thank you for any hints and ideas, Petr.



Posted by on September 17, 2008, 4:36 pm
If you were  Registered and logged in, you could reply and use other advanced thread options


On Sep 17, 9:19=A0pm, "Phil Wilson"
> I believe that you must set ALLUSERS to 1 (such as in the property table =
or
> on the commmand line) to install from local system account. When you say =
"it
> does not help" what exactly did you do?
>
> --
> Phil Wilson
> Definitive Guide to Windows Installerhttp://www.apress.com/book/view/1590=
592972
>
>
>
> > Hello everybody,
>
> > I am developing an updater application which is polling a server
> > asking for updates. The application is executing as aNTserviceunder
> > Local System account. Once there is an update, theserviceapplication
> > is downloading it, and runs.
>
> > Here problems start to appear. The update is anMSIapplication which
> > fails with the weird error:
>
> > DIFXAPP: INFO: creating HKEY_USERS\S-1-5-18\Software\Microsoft\Windows
> > \CurrentVersion\DIFxApp\Components\{35D06518-F300-4A4A-
> > B802-1AC70C92E08F} (User's SID: 'S-1-5-18') ...
> > DIFXAPP: ERROR 0x57 encountered while creating subkey for component
> > ''
> > DIFXAPP: RETURN: ProcessDriverPackages() 87 (0x57)
>
> > So, the question is: am I able to launchMSIfrom aNTservice? I read
> > that theMSIhas to have a property ALLUSERS set to 1, i.e. ALLUSERS=3D1
> > (read
> >http://groups.google.com/group/microsoft.public.platformsdk.msi/brows...
> > ) but it does not help. If I launchMSIunder user there are not
> > problems.
>
> > Thank you for any hints and ideas, Petr.

Hello Phil,

Thank you for reply. The property is set, and I got the problem with
MSI anyway (see logs in prev. message).

Posted by Stefan Kuhr on September 18, 2008, 4:50 am
If you were  Registered and logged in, you could reply and use other advanced thread options


Hi Petr,

petr.kizima@gmail.com wrote:
> <snip>
> DIFXAPP: INFO: creating HKEY_USERS\S-1-5-18\Software\Microsoft\Windows
> \CurrentVersion\DIFxApp\Components\{35D06518-F300-4A4A-
> B802-1AC70C92E08F} (User's SID: 'S-1-5-18') ...
> DIFXAPP: ERROR 0x57 encountered while creating subkey for component
> ''
> DIFXAPP: RETURN: ProcessDriverPackages() 87 (0x57)
>


Does your installation install a driver under the hood? If so, check if
the installation works if you run the msi from SYSTEM with desktop
interaction enabled. For testing purposes run on W2K, XP or W2K3 Server

cmdasuser localsystem

to get a command prompt running as system, then do an msiexec /i msifile
and see if the installation works. If it does, then you probably install
an unsigned driver or a driver with a coinstaller which is something you
can only do from an interactive logon session.

You can get cmdasuser from the IIRC last issue of MSJ, which can be
found on http://www.msj.com. The article link seems to be broken, but
the code is here:

http://download.microsoft.com/download/0/6/7/0678184e-905e-4783-9511-d4dca1f492b4/MSJFeb00.exe


HTH,

--
Stefan


Posted by on September 18, 2008, 6:40 am
If you were  Registered and logged in, you could reply and use other advanced thread options


Hello Stefan, Thanks for your reply.

> Does your installation install a driver under the hood? If so, check if
> the installation works if you run the msi from SYSTEM with desktop
> interaction enabled.

