Civil 3D 2011 deployment - first-run requires administrative rights

[Anonymous]

I am using Microsoft SCCM to distribute a network deployment of Civil 3D 2011 32-bit to a hybrid of systems, some of which have restricted rights for the end users and some of which do not.  The "installation" completes successfully, however the required restart at the end is not really the end of the installation.  Some components are not truly installing until the first launch of the application, after the restart, which means administrative rights are required again.  That isn't a problem for the end users who have local administrator rights, but it's a showstopper for the restricted ones.  I have stepped through the deployment wizard and did not find any "install on first run" options that would explain this.  I need for the app to be ready to use following reboot.  Am I missing something in the deployment options, or do I have to create a separate task to launch the program with elevated permissions after reboot to truly "complete" the installation?  If that's the case, any recommendations for how to best achieve that?  Any guidance would be greatly appreciated!

Thanks!

Carrie

[DouglasLauritsen]

When a user uses AutoCAD for the first time another installer is run, we refer to it as the secondary installer, to create their Local files, Roaming files, and the Registry entries in the HKCU hive.

This installer should work for standard Windows Users, Power Users, and Administrators. However permissions set in Group Policies can effect this. Elevating the user to an administrator for first time use may be the easiest solution. You may also need to reenable the privilege to run an installer and access to those user locations:

     Windows 7 and Vista:

          C:\Users\%USERPROFILE%\AppData\Roaming\Autodesk

          C:\Users\%USERPROFILE%\AppData\Local\Autodesk

          HKEY_CURRENT_USER\Software\Autodesk

     Windows XP:

          C:\Documents and Settings\%USERNAME%\Application Data\Autodesk

          C:\Documents and Settings\%USERNAME%\Local Settings\Application Data\Autodesk

          HKEY_CURRENT_USER\Software\Autodesk

Please reference this Technical Solution regarding restricted users.

[Anonymous]

Hi.

I have the same problem, but with AutoDesk Inventor 2011 on Windows 7 x64. I ran the deployment version with administrator rights and the installation was successfull, but running the program as a standard user (domain user) after the installation fails with the error that the software is not registered.

---

@DouglasLauritsen wrote:

When a user uses AutoCAD for the first time another installer is run, we refer to it as the secondary installer, to create their Local files, Roaming files, and the Registry entries in the HKCU hive.

     Windows 7 and Vista:

          C:\Users\%USERPROFILE%\AppData\Roaming\Autodesk

          C:\Users\%USERPROFILE%\AppData\Local\Autodesk

          HKEY_CURRENT_USER\Software\Autodesk

---

If those are the only locations that the post-setup needs to write to then it should not be a problem. The user have access to all those. It should be noted though that we do use Folder Redirection on AppData, but only to another location on the same local computer. "AppData\Local" is still in the standard location, but the "AppData\Roaming" gets redirected.

Giving our users "temporary" administrative rights is a very bad practice that no company really should do unless absolutely neccessary...

I should also note that the post-setup for AutoCAD Mechanical 2011 worked like it should.

[DouglasLauritsen]

You may need to either disable UAC or set Inventor to “Run as Administrator” as described in the Readme:

If you installed Inventor 2011 on Windows Vista or Windows 7, and you want User Account Control (UAC) enabled, right-click the Inventor icon, and then select "Run as Administrator" to start Inventor after installation. This ensures all necessary subcomponents are registered correctly.

Please reference the folder redirection section of this Technical Solution.

[Anonymous]

Turning off UAC would still require the end users to be administrators, which they are not. If something require administrator rights then that should be done during the initial installation. For user-specific settings, templates, shortcuts and that kind of stuff you could do that in a post-install. I don't really know what this post-installer is trying to do, but if it only accesses the locations you mentioned in the earlier post it should not require administrator rights. Could you ask the developers to consider working on a fix? AutoCAD Mechanical 2011 did this procedure the correct way. It ran the post-install MSI without requiring any other rights than what the standard domain user had.

And it isn't really efficient to have our IT staff go to each computer where we deploy AutoDesk Inventor 2011 and manually run the programs as administrator.

[DouglasLauritsen]

Bob Van der Donck documented an alternative way to grant Administrative privileges to only Inventor in the Being Inventive blog. This alternative can be applied to Inventor 2008, 2009, 2010 and 2011.

[Anonymous]

I can see how that would work, but this problem is not really about how we run the software as an administrator. Letting the user run the software as an administrator is a security risk no matter how you do it. Once the software is loaded as an administrator the user can do everything an administrator could from within the software. Let me give you an example:

1. You use this script to let users run the software as an administrator.

2. A user notices that the software runs with administrator privileges.

3. The user could now go to the "File" menu and select "Open" and find whatever software he wants and run that as an administrator, for example "cmd.exe".

You see where I am going with this? The whole system and all other systems that use the same administrator account gets exposed.

[DouglasLauritsen]

The Administrative privilege is only required for first run or when changing the Inventor version.

[Anonymous]

Yes, but we can't let our users run the software as an administrator, even for the first run. If that is required, the only secure way of doing it is by letting the local IT-staff do the first-run manually on all the computers and then check that the software have registered properly and then reboot the computer, but you can see how that doesn't really appeal to us as a viable method.

What would fit our needs would be this kind of scenario:

1. Initial install during deployment installs all required files, registry, and does all the dirty work that require administrative rights.

2. Post-install that runs when a user starts the software installs private user settings, templates, and other stuff that would usually be bound to the user account, and would not require administrative rights.

This is kind of how AutoCAD Mechanical 2011 is doing its installation, isn't it? So why can't Inventor 2011?

Btw, thanks for all the answers so far. Not many companies that answer this quick on their free support forum.

[DouglasLauritsen]

You can provide this feedback directly to the Inventor product managers and developers by logging it with this feedback form on the Autodesk web pages. I recommend that you or anyone else interested in this provide feedback as many product enhancements are based on a business case which is best supported by having customers comment.