The system administrator has set policies to prevent this installation — no elevation prompt!

«The system administrator has set policies to prevent this installation»

This has become gradually more frequent on install and uninstall over the last two years or so. It now occurs almost every time. Win7Pro with Tablet Extensions, fully updated. I am supposedly an admin user. If I install from a command prompt «as Administrator», or logout and log in as _the_ «real» Administrator, un/installs always work.

I’ve tried lots of the web «solutions», none helped.

I just compared a failure log with a success (command prompt «as Administrator») log. Quick summary, then details. Clues welcome!

In fail log, «MsiRunningElevated» not found.

In both logs:
line 159/161: —> Doesn’t seem to be enough.
MSI (c) (78:E0) [12:04:32:043]: MSI_LUA: Setting AdminUser property to 1 because this is the client or the user has already permitted elevation

In good log:
line 1333:
MSI (s) (88:6C) [12:51:06:262]: MSI_LUA: Credential prompt not required, user is an admin

in fail log:
line 1342:
MSI (s) (60:68) [12:04:59:974]: MSI_LUA: Elevation required to install product, will prompt for credentials

—> but it doesn’t prompt, the call fails in 3ms:
MSI (s) (60:68) [12:04:59:977]: MSI_LUA: Credential Request return = 0x80070005
This installation is forbidden by system policy. Contact your system administrator.

——
The Windows Installer verbose log will contain the following line when the caller to the Windows Installer is already elevated.

MSI_LUA: Credential prompt not required, user is an admin

The Windows Installer verbose log will contain the following line when the AlwaysInstallElevated policy is set.

MSI_LUA: No credentials required as all installs will run elevated due to AlwaysInstallElevated policy setting

The Windows Installer verbose log will contain the following line when there was an error returned from the credential dialog service.

MSI_LUA: Failed to obtain credentials. Error = 0x%X

The Windows Installer verbose log will contain this line when AdminUser is faked.

MSI_LUA: Setting AdminUser property to 1 because this is the client or the user has already permitted elevation

Additionally the log will not have this line

Property(C): MSIREALADMINDETECTION = 1

The Windows Installer verbose log will contain the following line when prompting for credentials.

MSI_LUA: Elevation required to install product, will prompt for credentials

The Windows Installer verbose log will contain the following two line the prompt for credentials has been successful.

MSI_LUA: Credential Request return = 0x0

MSI_LUA: Elevated credential consent provided. Install will run elevated
——

——
How can I troubleshoot when the call to a custom action has failed due to lack of access to a machine?

Custom actions vary in their quality and proper handing of errors. The underlying error the custom action will receive from their Windows API call is 0x80070005 (Access is Denied). Assuming the custom action has not written errors to the log indicating Access is Denied, the best guess method is to

Determine the problem occurred in a custom action by searching for Return Value 3 in the verbose log and looking immediately before the error to see of a Custom Action as the source of the error.
Run the same install from an elevated command prompt and check to see if the same custom action was successful.

Generally this indicates the custom action was the problem. The body of the document contains the most frequent custom action errors under UAC and their mitigations.
——
—> no «Return Value 3» in my logs. But we know the request.

The failing log, as Admin user:

MSI6a09e sdformater-fail.LOG, — Fail — line 30:
—
MSI (c) (78:E0) [12:04:32:006]: Machine policy value ‘DisableMsi’ is 0
MSI (c) (78:E0) [12:04:32:006]: Machine policy value ‘AlwaysInstallElevated’ is 0
—

line 128:
—
MSI (c) (78:E0) [12:04:32:027]: Machine policy value ‘AlwaysInstallElevated’ is 0
MSI (c) (78:E0) [12:04:32:027]: User policy value ‘AlwaysInstallElevated’ is 0
—

line 161: —> Doesn’t seem to be enough.
MSI (c) (78:E0) [12:04:32:043]: MSI_LUA: Setting AdminUser property to 1 because this is the client or the user has already permitted elevation

line 1248:
—
MSI (s) (60:68) [12:04:59:887]: Machine policy value ‘AlwaysInstallElevated’ is 0
MSI (s) (60:68) [12:04:59:887]: User policy value ‘AlwaysInstallElevated’ is 0
—