Yes, the MSI is installing the driver. I tried with cmdasuser and I
got the failure anyway. Here goes a logs when I run it via cmdasuser
in Windows 2000 SP4:

DIFXAPP: INFO: creating HKEY_USERS\S-1-5-18\Software\Microsoft\Windows
\CurrentVersion\DIFxApp\Components\{35D06518-F300-4A4A-
B802-1AC70C92E08F} (User's SID: 'S-1-5-18') ...
DIFXAPP: ERROR 0x57 encountered while creating subkey for component
''

So, I decided to look further into this issue. I decompiled the
difxapp, and found the following code which fails:

.text:04049D5 push 80000001h ; hKey
.text:004049DA call ds:__imp__RegCreateKeyExW@36 ;
RegCreateKeyExW(x,x,x,x,x,x,x,x,x)
.text:004049E0 mov [ebp-0CCh], eax
.text:004049E6 test eax, eax
.text:004049E8 jz short loc_404A40
.text:004049EA push dword ptr [ebp-0D4h]
.text:004049F0 push eax
.text:004049F1 push offset aDifxappError_5 ;
"DIFXAPP: ERROR 0x%X encountered while c"...
.text:004049F6 push ebx
.text:004049F7 call ?
LogCustomActionInfo@@YAXKPBGZZ ; LogCustomActionInfo(ulong,ushortconst
*,...)

Which proves that the failure is caused by a failure of
RegCreateKeyExW function. So I put a simple code into my NT service
and it reproduces the problem. I hope it would help people from
Microsoft to isolate and fix this problem:

std::wstring szKey                = TEXT("S-1-5-18\Software\Microsoft\Windows\
\CurrentVersion");
HKEY componentRegKey        = 0;

LONG uiStat = RegCreateKeyEx(HKEY_USERS, szKey.c_str(), 0, NULL,
REG_OPTION_NON_VOLATILE, KEY_READ | KEY_WRITE, NULL, &componentRegKey,
NULL);

When running in NT service in Windows 2k the code above always fails.
Could please someone shed light why, or I should decompile and dig
further into RegCreateKeyEx?

Thanks. Petr.

Stefan Kuhr wrote:
> Hi Petr,
>
> petr.kizima@gmail.com wrote:
> > <snip>
> > DIFXAPP: INFO: creating HKEY_USERS\S-1-5-18\Software\Microsoft\Windows
> > \CurrentVersion\DIFxApp\Components\{35D06518-F300-4A4A-
> > B802-1AC70C92E08F} (User's SID: 'S-1-5-18') ...
> > DIFXAPP: ERROR 0x57 encountered while creating subkey for component
> > ''
> > DIFXAPP: RETURN: ProcessDriverPackages() 87 (0x57)
> >
>
>
> Does your installation install a driver under the hood? If so, check if
> the installation works if you run the msi from SYSTEM with desktop
> interaction enabled. For testing purposes run on W2K, XP or W2K3 Server
>
> cmdasuser localsystem
>
> to get a command prompt running as system, then do an msiexec /i msifile
> and see if the installation works. If it does, then you probably install
> an unsigned driver or a driver with a coinstaller which is something you
> can only do from an interactive logon session.
>
> You can get cmdasuser from the IIRC last issue of MSJ, which can be
> found on http://www.msj.com. The article link seems to be broken, but
> the code is here:
>
>
http://download.microsoft.com/download/0/6/7/0678184e-905e-4783-9511-d4dca1f492b4/MSJFeb00.exe
>
>
> HTH,
>
> --
> Stefan

Similar ThreadsPosted
Running WWW Service in IIS 5.0 Isolation Mode... January 9, 2006, 8:04 pm
TCP/IP communication blocked when running a service as SYSTEM on W November 21, 2006, 3:50 pm
Service running as Local system account Unable to map drive on ano December 23, 2005, 8:10 am
Service Log On Account Problem September 19, 2005, 9:41 am
Service Pack 2 problem October 25, 2006, 6:00 pm
Messenger Service problem! January 2, 2008, 3:18 pm
Running .exe May 9, 2007, 11:46 am
SQL Server not running January 16, 2009, 1:01 pm
Does anyone know how to see if NTLM is running on a web site? December 16, 2005, 10:03 am
Rename running process (can't) March 15, 2006, 4:39 pm

The site map in XML format XML site map

Contact Us | Privacy Policy