Why is this preventing me installing an MSI: The System Administrator has set policies to prevent this installation

Question

I am trying to install an MSI on a Windows Server 2012 machine which is part of my lab domain. I am local and domain admin, but I seem to be prevented from installing this MSI.

For clarification, when attempting to install the git extension for visual studio (located here) logged in as a domain user that is part of the administrator group, I get the following error

enter image description here

The machine reporting the error is a Windows Server 2012.

I'm almost certain it must be some sort of group policy restriction? None will have been set, unless it's the default security level?

For clarification, I'd like to know what is preventing this MSI being installed by a domain admin?

score 41 · Accepted Answer · answered Mar 10 '14 at 20:06

41

After spending time looking at group policy, as far as I could tell, there was nothing that was relevant. I then came across this post that suggest I try launching a command promt as an administrator and running

 msiexec /a install.msi

This appeared to work, but ran very quickly - in fact it didn't. On a whim, I tried this inside the admin command prompt.

 msiexec /i install.msi

which worked a treat.

answered Mar 10 '14 at 20:06

Jason Hyland

883
1
7
10

1

This works but it can be irritating to do every time you install from an msi. See Armin Sadeghi's answer below for a long-term solution. – Jake Sep 01 '16 at 00:23
Not ideal if you need to install something as a user. – user2924019 Aug 16 '22 at 12:30

score 23 · Answer 2 · answered Apr 15 '15 at 06:59

23

I've run into this behavior, where MSI installation is prevented with "The system administrator has set policies to prevent this installation" before. I believe it is due to default Windows Software Restriction policy and I've seen it on both Windows Server 2008 R2 and Windows Server 2012.

There is probably a better GUI based way to alter the policy, but setting the following reg key as an admin on the machine does the trick:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer]
"DisableMSI"=dword:00000000

answered Apr 15 '15 at 06:59

Armin Sadeghi

341
2
4

6

This works 100% – Jan Chrbolka Jul 23 '15 at 00:57
3

This worked for me. I had to add the "Installer" part of the path as a key, then add the DWORD "DisableMSI" (without the quotes). – Mike S Apr 13 '16 at 18:12
1

Had same error message with AcrobatReader update, after change registry to zero install was successful. – Kemin Zhou Feb 18 '19 at 06:19
Tried looking for the "DisableMSI" key on the "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer" registry path, but the "Installer" folder does not exist. Should I create an Installer folder and add in the DisableMSI dword? – Harvey Darvey Nov 18 '19 at 08:53

score 3 · Answer 3 · answered Jul 15 '15 at 21:25

3

This is usually due to a Group Policy or a Local Policy disabling Windows Installer.

Look on your Domain Controller if you have a GPO disabling "Windows Installer": Computer Configuration > Administrative Templates > Windows Components > Windows Installer > "Turn off Windows Installer".

Verify that it is set to "Not configured" or "Disabled".

If if you don't find it in your GPO's, look on the computer's local policies using gpedit.msc.

Note: the fact that you are a domain admins doesn't matter. It all depends of the scope of the GPO.

answered Jul 15 '15 at 21:25

Charlie Wilson

136
1
15

5

`Verify that it is set to "Not configured" or "Disabled".` That's not true. The default (Not Configured) is `1` which means `managed only`. https://msdn.microsoft.com/en-us/library/aa368304.aspx Disabled in terms of gpos means the policy will be disabled, so the reg key will be deleted and the default is used. Sound's strange but you have to choose `Enabled` and select `Never` in the dropdown box. – Jürgen Steinblock Jul 17 '17 at 07:26
@JürgenSteinblock's comment is what fixed it for me on Server 2019. – jeffmjack Jan 13 '20 at 18:48

score 1 · Answer 4 · answered Jun 11 '15 at 20:48

We had the same exact issue when building an MSI using IsCmdBld.exe, but not when building from the InstallShield software user interface.

When running the installer, we would see the error mentioned by the OP and the installation log would show: MSI_LUA: Invalid Descriptor Format.

The cause of the problem was that we were passing a ProductCode Guid value to the IsCmdBld.exe command line like this: -z "ProductCode"="f176c219-dec0-4fa9-a373-94a711f28a3d".

You can see that the Guid provided here is not surrounded by { and }.

We fixed it by passing the guid with brackets around: -z "ProductCode"="{f176c219-dec0-4fa9-a373-94a711f28a3d}" which works as expected and does not display the error anymore.

score 1 · Answer 5 · answered Oct 26 '15 at 18:17

1

right-click -> run as administrator

answered Oct 26 '15 at 18:17

calorie712

111
1

3

How is this different than accepted answer? – Dave M Oct 26 '15 at 19:15

score 0 · Answer 6 · answered Aug 25 '17 at 22:58

0

Neither the msiexec nor registry fixes worked for me (even after rebooting), but disabling User Account Control (as suggested by Ha Ly in this thread) and rebooting did the trick.

answered Aug 25 '17 at 22:58

Miles Wolbe

151
5

score -2 · Answer 7 · edited Jun 02 '15 at 15:41

-2

You have the option to turn off UAC via registry by changing the DWORD EnableLUA from 1 to 0 in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system. You will get a notification that a reboot is required. After the reboot, UAC is disabled.

edited Jun 02 '15 at 15:41

sebix

4,175
2
25
45

answered Jun 02 '15 at 15:09

Bismarck

97
1

Why is this preventing me installing an MSI: The System Administrator has set policies to prevent this installation

7 Answers7