2

I'm having some problems with privileges when running a CustomAction in deferred mode.

I want to kill some Service processes which could be running using different user accounts, from Local System to regular users, but the CA succeeds only when the processes and the CA are executed as the same user. Here are some cases and results:

  • "process1.exe" is a process running as the same user running the installation. If the kill CA is run in System context using Impersonate="no" the access is denied.
  • "process1.exe" is a process running as the same user running the installation. If the kill CA is run in User context using Impersonate="yes" the process is killed.
  • "process1.exe" is a process running as another user. If the kill CA is run in User context using Impersonate="yes" the access is denied.
  • "process1.exe" is a process running as another user. If the kill CA is run in System context using Impersonate="no" the access is denied
  • "process1.exe" is a process running as Local System. If the kill CA is run in User context using Impersonate="yes" the access is denied.
  • "process1.exe" is a process running as Local System. If the kill CA is run in System context using Impersonate="no" the process is killed.
<SetProperty Id="KillUserProcess" Value='"[WindowsFolder]\System32\taskkill.exe" /F /IM process1.exe' After="CostFinalize" />
<CustomAction Id="KillUserProcess" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" Return="check" />

<SetProperty Id="KillSysProcess" Value='"[WindowsFolder]\System32\taskkill.exe" /F /IM process2.exe' After="CostFinalize" />
<CustomAction Id="KillSysProcess" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" Return="check" />

<InstallExecuteSequence>
    <Custom Action="KillUserProcess" After="InstallInitialize"></Custom>
    <Custom Action="KillSysProcess" After="KillUserProcess"></Custom>
</InstallExecuteSequence>

Action=KillUserProcess,ActionType=3137,Source=BinaryData,Target=CAQuietExec,CustomActionData="C:\Windows\System32\taskkill.exe" /F /IM process1.exe) CAQuietExec: "C:\Windows\System32\taskkill.exe" /F /IM process1.exe CAQuietExec: ERROR: The process "process1.exe" with PID 3164 could not be terminated. CAQuietExec: Reason: Access is denied. CAQuietExec: CAQuietExec: Error 0x80070001: Command line returned an error. CAQuietExec: Error 0x80070001: QuietExec Failed CAQuietExec: Error 0x80070001: Failed in ExecCommon method

Action=KillSysProcess,ActionType=3137,Source=BinaryData,Target=CAQuietExec,CustomActionData="C:\Windows\System32\taskkill.exe" /F /IM process2.exe) CAQuietExec: "C:\Windows\System32\taskkill.exe" /F /IM process2.exe CAQuietExec: SUCCESS: The process "process2.exe" with PID 4596 has been terminated.

If LocalSystem doesn't have the rights to kill the processes, who does? Running these commands from Command Prompt work without problem when elevated. Even using psexec from SysInternal to run the command as System work without a problem. Only when running through MSI are these issues faced.

Is it possible to make a Custom Action running as a System kill processes not owned only by System?

IlirB
  • 1,410
  • 14
  • 19
  • I cannot see a mistake on the first glance, but perhaps you could try to stop your services with `sc stop ` instead of `taskkill` – ChristianMurschall May 09 '17 at 15:07
  • Stopping services is the first thing I do, the actual CustomAction that I have is much more advanced where it instructs service manager to stop services, it resolves all processes of a services and waits 60 sec for the processes to close. BUT processes sometimes crash and they don't close and service manager is stuck on trying to stop the services. The only way to release all the locks is to kill the processes. And this is where the issue appears with the lack privilege to kill the processes even when running in "System" context. – IlirB May 10 '17 at 08:09

1 Answers1

0

This question is tagged DTF but I don't see any .NET code.

FWIW, I've googled this topic and it's too much to speculate on... the reality is you need a bigger hammer and C#/DTF is that hammer. You can do way more complicated API calls with it and better error handling / logging.

Christopher Painter
  • 54,556
  • 6
  • 63
  • 100