Proclaim Windows installer issues

Northminster said:

The last several updates of Proclaim have all required local administrator rights, even Thursday's v1.31.0.0826   Is this intentional? 

Our users run with standard accounts (not administrators), which avoids many risks.  The combination of Proclaim's per-user installation with some updates causing UAC prompts makes those updates risky and concerning.  The 1.3 update was a  wreck for us.

Those UAC prompts used to be very rare with Proclaim, but have become common over the last few months.  If updates are going to require admin, you might as well change the installer from per-user to per-machine.

What should we expect going forward?

The UAC update introduced in 1.30 was required to block Layered Service Providers from injecting themselves in our process, ultimately causing crashes. As you mentioned, in the initial release there was an issue if the UAC prompt was denied. This issue has been resolved. If you cancel the UAC prompt the installer will proceed and try again next time. If you accept the UAC prompt the installer will block the LSPs and next time you update you should not see a UAC prompt.

Is this not the behavior you're experiencing?

It would be helpful to see the setup logs from a machine that is continually showing a UAC prompt. They are located at the following path

%TEMP%\Logos Log Files

If you could zip them up and attach them to this thread we can take a look.

>> This system made a UAC prompt going from 1.31.0.0825 to 1.31.0.0826 last week, and I accepted:

On this machine the setup log indicates the UAC prompt was canceled. I'll look into our code to see if we can misreport accept/cancel.

2015-11-15T13:40:45Z 0xD84 Info Run Processing line 158: requires-elevation|title=Proclaim Setup|message-id-title=221|message=Proclaim Setup was not able to finish the installation.|message-id-message=231
2015-11-15T13:40:45Z 0xD84 Info Run Elevated section: execute commands will be processed in an elevated instance of LogosSetup.exe.
2015-11-15T13:40:45Z 0xD84 Info Run Processing line 159: # check for, and set if needed, Layered Service Provider exclusion in the current app directory
2015-11-15T13:40:45Z 0xD84 Info Run Processing line 160: if-not-has-layered-service-provider-exclusion|application-path=%CurrentVersionSystemDirectory%\Proclaim.exe
2015-11-15T13:40:45Z 0xD84 Info HasLayeredServiceProviderExclusion Application 'C:\Users\re\AppData\Local\Proclaim\System2\Proclaim.exe' does not have Layered Service Provider exclusion
2015-11-15T13:40:45Z 0xD84 Info Run Processing line 161: set-layered-service-provider-exclusion|application-path=%CurrentVersionSystemDirectory%\Proclaim.exe
2015-11-15T13:40:45Z 0xD84 Info SaveCommands Writing command file back to 'C:\Users\re\AppData\Local\Proclaim\Install\ProclaimWebScript.lbxdat'.
2015-11-15T13:40:45Z 0xD84 Info ExecuteElevated Launching with ShellExecuteEx 'C:\Users\re\AppData\Local\Proclaim\ProclaimSetup.exe', command line '/elevated "C:\Users\re\AppData\Local\Proclaim\Install\ProclaimWebScript.lbxdat" 1 13428'.
2015-11-15T13:41:02Z 0xD84 Warning ExecuteElevated Elevation was canceled by the user, aborting.
2015-11-15T13:41:02Z 0xD84 Error SpawnElevatedInstance ShellExecuteEx failed to return a process handle.

>> This system just prompted from 1.31.0.0825 to 1.31.0.0826 just now, and I cancelled

That is what I see as well - UAC prompt canceled.

I'll answer a couple questions you may have about why/when we need administrator permissions.

Proclaim needs administrator permissions on install in the following cases:

1. When we need to run a third party installer for a component that requires UAC (i.e. .NET)
2. When we need to install third party redistributables (i.e. vc runtime)
3. When we need to add a Layered Service Provider (LSP) exemption

Items #1 and #2 are required for Proclaim to run on any machine. Canceling the UAC prompt for these components will halt the install and leave Proclaim not installed. Item #3 is not a required component for Proclaim on all machines - if you cancel the UAC for this part the install will skip adding the LSP exemption but continue with the Proclaim install. In the upgrade scenario Proclaim will be upgraded to the next version, however, it will not have the LSP exemption. The next time you install Proclaim it will repeat the process of trying to add an LSP exemption and prompt for UAC again.

So why add an LSP exemption if it isn't required on your machine? There are several fairly common security (or virus in some cases) applications that will load DLLs into other applications when they are running to perform certain checks (sorry about being vague - here are more details: https://en.wikipedia.org/wiki/Layered_Service_Provider). These cause the embedded web browser we are using to immediately crash which crashes Proclaim. This crash happens at application start - so Proclaim appears to just fail to launch.

Why not run the LSP exemption only when a customer has one of the known security applications installed? If you install Proclaim then install one of these security applications Proclaim would suddenly start crashing. So we would need to move adding the LSP exemption from the installer to Proclaim itself. There isn't an easy way to detect applications that use LSP - you basically have to create a list of applications and check for those on the machine. However, this list changes continuously and, with each change, we need to ship updates to our application. Additionally, when you launch Proclaim you may get a UAC prompt (when it needs to add the LSP exemption) which we would rather avoid.

We felt adding the exemption globally in the install was the right trade off for us in terms of cost to implement and maintain and making things right for customers. Once you accept the UAC prompt for the LSP exemption (assuming things as working as intended) you should no longer be prompted at install time.

What are your thoughts?

Northminster said:

I think you're saying the cancelling any post-1.3 update's UAC prompt won't prevent the update, but should keep prompting with each subsequent update until it gets finally a yes?

That is how it is supposed to work. Perhaps on your machine even though you click accept on the UAC prompt the process of adding the exclusion is failing. We haven't seen this before but that would exhibit this behavior. The next time you upgrade accept the UAC would you get the install logs and send them to us?

Northminster said:

Also, please recall problem #2: if we skip an update, Proclaim NEVER offers us a skipped update again. ALSO, Help>About Proclaim>Check again won't offer an update either, but just opens your downloads page for a scratch reinstallation.

If you skip the update it should not prompt you for that update again for a week. The idea is we don't want to continuously ask if you want to update after you have skipped it. If you do Help -> About -> check and use the version on the web site it will download the Setup exe (which is small). When you run that it will download the appropriate installers and execute them. These will run an upgrade (not a fresh install).

If you are already running the latest version the installer will not run (it will tell you Proclaim is up to date). So, if you have skipped the UAC and are on the latest version of Proclaim, the only way to get it to prompt you again is to uninstall/reinstall or wait for the next update (usually every few weeks).