Deploy-Application.exe Unknown Error (0xffffffff) as a non-admin user

Hi all,

I am having a problem running Deploy-Application.exe as a non-admin user
Even running a default script template with nothing in I get the same problem.

  • A ‘non-admin’ user runs ‘Deploy-Application.ps1’ it works OK.
  • An ‘admin’ user runs ‘Deploy-Application.exe’ it works OK
  • But when 'an non-admin user runs ‘Deploy-Application.exe’ …
    Window pops ‘Deploy Application 1.1.1.0’ with message ‘Unknown Error (0xffffffff)’

Seems strange, the ps1 runs OK but the .exe throws this error if a non-admin user.
To troubleshoot, I have.

  • Set the execution policy to bypass
  • Removed all antivirus protection from the machine
  • Permissions on the folder appear to be fine in all ways
  • Configured AppDeployToolkitConfig.xml with <Toolkit_RequireAdmin>False</Toolkit_RequireAdmin>

Ultimately the package would be deployed through sccm to run in the user context.
Been using PSADTK for the past few months, loving it, I hope this is a simple newbie problem.

I found the problem causing this for me, it is particular to my company, they have blocked user accounts from running ‘powershell.exe’ and ‘powershell_ise.exe’ in group policy…
https://www.technipages.com/prevent-users-from-running-certain-programs

Not a bad idea at all for security puposes, but of course better ways to go about by using script signing … thats going to be a fun but politics I’ll need to sort out :slight_smile:

So this leaves me with one option of delivery through sccm, as the system account only.
I’m so impressed with PSAppDeployToolkit’s commands for reaching users hives, and running processes as user in the system context, what a time saver, its just totally awesome.

I have various user based Office plugins and browser plugins installations working again and a nice consistent approach to delivery in sccm, which is a great thing.

But there are some circumstances where I need the user to run a powershell script … such as setting up user based App-V connection groups.

I am working on a method which removes exe block from the registry of the user at the start and then applies it at the end. most obvious way would be to deliver a PSAppDeployToolkit folder inside of a PSAppDeployToolkit folder, I can think of many other variants to try, I’m working on it and will post results in time.