Jouydree
24th April 2012 11:37 UTC
Installing as non-local admin?
Hello All,
years ago, I had written an extensive nsis script (including my own plugin dll) to install several applications. The install process requires administrative privileges and so far using the 'run as" option of windows was ok for the clients.
Now I am confronted with the wish of an important client to "support Windows Domain Accounts" and to enable the clients administrators to "install as non-local admin". Unfortunately Windows is not the area of my greatest expertise.
What my researches have unearthed so far, is that it all is about "Active Directories" and "Group Policies" and that either nsis does not support this or nobody has a need of it: The only similiar cases I found was an admin daily changing the administrator passwords and supplying his users with it on request, and someone including that password in the script itself). Another impression I got in my research was that it would be best to wrap the nsis installer executable in a MSI installer...
Before I now start to learn MSI needlessly: Could somebody please point me in the right direction? Did I understand the client's wish correctly at all?
Jouydree
Afrow UK
24th April 2012 16:13 UTC
You should not have to change anything to your script to support domain account installations. As long as you have written your script correctly with RequestExecutionLevel admin and are checking the user is indeed an administrator (UserInfo plug-in) then that should be enough.
I'm not sure what you're getting at in your post. Is the client unable to install under a domain account? Why are you looking into active directory and group policy? Do you need to change active directory entries or apply group policies?
And what gave you the idea that you have to wrap into an MSI? You need to explain why. If you do not know why then your researchers aren't doing a very good job :)
Stu
Jouydree
24th April 2012 17:01 UTC
Hello Afrow,
firstly thank you for the quick reply! Secondly my researchers are all clones of myself, so I take all the blame. ;) I am sorry that the description of my problem is a little confused - that is probably part of the problem: I am confused.
I do use RequestExecutionLevel admin and I do check with xtInfoPlugin::IsAdministrator on Windows NT, 2000, XP, Vista, and 7. This has never been any problem: Either the installer is run as admin or a polite MsgBox informs the user "that unfortunatly we are compelled to request administrative privileges", asks to use "run as...", and exits.
Now the administrator or a client wrote us an email that he does "not want to go from one employee's PC to the next employee's laptop and enter the administrators password", but that we should "modify our installer in a way that it will work with Windows Domain accounts" and allow him to install as "a non-local Admin" ...
I was at a loss what was meant with "work with Windows Domain accounts" (and naturally shy to expose our utter ignorance in that area by asking him) and started researching. This is how I ended up with Active Directories and Group Policies. Hence my opening post. I've no idea in what direction to search or to act.
Jouydree
Afrow UK
24th April 2012 19:36 UTC
OK thanks for explaining. What you mean I think is remote installation. Installing using a domain user account is no problem but remote installations are. Remote installations require Microsoft Installer components which are part of the OS - NSIS does not use these components.
Try searching the forums for "remote installations" but you may have to go with an MSI as you have already said. There are free MSI generators around (such as WiX) but if you can afford a commercial product I would recommend Advanced Installer. I was able to create MSI wrappers for NSIS installers using Advanced Installer quite easily in the past (but I have the paid version - not the free version).
Stu
Jouydree
24th April 2012 20:07 UTC
Hi Stu,
thank you very much! At least I know now, in which direction to search and act! What a relief.
Have a nice evening!
Jouydree