Why MSI CustomAction that sets a reg key needs to be deffered on Vista with UAC?

Question

We have a CustomAction that sets some registry key HKEY LOCAL_MACHINE. This wasn't working on Vista with UAC, until we made the action "deferred". The installer worked in other cases. Anyone knows why?

We are using WIX to create the installer.

Answer 1

Your custom action was being run immediately when it was encountered in the InstallExecuteSequence; instead of when the actual install script was being executed. This caused your custom action to be executed with the users permissions rather than with the system's elevated permissions. This series of blog posts will explain in detail what is happening, http://blogs.msdn.com/rflaming/archive/2006/09/23/768146.aspx. You shouldn't have custom actions that effect the state of the machine that do not run as deferred custom actions.

Answer 2

+1 Lance. To phrase it another way and give some more info

There are 2 steps in the MSI process

• Immediate - where you collect preferences (install dir etc) - no changes to the machine should be made here

and then later

• Deferred - which runs after all preferences have been collected and actually does the installation.

Some further thoughts

• Immediate may not always be ran (e.g. scripted install) so don't rely on it.

There are 2 modes that a deferred action can run in

• NoImpersonate - aka NT Authority\System that has full permission on your computer

• Impersonate - whomever kicked off the installation.

With UAC enabled Impersonate has a kicker. You will only have the standard user token and no admin rights, even if the user is actually an administrator - so keep to NoImpersonate if possible otherwise your custom action will not be able to do anything.