Novell is now a part of Micro Focus

Temporarily Elevate MSI Install Privileges

Novell Cool Solutions: Trench
By Doug Glenn

Digg This - Slashdot This

Posted: 12 Nov 2002

MSIUTIL contains utilities to upgrade MSI to "AlwaysInstallElevated" in pre-distribution and remove this in post-distribution scripts. This removes the need to set the policy to allow MSI to AlwaysInstallElevated, which can open a security hole. Contains premsi.exe and aftermsi.exe.


These files are provided "as is" and no warranty is either expressed or implied as to the usability of the product. The only guarantee is that they will occupy space on the drive.


Not everyone sets the Windows 2000 policies to allow any MSI based install to have elevated privileges. Yet the Windows Installer sometimes requires this to be set when writing to a network drive.

These two utilities provide a means to set these settings temporarily during an install to avoid pushing out a policy to elevate the MSI installer.

PREMSI.EXE enables all the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Installer keys to a value of 1 It writes the following keys and values into the registry when run: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer] "AlwaysInstallElevated"=dword:00000001 "AllowLockDownBrowse"=dword:00000001 "AllowLockDownMedia"=dword:00000001 "AllowLockDownPatch"=dword:00000001 "EnableAdminTSRemote"=dword:00000001 "EnableUserControl"=dword:00000001 "TransformSecure"=dword:00000001 AFTERMSI.EXE removes all of the above keys and the Installer key when run. Usage: Add these files to the pre-distribution and post-distribution sections of the MSI install object. There are no command line parameters. Note: If you do not wish to remove all of the keys, but certain selected ones, you may contact me for a custom build.



If you have any questions you may contact Doug at

Novell Cool Solutions (corporate web communities) are produced by WebWise Solutions.

© Copyright Micro Focus or one of its affiliates