Installation & Licensing
Welcome to Autodesk’s Installation and Licensing Forums. Share your knowledge, ask questions, and explore popular Download, Installation, and Licensing topics.
cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Forbidden installation with Windows 7 Enterprise, Applocker and Autodesk Product

19 REPLIES 19
SOLVED
Reply
Message 1 of 20
neilgwood
6336 Views, 19 Replies

Forbidden installation with Windows 7 Enterprise, Applocker and Autodesk Product

 

When I run setup.exe for 3DS Max Design 2011 or Navisworks 2011 on any of our domain connected Windows 7 machines, the program starts to initialise, but then comes up with the following message:

 

"This installation is forbidden by system policy. Contact your system administrator. #1"

 

followed by

 

"Fatal error during installation."

 

At which point setup.exe bombs out. In the Application Log, I get this message:

 

"The installation of C:\Users\username\AppData\Local\Temp\_random.tmp\SetupRes\eval.msi is not permitted due to an error in software restriction policy processing. The object cannot be trusted"

Source: MsiInstaller  Event ID: 1008

 

I have confirmed that this is caused by Applocker as I have tested with a machine that has all policies except Applocker and it works, but as soon as Applocker is turned on I get this error. We use Applocker policies which have been set to allow Admins to run all Windows Installer Files, Executables and Scripts on any Path. The Applocker event log doesn't show any errors to suggest it's blocking the program, but something must be causing a knock on effect to this install. I can also confirm that I do have a Software Restriction Policy turned on that applies to all except Administrators. This policy doesn't have any actual restrictions in it, but it has been suggested elsewhere that this is a possible cause of this error.

 

I can confirm that if the product has already been packaged using the packaging tool within the setup program, that the package installs ok. Of course, we can only get to the packaging tool through the setup program which doesn't run on our Windows 7 machines.

 

Finally, I have seen another post similar to this that suggests taking the machine off of the domain and trying a fresh install. Unfortunately, this is not an option to our users.

 

Any help would be very gratefully received.

19 REPLIES 19
Message 2 of 20
neilgwood
in reply to: neilgwood

Noone of the Autodesk community volunteered an answer, but the Microsoft forum proved more fruitful:

 

http://social.technet.microsoft.com/Forums/en/winserverGP/thread/2ad92754-f01e-410e-97db-7a9bc81586d...

Message 3 of 20
Dwayne.Poot
in reply to: neilgwood

Hi neilgwood;

 

   I know this reply is a bit on the late side but my manager asked me to contact you to see if we can be of any assistance. I read through the discussions you have here and with Microsoft and see that you were able to work around this issue via modifying some registry entries. I haven't experienced too many customers using the AppLocker so I'm glad that you were able to get some assistance from Microsoft.

 

  Were you looking for any change or modifications from the applicaiton end? If you would like any information or details form our end please let me know and we'll help as best as possible.

 

Dwayne

 



Dwayne Poot
Support Specialist
Product Support
Autodesk, Inc.


Message 4 of 20
neilgwood
in reply to: Dwayne.Poot

Hi Dwayne,

 

Thank you for getting in touch. As you have seen, I do now have a workaround so I can get Autodesk products to install, but workarounds are never as ideal as actual fixes. I'm not 100% sure if the problem is with Autodesk or Applocker, but I haven't experienced the same problems with any other product I've installed in our Windows 7 environment so that suggests to me that your installer works in a slightly different way. I also know that it's not a oddity with our group policies as someone else was able to replicate the problem without knowing our set up.

 

As such, I can't just say "fix your product", but I will respectfully request that you look at how your setup program initialises and works with Applocker. As previously mentioned, if a custom installation of the product has already been packaged for deployment using the option in your setup program then it installs with no issues and this uses the same setup.exe to run. However, if it's a new install from the CD (or a network stored copy of the CD) then the setup.exe starts to initialise and then fails with the errors mentioned.

 

Thanks again for looking into this.

