Installation MSI 8.08.2 auf Server 2k3: Rollback

[virtualdreams]

Hallo,

ich versuche mittels des MSI-Installers die DekiWiki auf ein Win-Server 2k3 zu installieren. Leider schlägt die Installation jedoch ständig fehl mit einem Rollback am Ende. Die Fehlermeldung (falls man so nennen darf) ist sehr dürftig. Das MSI-Log sagt ebenso nichts aus. Über Hinweise bzw Hilfe würde ich mich sehr freuen.

Das System:
Windows Server 2k3 SP2
MySQL 5.067 (Non Strict mode)
IIS 6.0.3790.x

Mfg

[SteveB]

Bitter versuchen Sie es nochmals mit der folgenden command line:

msiexec /i MindTouchDeki.msi /l*v log.txt

Das macht sicher das alle Logmeldungen in den Log gehen.

[virtualdreams]

Damit hatte ich es bereits versucht. Ich könnte das log auch uploaden. Wo kann ich es hinschieben?

[SteveB]

Als Zip sollte es möglich sein das Log hier in den Forums zu uploaden. Anderseits, können Sie es auch of Ihrer Userseite uploaden: http://wiki.developer.mindtouch.com/User:virtualdreams

[virtualdreams]

OK, hab das Logfile als zip auf meiner Userseite hochgeladen.

Hoffe das irgendetwas daraus hervorgeht.

Mfg

[brigettek]

Thank you for posting your log! Everything looks good until the installer attempts to grant NT AUTHORITY\NETWORK SERVICE access to one of our directories. At this point, the following error occurs:

ExecSecureObjects: Error 0x800706fd: failed to get sid for account: NT AUTHORITY\NETWORK SERVICE

It can't seem to find NT AUTHORITY\NETWORK SERVICE. According to msdn, NT AUTHORITY\NETWORK SERVICE is the built-in account name in all locales. However, I suspect this might be getting localized to german.

Next Steps:
You could try checking if you are able to access this account from the Windows Groups management control panel. Pick a group (such as Guests, Administrators, or something) and attempt to add NETWORK SERVICE to the group. You should see it come back with: NT AUTHORITY\NETWORK SERVICE (S-1-5-20). If that doesn't work, try it with NETZWERKDIENST. This will confirm if localization is the issue.

If this is the problem, I've posted a potential fix here. Since it's a test build, I recommend removing it once you've verified whether it fixes the problem.

[crb]

Stupid question (and in English too, sorry): can you grant access to the IIS_WPG group, or use the well-known SID for network service, instead?

[brigettek]

The built-in wix custom action support for permissions doesn't seem to take a sid (PermissionEx).

As for IIS_WPG, I believe there were issues with the domain name... something with computers connected to active directory having a different value other than the local machine name. This might also be something that only comes up with the wix custom action. Network service worked better since it didn't have this dependancy.

I could write a new custom action for setting permissions, but I would rather use the built-in if possible. Wix should handle the localization with the latest tweak (going from "Network Service" to "NetworkService" is all that needed to change).

[crb]

Yeah, domains tend to have an IIS_WPG group as well as local machines. I tend to try and use the local IIS_WPG for permission assignments as people at my current employer have a habit of setting the application pool to run as a different user. I believe that IIS requires any account which runs a process (application pool) be a member of the IIS_WPG group, and then assigns permission for things like "writing to the event log" to that group.

My knowledge only applies to IIS6 also, so I could be way off base for what is necessary for 7.

[brigettek]

My memory is fuzzy, but it was either a problem were wix wasn't able to find the local IIS_WPG account when connected to active directory or the application pool was using the domain IIS_WPG, but the permission grant used the local IIS_WPG. Something along those lines.

Since Network Service is a member of IIS_WPG, it seemed to be a decent replacement... although the user could change the MSI-configured Deki application pool to run as a different user in IIS_WPG and it would subsequently break. If you deem it worthwhile, file a tracking item and I can investigate switching back to IIS_WPG.