Privileged Access On Demand

Question

In our installation package, the user (not necessarily an Admin) has an option to select to install our application for the current user (CU) or for all users (AU). When CU is selected, a custom action (i.e. VB Script) writes something in the HKCU registry. On the other hand, when AU is selected (for Admins), the same script writes the same content to HKLM.

This is all fine in WinXP and below. But for Win7, this is posing a problem--as you can imagine--because of UAC. The user can always do a right-click->Run as Admin on the EXE file or temporarily turn-off UAC, but this does not fill the original requirement whereby a normal user should not need elevation to run the installer.

The workaround I've tried is to set the Require Administrative Privileges project property to be Yes. But that won't apply to a normal user as mentioned above.

Is there a means to request elevation on-demand? I am thinking that if the user selects AU, then I will ask elevation not at double-clicking the program, but just before executing the installation procedure. See my comment in the snippet below:

Sub AddRegistryKey(key, value)

    Dim WshShell
    Set WshShell = CreateObject("WScript.Shell")

    If Session.Property("ALLUSERS") <> "1" Then
        ' Can I request for elevation at this point?
        Session.Property("PathToRegistryKeys") = Session.Property("PathToRegistryKeysUser") ' HKCU
    Else
        Session.Property("PathToRegistryKeys") = Session.Property("PathToRegistryKeysAll") ' HKLM
    End If  

    WshShell.RegWrite Session.Property("PathToRegistryKeys")&Session.Property("ProductCode")&"\"&key&"\", value, "REG_SZ"

End Sub

Answer 1

I would read: Authoring a single package for Per-User or Per-Machine Installation context in Windows 7

Answer 2

There is a means for this, but it was introduced on Windows 7 so it is not available to Windows Vista. It's related to ALLUSERS, but requires also specifying the new property MSIINSTALLPERUSER. When enabled correctly, MSIINSTALLPERUSER overrides bit 3 of the Word Count summary property, allowing a per-user install to not require elevation. InstallShield has offered support for this since InstallShield 2010 or so (check the release notes for certainty if you're on an old version).

Without support for this property, as is the case on Windows Vista, you can either require elevation, or never elevate inside the MSI. This in turn requires launching a per-machine install with elevated privileges (the launch workarounds you describe), and will lose track of the non-elevated user in an "over the shoulder" elevation.

See also: How can the behavior of my .msi on Windows Vista and Seven be so weird?