Patching with LUA

[pushkar_p]

Hello,
We have a application that needs admin privilege to install (modifies HKCR in registry to register the Activex control). Just started using Advanced Installer and created setup.exe etc. works great. We figured to provide updates the administrator account is not necessary e.g. we just install in a shared folder rather than Program Files.
I am also able to create the patch and apply it by providing admin credentials. However, we would like non admin users to be able to install the patch. For this I did the following:
1. Created the DisableLUAPatching key and set it to 0 in HKLM\Software\Policies\Microsoft\Windows\Installer as suggested in MSDN.
2. Set the MSIDISABLELUAPATCHING property to 0 in Install Parameters section of the project.
3. Signed the old, new installers as well the patch using our public/private keys. (I verified patch is signed by checking properties of the file and viewing the Digital Signature Details tab)

I am on Windows Vista. I thought the above steps are sufficient to allow non admin users to install patches. What am I missing?
Thanks,
Pushkar

[Cosmin]

Hi,

Did you check the "Enable least-privileged user account patching" option in the Digital Signature page? Note that this option should be checked in both the target and upgraded packages. Also, the "MSIDISABLELUAPATCHING" property shouldn't be set to any value.

Regards,
Cosmin

[pushkar_p]

Hi,
Thanks for pointing that out, so I went to Digital Signatures page and enabled that option and removed the MSIDISABLELUAPATCHING property. Then I created the original (target) MSI and the upgrade MSI with the same product version. Then I created the patch again.
Applying the patch as administrator works fine, but still when a low privileged user tries to apply the patch it prompts for admin credentials.
I think the issue here is that somehow the patch appears as "unsigned" to Windows Installer, because when it prompts for admin credentials it says Unidentified publisher".
I am signing my MSIs and the patch too in the Digital Signature page using SignCode.exe. I can see the signing was done in the build logs too. This is on Windows Vista.
Any ideas?
Thanks,
Pushkar

[Cosmin]

Hi,

I'm not sure why you are encountering this behavior. Are all the files signed with the same certificate? If so, can you please send us the .AIP (project) files you are using to support at advancedinstaller dot com so we can investigate them?

Regards,
Cosmin

[rileydog]

HI,

I have a question on what behavior to expect now that I have a signed my code. When I install the product (at least on XP, haven't tried it on Vista yet) there is not identification that the code is digitally signed. This is important for me because I want users to feel comfortable running the installer I send.

As with previous posts, I look at the log and can see where the signing is completed successfully.

thnaks

[GabrielBarbu]

Hello,

Our Digital Signatures page describes all the advantages and benefits that result from signing your package.

Also please note that Windows XP (unlike Windows Vista and later) does not display any cues as to whether the package is signed or not, unless it is downloaded from the internet or from a network.

Regards,
Gabriel

[rileydog]

Thanks Gabriel. That page (because of the screen shots) makes it obvious what the benefits are.