line 1340:
—
MSI (s) (60:68) [12:04:59:974]: Machine policy value ‘AlwaysInstallElevated’ is 0
MSI (s) (60:68) [12:04:59:974]: User policy value ‘AlwaysInstallElevated’ is 0
MSI (s) (60:68) [12:04:59:974]: MSI_LUA: Elevation required to install product, will prompt for credentials
MSI (s) (60:68) [12:04:59:976]: MSI_LUA: Entering Credential Request. hwnd = 6687058, MsiAction = 0, productname = SDFormatter, version = 4.0.0, language = 1033, manufacturer = SD Association
MSI (s) (60:68) [12:04:59:976]: MSI_LUA: (continued). packagepath = C:\windows\Installer\e870db2.msi, packagesource = C:\Users\Loren\AppData\Local\Downloaded Installations\<5d501d62-f028-4c06-a9ff-cb3356efa62d>\SDFormatter.msi, dwUpdates = 1
MSI (s) (60:68) [12:04:59:976]: MSI_LUA: (continued). update 0 = C:\windows\Installer\e870db3.mst
MSI (s) (60:68) [12:04:59:976]: MSI_LUA: (continued). update source 0 = C:\Users\Loren\AppData\Local\Downloaded Installations\<5d501d62-f028-4c06-a9ff-cb3356efa62d>\1033.MST
MSI (s) (60:68) [12:04:59:977]: MSI_LUA: Credential Request return = 0x80070005
This installation is forbidden by system policy. Contact your system administrator.
C:\Users\Loren\AppData\Local\Downloaded Installations\<5d501d62-f028-4c06-a9ff-cb3356efa62d>\SDFormatter.msi
MSI (s) (60:68) [12:04:59:986]: Attempting to delete file C:\windows\Installer\e870db3.mst
MSI (s) (60:68) [12:04:59:992]: MainEngineThread is returning 1625
MSI (s) (60:80) [12:04:59:994]: Calling SRSetRestorePoint API. dwRestorePtType: 13, dwEventType: 103, llSequenceNumber: 1350, szDescription: «».
—

(Started from a command prompt «as Administrator»)

MSIf5d0 sdformater-good.LOG — Success — line 125:
—
MSI (c) (7C:7C) [12:50:46:179]: Machine policy value ‘AlwaysInstallElevated’ is 0
MSI (c) (7C:7C) [12:50:46:179]: User policy value ‘AlwaysInstallElevated’ is 0
MSI (c) (7C:7C) [12:50:46:179]: Product installation will be elevated because user is admin and product is being installed per-machine.
MSI (c) (7C:7C) [12:50:46:179]: Running product ‘<179324ff-7b16-4ba8-9836-055caaee4f08>‘ with elevated privileges: Product is assigned.
—

line 159:
—
MSI (c) (7C:7C) [12:50:46:195]: MSI_LUA: Setting AdminUser property to 1 because this is the client or the user has already permitted elevation
MSI (c) (7C:7C) [12:50:46:195]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated.
MSI (c) (7C:7C) [12:50:46:195]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is ‘1’.
MSI (c) (7C:7C) [12:50:46:195]: PROPERTY CHANGE: Adding Privileged property. Its value is ‘1’.
—

line 1333:
MSI (s) (88:6C) [12:51:06:262]: MSI_LUA: Credential prompt not required, user is an admin

line 1343:
—
MSI (s) (88:6C) [12:51:06:270]: Machine policy value ‘AlwaysInstallElevated’ is 0
MSI (s) (88:6C) [12:51:06:270]: User policy value ‘AlwaysInstallElevated’ is 0
MSI (s) (88:6C) [12:51:06:270]: Product installation will be elevated because user is admin and product is being installed per-machine.
—

line 1397
—
MSI (s) (88:6C) [12:51:06:322]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated.
MSI (s) (88:6C) [12:51:06:322]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is ‘1’.
MSI (s) (88:6C) [12:51:06:322]: PROPERTY CHANGE: Adding Privileged property. Its value is ‘1’.
—

line 5404:
—
Property(S): MsiTrueAdminUser = 1
Property(S): AdminUser = 1
—

Fix: The System Administrator Has Set Policies to Prevent This Installation

Installing a program shouldn’t be a difficult thing to follow through but sometimes it’s been made impossible by errors similar to this one. This particular error occurs when the users is trying to install a program on their PC and the message goes like:

The System Administrator Has Set Policies to Prevent This Installation

Sometimes there is an error code displayed as well which should help users research the cause of this error. The error is not a dangerous one and it can be fixed by implementing some of the methods which you can see below. The methods are quite easy to follow through so make sure you try out each one.

