When I run setup.exe for 3DS Max Design 2011 or Navisworks 2011 on any of our domain connected Windows 7 machines, the program starts to initialise, but then comes up with the following message:
"This installation is forbidden by system policy. Contact your system administrator. #1"
followed by
"Fatal error during installation."
At which point setup.exe bombs out. In the Application Log, I get this message:
"The installation of C:\Users\username\AppData\Local\Temp\_random.tmp\SetupRes\eval.msi is not permitted due to an error in software restriction policy processing. The object cannot be trusted"
Source: MsiInstaller Event ID: 1008
I have confirmed that this is caused by Applocker as I have tested with a machine that has all policies except Applocker and it works, but as soon as Applocker is turned on I get this error. We use Applocker policies which have been set to allow Admins to run all Windows Installer Files, Executables and Scripts on any Path. The Applocker event log doesn't show any errors to suggest it's blocking the program, but something must be causing a knock on effect to this install. I can also confirm that I do have a Software Restriction Policy turned on that applies to all except Administrators. This policy doesn't have any actual restrictions in it, but it has been suggested elsewhere that this is a possible cause of this error.
I can confirm that if the product has already been packaged using the packaging tool within the setup program, that the package installs ok. Of course, we can only get to the packaging tool through the setup program which doesn't run on our Windows 7 machines.
Finally, I have seen another post similar to this that suggests taking the machine off of the domain and trying a fresh install. Unfortunately, this is not an option to our users.
Any help would be very gratefully received.
Solved! Go to Solution.
Noone of the Autodesk community volunteered an answer, but the Microsoft forum proved more fruitful:
Hi neilgwood;
I know this reply is a bit on the late side but my manager asked me to contact you to see if we can be of any assistance. I read through the discussions you have here and with Microsoft and see that you were able to work around this issue via modifying some registry entries. I haven't experienced too many customers using the AppLocker so I'm glad that you were able to get some assistance from Microsoft.
Were you looking for any change or modifications from the applicaiton end? If you would like any information or details form our end please let me know and we'll help as best as possible.
Dwayne
Hi Dwayne,
Thank you for getting in touch. As you have seen, I do now have a workaround so I can get Autodesk products to install, but workarounds are never as ideal as actual fixes. I'm not 100% sure if the problem is with Autodesk or Applocker, but I haven't experienced the same problems with any other product I've installed in our Windows 7 environment so that suggests to me that your installer works in a slightly different way. I also know that it's not a oddity with our group policies as someone else was able to replicate the problem without knowing our set up.
As such, I can't just say "fix your product", but I will respectfully request that you look at how your setup program initialises and works with Applocker. As previously mentioned, if a custom installation of the product has already been packaged for deployment using the option in your setup program then it installs with no issues and this uses the same setup.exe to run. However, if it's a new install from the CD (or a network stored copy of the CD) then the setup.exe starts to initialise and then fails with the errors mentioned.
Thanks again for looking into this.
Regards
Neil
Hi neilgwood
Sorry for the delay, took a small vacation. I will log a case for you today and investigate this on our end.
dwayne
Hello
i have the same problem with Autocad 2012
what is the workaround?
i have added the Autodesk certificate to our Applocker Polkicy,
but the eval.msi in the temp dir have no digital signature. Why?
we want deploy Autocad 2012 with our Software distribution on Windows 7 64 Enterprise
and to disable Applocker is no solution.
Have Autocad 2012 a windows 7 compatible logo, because i didn't find it in the Microsoft Library.
Hi All;
We are currently testing App Locker in greater detail. We're experiencing issues reproducing this consistantly. I have tested several applications through standard install as well as deployments and I haven't had any issues while App locker was enabled.
That being said we have a couple defects logged that were submitted that were currently investigating so these might turn up some information that might help. If they send updates shortly I'll update the forum
Dwayne
I have recenlty experienced this issue (after installing Win7 and all Autodesk socftware as recent as approximately six months ago) Now the error message appears and 2012 Autodesk software including AutoCAD Lite installatons are disallowed.
Please update this thread when a solution or workaround is available.
Additionally, I sent a request via Subscription Support pertaining to trying to resolve this issue.
Hi Clint,
The workaround we use is a batch file, shown below, which makes the registry changes as suggested in the Microsoft forum, then pauses so you can separately run the Autodesk installer and then set the keys back after the install.
