Classic Shell: Forum

Hi,
"The system administrator has set policies to prevent this installation"
when I attempt to install v4.3.1 on the Anniversary build 14393.1593 (latest)

However v4.3.0 (re)-installs without problems.

I've been using Classic Shell on Win 10 Pro x64 and earlier for some years.

Some have installed v4.3.1 on the AU without problems, but I noted a comment here that 4.3.1 was supported on the Creator's build. One user reported v4.3.1 wouldn't install and gave an error message, but hasn't quoted it yet.

Thoughts welcomed.. thanks.

Try downloading again. I accidentally used the old certificate (the same as 4.3.0) instead of the new one.
It is also possible your problem is related to smart screen or other heuristic that is naturally suspicious of new and unknown software.

Hi, thanks, just tried that.. same result alas. Even tried 'Run as admin', disabling UAC and Avast.

Well, you need to figure out what policy is actually preventing the installation. Then we can try to figure out how to proceed.

@dal987, try this: https://answers.microsoft.com/en-us/win ... 2d244119b8

_________________
Links to some general topics:

● Compare Start Menus

● Read the Search box usage guide.

I am a Windows enthusiast and did Classic Shell's testing and usability/UX feedback.

Thanks. I will have to ask someone on tenforums if they can post such as this is my only Win 10 PC.

Installation works fine- except for v 4.3.1.

I can confirm other msi's run normally.

Here is the installation log for 4.3.1, and below that for 4.3.0:

=== Verbose logging started: 14/08/17 06:55:08 Build type: SHIP UNICODE 5.00.10011.00 Calling process: C:\Windows\SysWOW64\msiexec.exe ===
MSI (c) (F4:74) [06:55:08:995]: Font created. Charset: Req=0, Ret=0, Font: Req=MS Shell Dlg, Ret=MS Shell Dlg

MSI (c) (F4:74) [06:55:08:995]: Font created. Charset: Req=0, Ret=0, Font: Req=MS Shell Dlg, Ret=MS Shell Dlg

MSI (c) (F4:E8) [06:55:09:057]: Resetting cached policy values
MSI (c) (F4:E8) [06:55:09:057]: Machine policy value 'Debug' is 7
MSI (c) (F4:E8) [06:55:09:057]: ******* RunEngine:
******* Product: C:\ProgramData\ClassicShellSetup64_4_3_1.msi
******* Action:
******* CommandLine:
MSI (c) (F4:E8) [06:55:09:104]: Machine policy value 'DisableUserInstalls' is 0
MSI (c) (F4:E8) [06:55:09:229]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'C:\ProgramData\ClassicShellSetup64_4_3_1.msi' against software restriction policy
MSI (c) (F4:E8) [06:55:09:229]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\ClassicShellSetup64_4_3_1.msi has a digital signature
MSI (c) (F4:E8) [06:55:09:932]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\ClassicShellSetup64_4_3_1.msi is not permitted to run at the 'unrestricted' authorization level.
MSI (c) (F4:E8) [06:55:09:932]: SOFTWARE RESTRICTION POLICY: The path rule '{3CBE1D05-2ADC-4572-9B07-3711C065D3CB}' with image name 'C:\ProgramData\*.msi' in the default software restriction machine policy disallows execution. The returned execution level was 0
MSI (c) (F4:E8) [06:55:09:932]: The installation of C:\ProgramData\ClassicShellSetup64_4_3_1.msi is not permitted by software restriction policy. The Windows Installer only allows installation of unrestricted items. The authorization level returned by software restriction policy was 0x0 (status return 0x0).

MSI (c) (F4:E8) [06:55:09:932]: Note: 1: 1718 2: C:\ProgramData\ClassicShellSetup64_4_3_1.msi
MSI (c) (F4:E8) [06:55:09:932]: MainEngineThread is returning 1625
=== Verbose logging stopped: 14/08/17 06:55:09 ===


=== Verbose logging started: 14/08/17 07:08:47 Build type: SHIP UNICODE 5.00.10011.00 Calling process: C:\Windows\SysWOW64\msiexec.exe ===
MSI (c) (E0:40) [07:08:47:892]: Font created. Charset: Req=0, Ret=0, Font: Req=MS Shell Dlg, Ret=MS Shell Dlg

MSI (c) (E0:40) [07:08:47:892]: Font created. Charset: Req=0, Ret=0, Font: Req=MS Shell Dlg, Ret=MS Shell Dlg