 

Regards

 

Neil

Message 5 of 20
Dwayne.Poot
in reply to: neilgwood

Hi neilgwood

 

   Sorry for the delay, took a small vacation. I will log a case for you today and investigate this on our end.

 

dwayne



Dwayne Poot
Support Specialist
Product Support
Autodesk, Inc.


Message 6 of 20
stuebing
in reply to: Dwayne.Poot

Hello

i have the same problem with Autocad 2012

what is the workaround?

 

i have added the Autodesk certificate to our Applocker Polkicy,

but the eval.msi in the temp dir have no digital signature. Why?

 

we want deploy Autocad 2012 with our Software distribution on Windows 7 64 Enterprise

and to disable Applocker is no solution.

 

Have Autocad 2012 a windows 7 compatible logo, because i didn't find it in the Microsoft Library.

 

 

Message 7 of 20
Dwayne.Poot
in reply to: stuebing

Hi All;

 

   We are currently testing App Locker in greater detail. We're experiencing issues reproducing this consistantly. I have tested several applications through standard install as well as deployments and I haven't had any issues while App locker was enabled. 

 

   That being said we have a couple defects logged that were submitted that were currently investigating so these might turn up some information that might help. If they send updates shortly I'll update the forum

 

Dwayne



Dwayne Poot
Support Specialist
Product Support
Autodesk, Inc.


Message 8 of 20
chillme1
in reply to: Dwayne.Poot

I have recenlty experienced this issue (after installing Win7 and all Autodesk socftware as recent as approximately six months ago) Now the error message appears and 2012 Autodesk software including AutoCAD Lite installatons are disallowed.

 

Please update this thread when a solution or workaround is available.

 

Additionally, I sent a request via Subscription Support pertaining to trying to resolve this issue.

Thanks for your comments,

Clint Hill
Message 9 of 20
neilgwood
in reply to: chillme1

Hi Clint,

The workaround we use is a batch file, shown below, which makes the registry changes as suggested in the Microsoft forum, then pauses so you can separately run the Autodesk installer and then set the keys back after the install.

 

Hope this helps

 

Neil

 

REG ADD HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Script /v EnforcementMode /t REG_DWORD /d 0 /f
REG ADD HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows\SrpV2\Script
/v EnforcementMode /t REG_DWORD /d 0 /f

REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Srp\Gp\Msi /v EnforcementMode /t REG_DWORD /d 0 /f

REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Srp\Gp\Msi /v EnabledAttributes /t REG_DWORD /d 0 /f

PAUSE

REG ADD HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Script /v EnforcementMode /t REG_DWORD /d 1 /f
REG ADD HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows\SrpV2\Script
/v EnforcementMode /t REG_DWORD /d 1 /f

REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Srp\Gp\Msi /v EnforcementMode /t REG_DWORD /d 1 /f

REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Srp\Gp\Msi /v EnabledAttributes /t REG_DWORD /d 1 /f

 

Message 10 of 20
jeremy.burke
in reply to: neilgwood

Can anyone provide an update on a resolution, not just a workaround?

 

I have installed 50+ other applications and have had no issues with Applocker.  This problem is clearly related to Autodesk installers.

 

Thanks

Jeremy

Message 11 of 20
chillme1
in reply to: neilgwood

Hello Neil,

 

The solution that you provided did not work. Thanks for sending the code.

Please keep all interested parties here updated on a solution

Thanks for your comments,

Clint Hill
Message 12 of 20
chillme1
in reply to: jeremy.burke

As you, I would like a resolution as I have no issues installing other non-Autodesk software.

Thanks for your comments,

Clint Hill
Message 13 of 20
Dwayne.Poot
in reply to: chillme1

Hi All;

 

   I have ran several tests over here on several Autodesk applications and haven't had any issues so at this point I haven't been able to reproduce this issue. It's possible that the configuration / setup is a bit different. If you have any specific configuration you would be happy to test this out for you but at this point we have yet to reproduce so I can't offer a fix.

 

  If you have subscription and would like to send us more details I would suggest logging a service request and the tech will gather information for the QA teams to see if they can offer any further information.