Solution 1: Simply Try Running the Setup File as an Administrator

This fix is definitely the simplest one and the reason why it’s included is because it has definitely worked in several occasions. So, before trying the more complicated fixes, make sure that you have tried this one out and saved yourself a couple of hours.

1. Locate the setup file of the program you want to install and right-click on it.
2. Choose the Run as administrator option from the context menu and agree to all popup alerts which may appear.

Solution 2: A Simple Registry Fix

The first method on our list has been declared as quite a successful one so that is the reason why you should first try this one out. The method includes editing the registry which can be somewhat dangerous if you are not sure what you are doing or if you accidentally edit the wrong key.

Follow the instructions displayed in this article in order to safely backup your registry so that you can fix the potential damage if it occurs.

1. Open the Registry Editor by typing this into the Start menu or in the search bar located at the left part of the taskbar. You can also open the Run dialog box and type in “regedit”.

1. Navigate to the following key in the registry editor:

1. Right-click on the right section of the Registry Editor windows and click on New >> DWORD (32-bit) Value.
2. Set its name to DisableMSI and set its value to 1.

1. Next, navigate to the following location and search through the list until you find the product that has been struggling to install on your computer.

1. After you locate its key which should look like a folder, delete the entire folder by right-clicking on it and choosing Delete. After that, try installing the software again and check to see if the error message still appears.

Solution 3: Turn of User Account Control (UAC) and Try Installing Your Program

Since Windows can sometimes overreact with their security warnings and messages, you can turn them off for a short period of time needed for you to install the program you are struggling with. You should undo these changes as soon as you are done with the process since the last thing you want to do is leave your computer unprotected.

1. Open Control Panel by searching for it in the Start menu.
2. Switch the View by option in Control Panel to Large Icons and locate the User Accounts option.

1. Open it and click on “Change User Account Control Settings”.
2. You will notice that there are several different options you can choose on the slider. If your slider is set at the top level, you will definitely receive more of these pop-up messages than usual. Also, the error messages similar to the one you are experiencing right now are usually caused by User Account Control.
3. Try decreasing this value by one if it’s at the top slider and check to see if it helped. Repeat the process if the error still appears or turn of UAC completely.

1. We recommend you turn it off for now as the file should probably install successfully. You may also be able to run the file even if you don’t disable UAC completely, but you should definitely leave it on as it serves to protect your PC.

Solution 4: Use the Hidden Administrator Account

Even though you are probably the administrator on your PC, this error message might implicate that you are not actually the real admin. This is a bug and it can be fixed for the particular program if you use the “hidden” administrator account which can be unlocked by several commands in Command Prompt.

1. Click on either the Start menu or the search button right next to the Start menu button on the taskbar and search for Command Prompt. Right-click on it and choose the Run as administrator option.

1. Copy and paste the following command in Command Prompt and click Enter. You should be able to see the “The command completed successfully” message in no time.

net user administrator /active:yes

1. Log into this admin account and wait for a couple of minutes before everything is ready.
2. Now you can try restarting your computer, logging into the new administrator account and running the setup file.
3. After you are finished with the hidden administrator account, you can disable it again by opening an administrative command prompt and typing the following command:

net user administrator /active:no

Solution 5: Use the Group Policy Editor

This error is explained in a way which tells us there may be something wrong with the Local Security Policy and it needs to be edited. You can safely edit these settings by following the instructions below and navigating to the settings which needs to be changed.

1. Hold the Windows key and press the R button from your keyboard.
2. Enter “gpedit.msc” in the Run dialog box, and press the OK button in order to open the Group Policy Editor.

1. On the left section of Local Group Policy Editor, under Computer Configuration, double click on Administrative Templates, and navigate to the Windows Components >> Windows Installer.
2. Select the Windows Installer folder, and navigate to its right side section.
3. Double click on the “Turn off Windows Installer” policy option, check the box next to the “Enabled” option, and set the Disable Windows Installer option to Never.

1. Finally, restart your computer in order to save these changes and check to see if the program can be installed.