Hope this helps
Neil
REG ADD HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Script /v EnforcementMode /t REG_DWORD /d 0 /f
REG ADD HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows\SrpV2\Script
/v EnforcementMode /t REG_DWORD /d 0 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Srp\Gp\Msi /v EnforcementMode /t REG_DWORD /d 0 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Srp\Gp\Msi /v EnabledAttributes /t REG_DWORD /d 0 /f
PAUSE
REG ADD HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Script /v EnforcementMode /t REG_DWORD /d 1 /f
REG ADD HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows\SrpV2\Script
/v EnforcementMode /t REG_DWORD /d 1 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Srp\Gp\Msi /v EnforcementMode /t REG_DWORD /d 1 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Srp\Gp\Msi /v EnabledAttributes /t REG_DWORD /d 1 /f
Can anyone provide an update on a resolution, not just a workaround?
I have installed 50+ other applications and have had no issues with Applocker. This problem is clearly related to Autodesk installers.
Thanks
Jeremy
Hello Neil,
The solution that you provided did not work. Thanks for sending the code.
Please keep all interested parties here updated on a solution
As you, I would like a resolution as I have no issues installing other non-Autodesk software.
Hi All;
I have ran several tests over here on several Autodesk applications and haven't had any issues so at this point I haven't been able to reproduce this issue. It's possible that the configuration / setup is a bit different. If you have any specific configuration you would be happy to test this out for you but at this point we have yet to reproduce so I can't offer a fix.
If you have subscription and would like to send us more details I would suggest logging a service request and the tech will gather information for the QA teams to see if they can offer any further information.
Dwayne
Thanks for the workaround. Made the batch file, ran it, install the program. Help me out a lot since this is for my college class.
----------------------------------
From: 3/6/2012
----------------------------------
Hi Jeremy,
Ok I've logged the defect and we'll just need the QA team to verify the defect which shouldn't take to long. I'll send any updates that they have for you.
Best regards,
Dwayne Poot
Autodesk Support Team
--------------------------------
From: 4/12/2012
---------------------------------
Hi Jeremy,
Unfortunately there hasn't been any updates from the developers. I have been working with the Maya developers since I was able to reproduce it but they haven't been able to find a fix for this.
I can't promise when the developers will have a update / work around for this. I think the only option at this point is to turn off the Applocker rules during the Autodesk installations.
Best regards,
Dwayne Poot
Autodesk Support Team
HI All;
I ran a few tests with the 2013 installers and they seem to install fine with AppLocker enabled with default rules turned on. Unfortunately some of the 2012 installers are still effected.
dwayne
Hi
I will just tell that even i am not able to install Autodesk 2013 product, neither made deployments with Applocker just installed and not activated in our european part of the domain (where we are located). (only Win 7 x64 available for test)
Today i will try with an virtual computer not added to the domain, not the prefered way...
Next month i want to roll out 400 Acad`s. Hotfix for this would be great 🙂
We do not see this probelm in other applications, and there is many of them...
steinars
I know this is an older thread, but it appears to rearing it's ugly head again. I am seeing the same error with Windows 10 trying to install AutoCad 2018. We are using Kace K1000 to push the installer from a network share. I have also created a hash for Applocker for the installer. Any help will be appreciated.
Hello,
I'm trying to install Autocad LT 2020 and I have the same issue : "The installation is forbidden by system policy. #389". An event 1008 is generated in Application : "The installation of C:\Users\xxx\Appdata\Local\Temp\xxxx\x64\acadlt\acadlt-x64dd.msi is not permitted du to an error in the software restriction policy processing. The object cannot be trusted."
After a lot of search, applocker is the cause. We have rules to deny launch of softwares installation from Appdata for normal users. Despite the fact that local administrators have no restriction and I added an exception (authorization) for this MSI, no change. No event is created in Event viewer/Application/Microsoft/Windows/Applocker).
The solution is to clear Applocker policy . When Applocker is off, installation works fine ....
According to this disccussion, it seems this issue was already present in Autocad 12 and solved in Autocad 13. The previous message appears to show this bug is come back with Autocad 18 !
Could you please create an update to fix this bug ? Turning off Applocker is not a solution ....
@Anonymous
Welcome to the Autodesk User's Community..
This is mainly a user based support forum and even if Autodesk is monitoring postings, there are most likely not going to find your request to make a change. Use this forum https://forums.autodesk.com/t5/install-update-deployment-ideas/idb-p/6016 and post an idea to change it.. Not going to say its going to happen but at least its more visual to Autodesk.
Mark Lancaster
& Autodesk Services MarketPlace Provider
Autodesk Inventor Certified Professional & not an Autodesk Employee
Likes is much appreciated if the information I have shared is helpful to you and/or others
Did this resolve your issue? Please accept it "As a Solution" so others may benefit from it.
Can't find what you're looking for? Ask the community or share your knowledge.