Thread: Visual Studio Installer Privilege Issue

I am using Visual Studio Installer to create an installation package for my application. However, I have found the tool to be lacking. As part of the installation procedure, I need to launch the newly copied executable so it can handle some additional installation steps. I was able to accomplish this by using Orca to create a custom action. The executable launches correctly when I do this.

However, there is a major problem. One part of the exe's install component is to acquire the Backup Privilege. If I start the executable manually by double clicking on it, this succeeds without any problems. When the installer launches it however, AdjustTokenPrivilege fails. Both of these occur while in an administrator profile. Does anyone know why this would occur and how to fix it?

Thank You,
Joe

Update on the situation. The failure code for AdjustTokenPrivilege is 1300 for ERROR_NOT_ALL_ASSIGNED. I believe this is typical of the user mode not containing the privilege. How could it shell it in a user context that is different than the Administrator I am running it under?

Searching on 'AdjustTokenPrivileges msi' brings up this thread.
Security differences between MSIEXEC 1.1 and 2.0

Thank you for the link. It verifies what I had already feared that the executable is getting launched under an account that has lower privileges than the Administrator account it is running under. I do not fully understand the rationale for limiting the privileges given installers tend to require more rights and privileges than programs under standard operation.

For the time being, I think I will implement my hack-y fix of launching my executable with a different command line which in turn shells the real install routine and waits for its completion. I really would prefer a more graceful solution if anyone can think of one(that does not require spoofing accounts I do not know the information for).

Thank you for your help,
Joe

Current Resolution: I changed the custom action type from 1042 to 3090. This remedied the problem. Does anyone see any potential flaws/dangers/complications in taking this approach? Thank you.

Joe