[wix-users] Per-User MSI Minor Upgrade Fails By Requiring Admin Privileges

[Andrew Derry-Farrell]

Hello,

I am hoping someone can explain this issue and hopefully provide a workaround. Let me know if you need any more information such as logs or source code.

Thanks!

I am in the process of developing Per-User installers that do not require Admin Privileges to run. Installing and uninstalling work as expected. However, when performing a minor upgrade, a Red Banner UAC dialog is shown with the following text: "Do you want to all this app to update Software on your device". Underneath the text is a "Yes" button and a "Close" button. To continue the minor upgrade, the user must choose the "Yes" button but this requires admin privileges. Choosing the close button fails the minor upgrade.

This is not the behavior I expected. If a user can install and uninstall an MSI without admin privileges, that user should not be required to have admin privileges to perform a minor upgrade. I am hoping that there is something that I can specify in the MSI files to work around this issue. I am following all of the rules for Minor Upgrades as defined by the following Microsoft Documentation:
https://docs.microsoft.com/en-us/windows/win32/msi/minor-upgrades

I am performing the minor upgrade with the following options: REINSTALL=ALL REINSTALLMODE=vomus. The version of WiX that I am using for development is 3.10.3.

This issue has been seen on Windows 10 Pro Version 1809 64-Bit, Windows 10 Pro Version 1803 32-Bit, and Windows 7 Professional SP1. I created a sample Per-User MSI file that only installs a single file and is digitally signed. Performing a Minor Upgrade with a lower version and a higher version of this MSI file, allowed me to identify the section of the log where the UAC dialog was being displayed. The Minor Upgrade process appears to require admin privileges when performing the "SECREPAIR". The following is the log excerpt where the minor upgrade displayed the UAC dialog and the user chose the "Close" button:

Action start 20:42:05: RegisterProduct.
MSI (s) (24:98) [20:42:05:961]: Note: 1: 2205 2:  3: Error
MSI (s) (24:98) [20:42:05:961]: Note: 1: 2228 2:  3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1302
MSI (s) (24:98) [20:42:05:977]: Re-registering product - performing upgrade of existing installation.
MSI (s) (24:98) [20:42:05:977]: Resolving source.
MSI (s) (24:98) [20:42:05:977]: Resolving source to launched-from source.
MSI (s) (24:98) [20:42:05:977]: Setting launched-from source as last-used.
MSI (s) (24:98) [20:42:05:977]: PROPERTY CHANGE: Adding SourceDir property. Its value is 'C:\Users\adfarrell\Desktop\PerUserMsi\2.0\'.
MSI (s) (24:98) [20:42:05:977]: PROPERTY CHANGE: Adding SOURCEDIR property. Its value is 'C:\Users\adfarrell\Desktop\PerUserMsi\2.0\'.
MSI (s) (24:98) [20:42:05:977]: PROPERTY CHANGE: Adding SourcedirProduct property. Its value is '{A8AC8689-4E0E-468E-804D-7B6625E64677}'.
MSI (s) (24:98) [20:42:05:977]: SOURCEDIR ==> C:\Users\adfarrell\Desktop\PerUserMsi\2.0\
MSI (s) (24:98) [20:42:05:977]: SOURCEDIR product ==> {A8AC8689-4E0E-468E-804D-7B6625E64677}
MSI (s) (24:98) [20:42:05:977]: Determining source type
MSI (s) (24:98) [20:42:05:977]: Source type from package 'PerUserMSI.msi': 10
MSI (s) (24:98) [20:42:05:977]: SECREPAIR: Hash Database: C:\WINDOWS\Installer\SourceHash{A8AC8689-4E0E-468E-804D-7B6625E64677}
MSI (s) (24:98) [20:42:05:977]: SECREPAIR: filename: PerUserMSI.msi Stored Hash Value:xEhQ7QbV8H+rU74Zgv0JdFdaHZ35LzzJdaktWYsbt6g= Current Hash:Pyk+gyKCPkuje97ObBMbi2ZmI2Bw6q8TcG3hRzpdkYQ=
MSI (s) (24:98) [20:42:05:977]: Machine policy value 'AlwaysInstallElevated' is 0
MSI (s) (24:98) [20:42:05:977]: User policy value 'AlwaysInstallElevated' is 0
MSI (s) (24:98) [20:42:19:634]: MSI_LUA: Credential Request return = 0x800704C7
MSI (s) (24:98) [20:42:19:634]: Note: 1: 3
MSI (s) (24:98) [20:42:19:634]: SECUREREPAIR: SecureRepair Failed. Error code: 36288B384
Action ended 20:42:19: RegisterProduct. Return value 2.