I've seen a couple of threads stating that AppLocker is preventing setup to install (even in administrator mode). None of those threads are useful, except we have to do a workaround by changing some registry keys, or disabling AppLocker temporary. The opener of those threads didn't really provide their configuration settings either, which can make it harder for AutoCad support reps to troubleshoot and not matching up our AppLocker configurations. In the end, the support reps claimed that it's working on their end and provided no fix.
Anyways, I decided to start a new thread and I've provided 2 screenshots of my AppLocker settings. Event log gave me this error during installer's splash screen:
The installation of C:\Users\some username\AppData\Local\Temp\_AI2F83.tmp\SetupRes\eval.msi is not permitted due to an error in software restriction policy processing. The object cannot be trusted.
I tried whitelisting this eval.msi file by either using a path rule, eval.msi's certificate, a hash rule from its file size, or simply all of them. Later, I found out that any rule will be useless. Why? It's because for some reason the installer (or some process) modifies eval.msi to the point it loses its certificate and the file size changed. Here's what I observed:
- On the CD (let's say D:\), D:\SetupRes\eval.msi is around 199KB and it has a certificate.
- Once I run setup.exe, the installer's splash screen shows and starts copying files and folders in the background from the CD to user temp directory (in my case ex: C:\Users\some username\AppData\Local\Temp\_AI14FF.tmp\)
- eval.msi still has its certificate and the file size remains the same at this time while the installer is copying remaining files and folders
- Ones it's done copying, this is where eval.msi's file size grew to about 288KB and because of that, it loses its certificate. This is where AppLocker comes in and decides to block it since it's no longer be trusted to run.
- Using ProcMon, I can there was something is writing activity to eval.msi (setup.exe?).
That's some of the info I have for you guys to troubleshoot. Let me know if you can reproduce the error. Again my AppLocker settings are in the attachments (all rules should be enforced).
