Use of "icons\quicklaunch" install option, while executing under system account causes hang

[DarwinJS]

This is not strictly a bug as removing an install option will remedy it - however - it is a very likely stumbling block for anyone automating the installation of git since many automated deployment systems (chef, puppet) run under system account when deployed as a service or in a headless mode. Two suggestions for resolution are included.

Reproduction Steps:

Originally done on Server 2012 R2 - but I am 99% sure this is not OS specific.
Git installer was [https://github.com/git-for-windows/git/releases/download/v2.6.3.windows.1/Git-2.6.3-64-bit.exe]

1. Optionally use procmon.exe to trace this setup.
2. Start and ELEVATED CMD.exe prompt.
3. Use psexec.exe -s to trigger the git installer in system account context (same as most automated deployment systems use) ([http://live.sysinternals.com/psexec.exe]) as such - use the full path as the context switch to system account does not support relative paths:
   psexec -s FULLPATH/Git-2.6.3-64-bit.exe /VERYSILENT /NORESTART /NOCANCEL /SP- /NOICONS /COMPONENTS="icons,icons\quicklaunch,ext,ext\reg,ext\reg\shellhere,ext\reg\guihere,assoc,assoc_sh" /LOG
4. Observe that the installer stalls.
5. In "c:\windows\temp\Setup Log Fixes for the new SDK #1.txt" note the error "Message box (OK): Runtime Error (at 180:8204): IPersistFile::Save failed; code 0x80070003. The system cannot find the path specified."
6. If you did the optional procmon trace, notice troubles trying to create "c:\windows\syswow64\config\systemprofile\appdata\roaming\microsoft\internet explorer\quick launch\git bash.lnk"
   Note: The installer being used must be a 32-bit exe for this to reference syswow64. If there are 32-bit binaries in the 64-bit install, it is probably most compatible to leave the installer a 32-bit setup.exe.
7. Examine the system to see that path "c:\windows\syswow64\config\systemprofile\appdata\roaming\microsoft\internet explorer\quick launch" does not exist.

Counter test - removing command line option for quicklaunch:

You can either start with a clean VM image to ensure not leftovers from your prior run of setup and your investigation (which will require permissions changes on some folders) or use the same machine you just tested on - either way the test comes out the same.

1. Start and ELEVATED CMD.exe prompt.
2. Use psexec.exe -s to trigger the git installer in system account context (same as most automated deployment systems use) ([http://live.sysinternals.com/psexec.exe]) as such - use the full path as the context switch to system account does not support relative paths:
   psexec -s \v2.6.3.windows.1/Git-2.6.3-64-bit.exe /VERYSILENT /NORESTART /NOCANCEL /SP- /NOICONS /COMPONENTS="icons,ext,ext\reg,ext\reg\shellhere,ext\reg\guihere,assoc,assoc_sh" /LOG
3. In "c:\windows\temp\Setup Log t9300: use test_cmp_bin instead of test_cmp to compare binary files #2.txt" note a successful install.

Screenshots are below.

Suggested remedies for installer:

1. Option 1: Heavily document this limitation (though it will likely get missed again and again)
2. Option 2: In installer, detect system account and strip off argument "icons\quickstart" if it exists. Note this action and reason for such in log.

Suggested Immediate remedy for Chocolatey Package:

1. Option 1: Remove command line option 'icons/quickstart' from chocolatey package for all installs.
2. Option 2: Strip off 'icons/quickstart' if system account is detected. PowerShell detection code '(([System.Security.Principal.WindowsIdentity]::GetCurrent()).IsSystem'

I am willing to perform chocolatey remedies if it is ok to make me co-maintainer of the package.

Screenshots

[ferventcoder]

@DarwinJS We've pulled out those options in the Chocolatey package and folks have asked for them back. Now we have a good reason for them not to be there. I created ferventcoder/chocolatey-packages#103 for you to follow up with for Chocolatey.

[DarwinJS]

Ok - so stripping the that install option upon discovery of running under system account seems like the middle ground that would satisfy both requirements? FYI - the regular start menu shortcuts go down fine.

When you say "follow up on" - do you mean discuss options over there or do you mean fix the package?

[ferventcoder]

@DarwinJS fix. 👍

[DarwinJS]

I hate to ask this :( - is there any chance to change my chocolatey ID from Darwin_CSIWindowscom to DarwinJS ?

If not, no problem - please add Darwin_CSIWindowscom to chocolatey maintainers and DarwinJS (github) to chocolatey source for relevant git choco packages.

D.

[DarwinJS]

Rob - could use a few pointers on how to get started - *) choco source, *) whether you want me to update the choco source directly - if not, what is the procedure to follow to submit my source, *) whether you want me to update the choco package directly.

[ferventcoder]

@DarwinJS Please follow up on the actual issue that I linked here so this discussion can be about only the git installer making any adjustments necessary.

[dscho]

Option 2: Strip off 'icons/quickstart' if system account is detected. PowerShell detection code '(([System.Security.Principal.WindowsIdentity]::GetCurrent()).IsSystem'

Apart from PowerShell not being an option for use in InnoSetup, it looks as if you already have a pretty good head start on a Pull Request. So why not making that Pull Request directly?

[fabio-porcedda]

I've installed the latest version available (git 1.7.2) on Windows 10 from a user account and it still doesn't icons, it is the expect behavior?

Thanks a lot for your hard work.

[DarwinJS]

FYI - the above solutions I suggested have been implemented in the Chocolatey package for git - so when git is installed with chocolatey it will succeed under the system account.

[fabio-porcedda]

Never mind, even using the git official installer i'm unable to add the icons. At least for me is a problem with the official git installer.

[dscho]

It is really funny that this should still be a problem, as it was fixed and the fix made it into Git for Windows v2.7.0, released on January 5th.

But I guess the more recent comments complained about a lack of the quicklaunch icons option (in which case the rationale for not offering that choice was ignored).

So I am finally closing this.