Using Softgrid MSIs Without Being An Admin |
Monday, 10 March 2008
by Michel Roth
|
Recently Microsoft included a new feature into Softgrid that allows for OSD to be deployed as an MSI. This was done to optimize the integration with ESDs like SMS / SCCM. MSI do however require admin privileges. Or do they?
Ment van der Plas has found a way to work around the "limitations" of using an MSI to deploy a Softgrid application. By default, MSIs are secured in that msiexec checks whether or not the user installing the program is an admin. If not, the installation will fail. There are some other catches as well as Ment points out:
Removing the Launch Condition
This is where msiexec checks whether or not you are an admin. What you need to do to disable this check is:
• Open the generated MSI with Orca and locate the LaunchCondition table
• Remove the row containing “Privileged”
Changing the ALLUSERS property
By default the MSI installs the package for all the users on the machine provided the user has administrative privileges. To change this behavior do the following:
• Locate the Property table
• Set the property ALLUSERS to 2
Editing the SFTMIME commands
Locate the CustomAction table in the MSI and edit the following CustomActions:
• SOFTGRID_ADD_PACKAGE; in the Target column remove the /GLOBAL parameter from the SFTMIME command.
• SOFTGRID_DELETE_PACKAGE; in the Target column remove the /GLOBAL parameter from the SFTMIME command
Change User permissions on the client
It's also needed to give the user some additional permissions in the Microsoft Application Virtualization Client Console (sftcmc.msc):
• Add applications
• Delete applications
• Unload applications from the cache
Ment mentions (what a choice of words huh?) that this is of course not meant for production environments, something I very much second. I think it still pays to read Ment's entire article though.
|