MSI (c) (E0:0C) [07:08:47:954]: Resetting cached policy values
MSI (c) (E0:0C) [07:08:47:954]: Machine policy value 'Debug' is 7
MSI (c) (E0:0C) [07:08:47:954]: ******* RunEngine:
******* Product: C:\ProgramData\ClassicShellSetup64_4_3_0.msi
******* Action:
******* CommandLine:
MSI (c) (E0:0C) [07:08:48:001]: Machine policy value 'DisableUserInstalls' is 0
MSI (c) (E0:0C) [07:08:49:048]: Cloaking enabled.
MSI (c) (E0:0C) [07:08:49:048]: Attempting to enable all disabled privileges before calling Install on Server
MSI (c) (E0:0C) [07:08:49:048]: End dialog not enabled
MSI (c) (E0:0C) [07:08:49:048]: Original package ==> C:\ProgramData\ClassicShellSetup64_4_3_0.msi
MSI (c) (E0:0C) [07:08:49:048]: Package we're running from ==> C:\Windows\Installer\73966d.msi
MSI (c) (E0:0C) [07:08:49:064]: APPCOMPAT: Uninstall Flags override found.
MSI (c) (E0:0C) [07:08:49:064]: APPCOMPAT: Uninstall VersionNT override found.
MSI (c) (E0:0C) [07:08:49:064]: APPCOMPAT: Uninstall ServicePackLevel override found.
MSI (c) (E0:0C) [07:08:49:064]: APPCOMPAT: looking for appcompat database entry with ProductCode '{383BB30A-B4A7-4666-9A83-22CFA8640097}'.
MSI (c) (E0:0C) [07:08:49:064]: APPCOMPAT: no matching ProductCode found in database.
MSI (c) (E0:0C) [07:08:49:423]: MSCOREE not loaded loading copy from system32
MSI (c) (E0:0C) [07:08:49:470]: Machine policy value 'DisablePatch' is 0
MSI (c) (E0:0C) [07:08:49:470]: Machine policy value 'AllowLockdownPatch' is 0
MSI (c) (E0:0C) [07:08:49:470]: Machine policy value 'DisableMsi' is 0
MSI (c) (E0:0C) [07:08:49:470]: Machine policy value 'AlwaysInstallElevated' is 0
MSI (c) (E0:0C) [07:08:49:470]: User policy value 'AlwaysInstallElevated' is 0
MSI (c) (E0:0C) [07:08:49:470]: Product {383BB30A-B4A7-4666-9A83-22CFA8640097} is admin assigned: LocalSystem owns the publish key.
MSI (c) (E0:0C) [07:08:49:470]: Product {383BB30A-B4A7-4666-9A83-22CFA8640097} is managed.
MSI (c) (E0:0C) [07:08:49:470]: Running product '{383BB30A-B4A7-4666-9A83-22CFA8640097}' with elevated privileges: Product is assigned.
MSI (c) (E0:0C) [07:08:49:470]: Machine policy value 'DisableLUAPatching' is 0
MSI (c) (E0:0C) [07:08:49:470]: Machine policy value 'DisableFlyWeightPatching' is 0
MSI (c) (E0:0C) [07:08:49:470]: APPCOMPAT: looking for appcompat database entry with ProductCode '{383BB30A-B4A7-4666-9A83-22CFA8640097}'.
MSI (c) (E0:0C) [07:08:49:470]: APPCOMPAT: no matching ProductCode found in database.
MSI (c) (E0:0C) [07:08:49:470]: Transforms are not secure.
MSI (c) (E0:0C) [07:08:49:470]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'C:\Users\David\AppData\Local\Temp\MSI577db.LOG'.
MSI (c) (E0:0C) [07:08:49:470]: Command Line: CURRENTDIRECTORY=E:\Downloads CLIENTUILEVEL=0 CLIENTPROCESSID=16352
MSI (c) (E0:0C) [07:08:49:470]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{5DF2A896-2547-4DAB-B4C5-53AA5E21A689}'.

After downloading the EXE installer, have you unblocked it? Windows adds zone information to it if it came from the internet.

_________________
Links to some general topics:

● Compare Start Menus

● Read the Search box usage guide.

I am a Windows enthusiast and did Classic Shell's testing and usability/UX feedback.

Unblock? Er... sorry, how? Where?

I've read about this for zip files.

There's no unblock button in the Properties sheets...

If there is no Unblock button in Properties, then the problem is something else.

_________________
Links to some general topics:

● Compare Start Menus

● Read the Search box usage guide.

I am a Windows enthusiast and did Classic Shell's testing and usability/UX feedback.

** I have snatched a copy of the msi file from C:\ProgramData\ClassicShellSetup64_4_3_1.msi and copied it to my desktop.

This msi runs ok from my desktop.

The install log shows that for this version
SOFTWARE RESTRICTION POLICY: The path rule '{3CBE1D05-2ADC-4572-9B07-3711C065D3CB}' with image name 'C:\ProgramData\*.msi' in the default software restriction machine policy disallows execution.

Now note that is *.msi

This seems puzzling, as v4.3.0 also creates
C:\ProgramData\ClassicShellSetup64_4_3_0.msi

Purely on the basis of the two logs, it is not clear to me why one is restricted, but the other not.

Any idea how to identify this:
SOFTWARE RESTRICTION POLICY: The path rule '{3CBE1D05-2ADC-4572-9B07-3711C065D3CB}' ?

Thanks!

You could check Gpedit.msc -> Windows Settings -> Security Settings -> Software Restriction Policies. Did you use any app to tweak or modify Windows settings?

_________________
Links to some general topics:

● Compare Start Menus

● Read the Search box usage guide.

I am a Windows enthusiast and did Classic Shell's testing and usability/UX feedback.

Hi, thanks, that shows there are none such in force, and I've not knowingly set any.

As I noted, it seems strange that the msi for 4.3.0 runs, whilst that for 4.3.1 doesn't, when the restriction reported for the latter applies to *.msi in that location.

There must be some difference between the two that is triggering this restriction. But I don't know where the restriction might be defined.

I've found the restriction. It's set by an anti-ransomware program, Cyptoprevent.

Screenshot of registry keys attached.

I found that by searching the registry for 3CBE1D05-2ADC-4572-9B07-3711C065D3CB from the installer log.

But I can't see why v4.3.0 is unaffected.

Possibly this is some sort of reputation system, similar to smart screen or Norton AV. Once a file is installed by large number of people, it gains reputation that unblocks it.

Hi, not as far as I can see from its settings (see attached) - there's a specific rule which I would have thought would have applied not just to this version of CS, but to previous ones. Clearly something I don't understand or haven't yet come across.

I've tried adding an exclusion.

Anyway, if someone else has a similar problem, we know more! Thanks for your time, and a great program that puts MS to shame (did you know Win 10's start menu strips shortcuts out of start menu folders more than about 3 deep in a folder tree, and lists them alphabetically.. think

Help Help Help Help Help..... Readme Readme Readme... -each from a separate program).