 

Dwayne

 



Dwayne Poot
Support Specialist
Product Support
Autodesk, Inc.


Message 14 of 20
voldo2006
in reply to: neilgwood

Thanks for the workaround. Made the batch file, ran it, install the program. Help me out a lot since this is for my college class.

Message 15 of 20
jeremy.burke
in reply to: neilgwood

----------------------------------

From: 3/6/2012

----------------------------------

Hi Jeremy,

  Ok I've logged the defect and we'll just need the QA team to verify the defect which shouldn't take to long. I'll send any updates that they have for you.

Best regards,

Dwayne Poot
Autodesk Support Team

 

 --------------------------------

From: 4/12/2012

---------------------------------

Hi Jeremy,

  Unfortunately there hasn't been any updates from the developers. I have been working with the Maya developers since I was able to reproduce it but they haven't been able to find a fix for this.

  I can't promise when the developers will have a update / work around for this. I think the only option at this point is to turn off the Applocker rules during the Autodesk installations.

Best regards,

Dwayne Poot
Autodesk Support Team

Message 16 of 20
Dwayne.Poot
in reply to: jeremy.burke

HI All;

 

    I ran a few tests with the 2013 installers and they seem to install fine with AppLocker enabled with default rules turned on. Unfortunately some of the 2012 installers are still effected. 

 

dwayne

 



Dwayne Poot
Support Specialist
Product Support
Autodesk, Inc.


Message 17 of 20
steinar.sorem
in reply to: Dwayne.Poot

Hi

I will just tell that even i am not able to install Autodesk 2013 product, neither made deployments with Applocker just installed and not activated in our european part of the domain (where we are located).  (only Win 7 x64 available for test)

Today i will try with an virtual computer not added to the domain, not the prefered way...

Next month i want to roll out 400 Acad`s. Hotfix for this would be great 🙂

We do not see this probelm in other applications, and there is many of them...

 

steinars

Message 18 of 20

I know this is an older thread, but it appears to rearing it's ugly head again. I am seeing the same error with Windows 10 trying to install AutoCad 2018. We are using Kace K1000 to push the installer from a network share. I have also created a hash for Applocker for the installer. Any help will be appreciated.

Message 19 of 20

Hello,

I'm trying to install Autocad LT 2020 and I have the same issue : "The installation is forbidden by system policy. #389". An event 1008 is generated in Application : "The installation of C:\Users\xxx\Appdata\Local\Temp\xxxx\x64\acadlt\acadlt-x64dd.msi is not permitted du to an error in the software restriction policy processing. The object cannot be trusted."
After a lot of search, applocker is the cause. We have rules to deny launch of softwares installation from Appdata for normal users. Despite the fact that local administrators have no restriction and I added an exception (authorization) for this MSI, no change. No event is created in Event viewer/Application/Microsoft/Windows/Applocker).
The solution is to clear Applocker policy . When Applocker is off, installation works fine ....
According to this disccussion, it seems this issue was already present in Autocad 12 and solved in Autocad 13. The previous message appears to show this bug is come back with Autocad 18 !
Could you please create an update to fix this bug ? Turning off Applocker is not a solution ....

Message 20 of 20

@alain.xhrouet 

 

Welcome to the Autodesk User's Community..

 

This is mainly a user based support forum and even if Autodesk is monitoring postings, there are most likely not going to find your request to make a change.  Use this forum https://forums.autodesk.com/t5/install-update-deployment-ideas/idb-p/6016 and post an idea to change it..   Not going to say its going to happen but at least its more visual to Autodesk.

Mark Lancaster


  &  Autodesk Services MarketPlace Provider


Autodesk Inventor Certified Professional & not an Autodesk Employee


Likes is much appreciated if the information I have shared is helpful to you and/or others


Did this resolve your issue? Please accept it "As a Solution" so others may benefit from it.

Can't find what you're looking for? Ask the community or share your knowledge.

Post to forums  

Administrator Productivity


Autodesk Design & Make Report