I have an application that only works properly when installed as SYSTEM. When I use psexec -i -s cmd.exe and install the MSI, I can run the software as a regular user, if I install using the Toolkit, I can’t run it as a regular user.
I’m trying to find a way to force msiexec to run as SYSTEM every time no matter if a User is logged in or not. We’re using SCCM to deploy Apps.
Neither Execute-MSI or Execute-Process has a way to run the executable as SYSTEM. Do I need to use psexec or runas to get this to work, or is there a better way?
I’ve not run into this specific problem with any piece of software but I’d be curious of the responses to this post.
What application is this that requires installation as SYSTEM?
In the mean time, I would just do what you’re currently doing since you appear to have a workaround.
I haven’t had any other responses yet. I’ve discovered that I can use SCCM to force the script to run as SYSTEM, but it doesn’t work when using the catalogue, even if I try to force it using psexec.
First, I have to ask: What application(s) absolutely needs to be installed as SYSTEM?
Not that I’ve seen it all (because I haven’t) but I have packaged my fair share of applications over the years, and I’ve not run across an application that required running the installation as SYSTEM. In every case the problem has been that the user running the installation simply didn’t have have the necessary rights (i.e.: they’re not local administrators) requiring something to elevate the installation on their behalf.
Are you using a privilege management solution? (If so, what is it?)
You may want to consider:
- posting on the TechNet forums or Windows-Noob for guidance
- posting on other application packaging sites like ITNinja
- getting with Zak in this post http://psappdeploytoolkit.com/forums/topic/run-install-as-system-but-interact-with-logged-on-user (link) because there are some similarities in your posts.
The program is the Netsupport School Tutor software (classroom management software, server part).
We migrated from a vbs script-based installation to the PS App Deploy. TK and found that, if the installation did not run as System, the User, when running the software for the first time, could not complete the online authorization. A shield appeared on the OK button of the authorization dialog and the program complained that it needed an administrator to authorize.
The vbs installer never had this problem, and now I realize that the PS installer is OK too when SCCM runs it as system. When installed via the SCCM Catalogue though, the problem remains. I know this is a strange one, but there it is 
I tried using psexec to force the exe to run as System, but this makes no difference when installed via the SCCM Catalogue.
There is one other wrinkle that might be relevant. The people who manage Group Policy decided a while ago to completely disable User Access Control in Windows 8.1. This seems like a very bad idea, but I have zero control over GPOs. I assume that UAC would allow on-the-fly privilege escalation for purposes such as this, but that road is blocked.
Have you tried running the script by right clicking on the deploy-application.exe and choose run as administrator? If uac is disabled it’s important that you’re logged on with an user that’s actually member of the local administrators group (I think the deploy-application.exe file will error out if you’re not admin though and return a proper message).
My guess is that this would work just as fine with local admin account as with nt-authority\system. Unless all your users are local administrators already?
Would be interesting to know how it fails more specifically. I have a feeling that the deploy-application.exe/ps1 doesn’t get executed at all when you’re deploying with CM (i.e some mistake in your deployment type). You’d have a log file from the script created in %windir%\logs\software.