MSI 错误“必须信任计算机才能进行委派"由 KB2918614 引起 [英] MSI Error "The computer must be trusted for delegation" caused by KB2918614
问题描述
我们有一个基于 MSI 的安装程序，它最近在 Windows 2008 R2 环境中停止工作.安装程序使用 \\servername\c$\ admin UNC 共享复制到目标计算机，然后使用 WMI Win32_Process 类.远程执行现在失败，并在事件查看器中显示以下错误消息:
We have an MSI based installer that recently stopped working on a Windows 2008 R2 environment. The installer is copied over to the target computer using the \\servername\c$\ admin UNC shares and then is remotely executed using the create method on the WMI Win32_Process class. The remote execution now fails with the following error message in the Event Viewer:
来自 MsiInstaller 的事件 ID 10837 的描述不能成立.未安装引发此事件的组件您的本地计算机或安装已损坏.你可以安装或修复本地计算机上的组件.
The description for Event ID 10837 from source MsiInstaller cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
如果事件起源于另一台计算机，则显示信息必须与事件一起保存.
If the event originated on another computer, the display information had to be saved with the event.
活动中包含以下信息:
产品:我们的产品名称 -- 请求的操作不能完成.必须信任计算机才能进行委派和当前用户帐户必须配置为允许委派.
Product: OUR PRODUCT NAME -- The requested operation cannot be completed. The computer must be trusted for delegation and the current user account must be configured to allow delegation.
经过搜索，看起来这是由最近发布的Windows Installer 安全补丁引起的.当我卸载 KB2918614 时，安装程序会再次开始工作，如果我重新安装 KB2918614MSI 再次停止工作.
After searching it looks like this is caused by a recently released security patch for Windows Installer. When I uninstall KB2918614 the installer starts working again, and if I reinstall KB2918614 the MSI stops working again.
该错误消息表明，要解决该问题，我们必须让域管理员使用 Active Directory 用户和计算机 允许委派，但是 MSI 不使用任何远程资源，所以我不明白为什么需要这样做.相同的 MSI 和远程执行过程在 Windows Server 2012 上运行良好，所以我想知道这是否是 2008 R2 补丁的问题.
The error message indicates that to solve the issue we would have to have a Domain Administrator edit the target computer using Active Directory Users and Computers to allow delegation, however the MSI is NOT using any remote resources, so I don't see why this is required. The same MSI and remote execution process works fine on Windows Server 2012, so I wonder if this is an issue with the patch for 2008 R2.
是否有其他方法可以绕过此错误消息?
Are there any other ways to get around this error message?
更新:这似乎不是 WMI 远程执行的问题，因为当我们尝试使用 Powershell、WinRM 和 Invoke-Commmand 远程安装 MSI 时也会发生这种情况-ComputerName TargetComputer ... cmdlet.安装 KB2918614 后，2008 R2 上的 Windows 安装程序的工作方式发生了变化，现在阻止自定义操作完成其任务.
UPDATE: This doesnt appear to be an issue with the WMI remote execution, as it also occurs when we try to install the MSI remotely using Powershell, WinRM, and the Invoke-Commmand -ComputerName TargetComputer ... cmdlet. There is a change in the way the Windows Installer on 2008 R2 works after installing KB2918614 that now prevents the custom action from completing it's task.
推荐答案
据我所知，
通过 KB2918614，MS 显然试图修复 Windows 安装程序服务中的某些内容.
With KB2918614, MS have apparently tried to fix something in the Windows Installer Service.
- 他们正在创建一个名为SourceHash{PRODUCT-GUID}"的文件%windir%\Windows\安装程序.这是为每个安装的产品完成的在机器上(已安装 KB2918614).
- SECREPAIR - 他们正在计算给定 MSI 的存储哈希值"和当前哈希值".
而且，在这个比较中，出于某种原因，这些不匹配！(在 MSI 详细日志中找到这些).
And, in this comparison, for some reason, these mismatch! (Found these in the MSI verbose logs).
一旦失败，它会寻找机器策略值AlwaysInstallElevated"用户策略值AlwaysInstallElevated"
Once this fails, it looks for Machine policy value 'AlwaysInstallElevated' User policy value 'AlwaysInstallElevated'
现在，如果您正在运行静默安装qn"，则会引发此错误:MSI_LUA:静默安装已禁用提升提示.
Now, if you are running a silent install "qn", this error is thrown: MSI_LUA: Elevation prompt disabled for silent installs.
附加信息:
我的 MSI 通过引导程序 exe 进行 ivkoded.但是，这真的无所谓.甚至通过 cmd 行手动调用 msiexec 的行为也相同.
Additional Info:
My MSI is ivkoded through a bootstrapper exe. But, it doesn't really matter. Even a manual call to msiexec through cmd line behaves the same way.
任何输入/解决方案，任何人?
Any inputs/solutions, anyone?
这篇关于MSI 错误“必须信任计算机才能进行委派"由 KB2918614 引起的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
