MSI Install on Terminal Server - getting error Custom Action Server rejected - Wrong Context

问题

When trying to install a software on a terminal server, we get the following error. Any help is appreciated.

msi install log shows the following error:

MSI (s) (1C:04) [07:27:28:750]: Executing op: ActionStart(Name=InstallODBC,Description=Installing ODBC components,)
Action 7:27:28: InstallODBC. Installing ODBC components
MSI (s) (1C:04) [07:27:28:750]: Executing op: ODBCInstallDriver(DriverKey=Microsoft FoxPro VFP Driver (*.dbf),Component={612B3EFA-F178-4C50-A049-B99BE6DCACE0},Folder=C:\Windows\SysWOW64\,Attribute_=Driver,Value_=vfpodbc.dll)
1: Microsoft FoxPro VFP Driver (*.dbf) 2: {612B3EFA-F178-4C50-A049-B99BE6DCACE0} 3: C:\Windows\SysWOW64\ 4: Driver 5: vfpodbc.dll 6: Setup 7: vfpodbc.dll 8: ConnectFunctions 9: YYN 10: SQLLevel 11: 0 12: APILevel 13: 0 14: FileUsage 15: 1 16: DriverODBCVer 17: 02.50 18: FileExtns 19: *.dbf,*.cdx,*.idx,*.fpt 
MSI (s) (1C:5C) [07:27:28:750]: Generating random cookie.
MSI (s) (1C:5C) [07:27:28:766]: Created Custom Action Server with PID 1876 (0x754).
MSI (s) (1C:10) [07:27:28:797]: Running as a service.
MSI (s) (1C:10) [07:27:28:797]: Custom Action Server rejected - Wrong Context
MSI (s) (1C:5C) [07:27:28:797]: CA Server Process has terminated.
MSI (s) (1C:04) [07:27:28:797]: Failed to get IMsiCustomAction*
Action ended 7:27:29: InstallFinalize. Return value 3.

At the very same time, process monitor log shows that installer process msiexec is trying a RegOpenKey on HKey_Users\S-1-5-18 which is the Local System user. and the result shown is BAD IMPERSONATION.

I have looked up KB3072630 - but it did not apply to our machine. Plus, i tried the MS workaround to add a registry key and that did not help either.

My error is similar to: https://community.flexerasoftware.com/showthread.php?219987-Microsoft-KB3072630-update-impact-on-InstallOCBC-action&s=8250ec9cbe80dab42bf7b49dcf86077c

回答1:

Yes, that is a classic issue - the terminal server aware custom action issue. Do you need that component, or can you just rip it out? I guess you did for testing already. UPDATE: I see you need it for other components as well.

It has been years since I looked at terminal server installations, but the MSI SDK has some brief sections on it:

• Using Windows Installer with a Terminal Server. There are many challenges centering around per-user data and custom action impersonation and much more. If you have a team taking care of this normally I would get them to do it - just a waste of time otherwise?
• Just want to add that last time I checked self-repair is normally disabled on terminal servers so you can't use self-repair to put data in place per-user, unless you use special terminal server means to do so.

• There is a flag added to mark custom actions terminal server aware. Some custom actions should probably just be disabled - since they might do crazy stuff that will never work anyway. Has to be determined in each case.

  • To disable a custom action: make a transform and set the condition to 0 or if there is a condition already, add: AND 0 to it. That should disable the custom action.

  • Looking up the msidbCustomActionTypeTSAware flag in the Magic Number Database:

    • https://www.magnumdb.com/search?q=msidbCustomActionTypeTSAware
    • msidbCustomActionTypeTSAware = 0x00004000, // impersonate for per-machine installs on TS machines
    • (just showing you this resource, you see the flag in the second link above)

Deferred custom actions run in the context of the local system unless the action has the msidbCustomActionTypeTSAware attribute. This is true even if the custom action impersonates the user on a system that is not a terminal server. Note that if a custom action having the msidbCustomActionTypeTSAware attribute changes the user's registry, the installer does not automatically ensure that those changes are also made in the registry of every user on the computer.

So I suppose you can hotfix the Custom Action Table entries for the custom actions in question and see what happens. I suppose you add 4000 as shown here: Custom Action In-Script Execution Options. The per-user data added will supposedly not make it into all user hives.

来源：https://stackoverflow.com/questions/53048312/msi-install-on-terminal-server-getting-error-custom-action-server-rejected-w