FirewallException for perUser installation

[mrcorum]

Hi!

I'm developing an installer using WiX5 (also tried latest 6.0.0.rc-2) and would like to add an FirewallException for my application. If I set Scope="perMachine" or set Scope="perUserOrMachine" and use msiexec /i ALLUSERS=1 the the firewall exception is added successfully. But in case I install without elevating, the exception is never added.
Also I get warning WIX1076: ICE105: 3329 contains msidbCustomActionTypeNoImpersonate execution option. This is invalid for a per user application warning during the build if I use Scope="perUserOrMachine".

Could you tell me if it's possible to use FirewallException for perUser installation without elevation?

Thanks!

[bevanweiss]

Have you configured the Firewall rules like this without WiX being involved at all?
i.e. is it even possible in Windows to have a firewall rule that is different depending on the user that is running the software?

Make sure that when you're trying to configure the firewall rules, you've got UAC enabled, but don't approve any UAC requests (because that would then be an elevation requirement).

[mrcorum]

Yes, you are right. It's not possible to have a firewall rule that is different depending on the the user. But I would like to achive a bit different result. I tried to add a firewall rule using different ways. The only thing you need is to be elevated to admin to do this. For, example if I run Scope="perUser" installer elevated (for example from a custom exe which requested elevation), the rule is added successfully using the WiX Toolset Firewall extension. The same if I call netsh advfirewall firewall add rule from installer, the installer also had to be elevated.

So the question is can I have elevated per user installation (and uninstallation as well) without using a bootstrapper? I suppose the answer is no 🙂

[bevanweiss]

So the question is can I have elevated per user installation (and uninstallation as well) without using a bootstrapper? I suppose the answer is no 🙂

Not really... that's not how the Windows Installer system wants things to be.
If you are authoring a perUser package, then any user without admin privileges is supposed to be able to install it, in face multiple users are supposed to be able to install it on the same machine all independently. It's kind of like the Windows Installer version of a 'portable app', everything that the installer touches should be ONLY for that user, and not visible to any other user.

Based on this, your firewall concept isn't correct. Firewall rules are shared across all users.. and so a change of this is in itself a perMachine change. Now, maybe overall you actually have several parts, some perMachine, and some perUser... that's reasonably complicated stuff, and you would really want to use a bootloader to sequence and validate the components (and likely you'd want to get a more experienced setup author to do the work for you).

So it sounds like your installer should be perMachine.

[mrcorum]

Thank you for the detailed explantion. Yes, you are right, in my case some parts of the installer are perUser, some are perMachine.

This is an offtopic by I would like to explain my intensions. The idea was to have initial installation for the user, to set up things that require elevation (i.e., firewall) by those who have admin access (one time action), and allow the user to update the app by himself in the future (those parts which require admin access not likely to be changed in the future) so the user will do simple perUser installation which doesn't require elevation.

I have some ideas how to achieve this, but they require additonal logic:

• have a per user installer and have an addional script or application which asks elevation and setups missing parts which perUser installer can't do. Admin will invoke this script after the initial installation. Another question is how to remove that additional stuff on uninstall 🙂
• create an additional application that will ask for elevation and setup thing by itself. The application will be invoked during the initial installation and uninstall using the WixQuietExec. I don't know yet whether I can separate initial installation (uninstall) and major upgrade.
• create a bundle and do the same as in the previous part by using the ExePackage
• register a windows service. It will have privileges to setup/remove firewal and etc. But again, it probably also will need perMachine installer