Installing with Elevated Privileges in .NET

Make ECC200 in .NET Installing with Elevated Privileges

The policy InstallAlwaysElevated installs Windows Installer based applications with elevated privileges. Microsoft documentation often calls this a privileged installation. This policy is one way to enable users to install applications that they couldn't otherwise install because they're in restricted groups or you've locked down the desktops in your enterprise. A better way is to deploy those applications through Active Directory or by using something like SMS (Microsoft Systems Management Server). If neither product is available to you, consider using this policy, but keep in mind that the consequences of doing so can be severe. These consequences are due to the fact that users can take advantage of this policy to gain full control of their computers. Potentially, users could permanently change their privileges and circumvent your ability to manage their accounts and computers. In addition, this policy opens the door to viruses disguised as Windows Installer package files. For these reasons, this isn't a setting that I recommend in any but the most dire situations in which there's no method available other than tossing users in the local Administrators group. For this policy to be effective, you must enable both the per computer and per user versions of it at the same time. In other words, enable it in Computer Configuration as well as User Configuration. TipDeploying applications to locked down desktops is a common and sticky scenario. Using the AlwaysInstallElevated policy isn't the best solution, either. Other than the typical fare, such as Active Directory and SMS, elegant solutions do exist for this problem. 7, "Managing Registry Security," describes many of them, including using Security Templates and Security 246

Configuration And Analysis to open up security just enough to allow legacy programs to run in Windows XP. 15, "Working Around IT Problems," shows you a few techniques for launching setup programs with elevated privileges.

Transforms are essentially answer files for Windows Installer based applications. 14, "Deploying Office XP Settings," describes transforms, but chances are good that you already know all about them. Transforms, which you build using the Office XP Resource Kit's Custom Installation Wizard, customize the way an application installs. When you install an application using a transform, Windows Installer stores the transform with a .mst extension in the Application Data folder of the user profile. Windows Installer needs this file to reinstall, remove, or repair the application. Keeping it in the user profile ensures that the file is always available. For example, if users have roaming user profiles, the transform follows them from computer to computer. This is not secure, however. When you set the TransformsSecure policy, Windows Installer saves transforms in %SYSTEMROOT%, instead, where users don't have permissions to change files. But because Windows Installer requires access to the transform used to install an application, the user must use the same computer on which he or she installed the application or have access to the original installation source to install, remove, or repair the software. The idea behind this policy is to secure transforms in enterprises when IT professionals can't risk users' maliciously changing the files.

Table 11 1 describes the policies that provide the most security for Windows Installer based applications and Windows XP in general. The first part of the table contains per user policies and the second part contains per computer policies. In the Setting column, Not Configured means that you don't define the policy. Enabled speaks for itself. Table 11 1: Secure Windows Installer Settings Policy User Configuration Always install with elevated privileges Prevent removable media source for any install Computer Configuration Always install with elevated privileges Enable user to browse for source while elevated Enable user to use media source while elevated Enable user to patch elevated products Remove browse dialog box for new source Disable Windows Installer Prohibit patching Enable user control over installs Disable IE security prompt for Windows Installer scripts Cache transforms in secure location on workstation Setting Not Configured Enabled Not Configured Not Configured Not Configured Not Configured Enabled Enabled for non managed apps only Enabled Not Configured Not Configured Enabled

You can configure these policies directly in the registry. I gave you the key and value names earlier in this chapter. To enable a policy, add it to the appropriate key as a REG_DWORD value and set it to 0x01. To disable the policy, set it to 0x00. Delete the value to remove the policy. These policies are typical of enterprise style deployments, however, so I wouldn't configure them in the registry, which is totally unmanaged. Instead, configure them using Group Policy locally or on the network so you can manage them properly.