WiX CustomAction with elevated privileges SCHTASKS “Access Denied”

Question

My installer currently installs a few files to a directory and then executes some CustomAction scripts to create 2 scheduled tasks named Script1 and Script2.

I have another 2 CustomAction scripts called RemoveScript1 and RemoveScript2.

They are all the same type 34 CA's with the following attributes:

<CustomAction Id="XXXXXX"
              Directory="AFolder"
              ExeCommand="XXXXXX"
              Execute="deferred"
              Impersonate="no"
              Return="asyncWait" />

And the following install sequence.

<InstallExecuteSequence>
  <Custom Action="RemoveScript1" Before="InstallFinalize" >REMOVE="ALL"</Custom>
  <Custom Action="RemoveScript2" Before="InstallFinalize" >REMOVE="ALL"</Custom>
  <Custom Action="Script1" Before="InstallFinalize" >(NOT Installed) OR MaintenanceMode="Modify"</Custom>
  <Custom Action="Script2" Before="InstallFinalize" >(NOT Installed) OR MaintenanceMode="Modify"</Custom>
</InstallExecuteSequence>

Example Create script:

SCHTASKS.exe /Create /TN NAME /TR "pathtosomeexe" /SC ONEVENT /EC System /MO *[System/EventID=XXXX] /F

Example Delete script:

SCHTASKS /Delete /TN NAME /F

The create scripts execute fine, however, the delete scripts do not seem to work. When checking the logs I see the following lines related to RemoveScriptX.

MSI (s) (60:B0) [17:20:49:555]: Doing action: RemoveScript1
Action start 17:20:49: RemoveScript1.
Action ended 17:20:49: RemoveScript1. Return value 1.
MSI (s) (60:B0) [17:20:49:649]: Executing op: ActionStart(Name=RemoveScript1,,)
MSI (s) (60:B0) [17:20:49:649]: Executing op: CustomActionSchedule(Action=RemoveScript1,ActionType=3234,Source=AFolder,Target=C:\Windows\SysWOW64\SCHTASKS.exe /Delete /TN NAME /F,)
1: RemoveScript1 2: 1631

When I try to delete these scripts created by the installer, using the normal command line, I get "ERROR: Access is denied." . Which is great! It means the scheduled tasks were created by admin. I can delete the task using the admin command line as expected.

If I create a task using the normal command line, I can delete it normally as expected.

I should note I have tried both InstallScope = perMachine, and perUser. The only difference it seems is that I have to run the actual installer as Admin for perUser to access ProgramFiles directory for the installation of the other files.

Why are my delete scripts not using admin/elevated privileges? Have I missed something stupid? I had assumed "1631" was the error code returned from SCHTASKS.exe, please correct me if I am wrong.

OS: Windows 10

WixVersion: 3.10

How are you creating the task in the first place? Likely the error is you are trying to delete a task from the system context which doesn't contain that task since it was made under the user's context during the install. If you put /RU "SYSTEM" in your SCHTASKS /CREATE it may solve this issue. — Brian Sutherland
I have just tried this. The task still creates, but it does not delete. It would seem the tasks do not create using "perMachine" without /RU "SYSTEM" though. — Top Rat
Not sure what the solution would be then, this was just a guess. It looks like there's logs for schtasks in C:\windows\tasks\schedlgu.txt if they exist they may shed more light on the issue. The error 1631 I think is just a generic custom action failed error. — Brian Sutherland
Unfortunately those logs do not exist. I will take another shot at it tomorrow and update my post accordingly. — Top Rat

Top Rat Top Rat · Accepted Answer · 2016-09-08T14:13:28

This may not be the ideal answer but it is how I solved the problem.

Instead of calling SCHTASKS with the arguments like so:

[SystemFolder]SCHTASKS.exe /Create /TN TASKNAME

I instead called POWERSHELL giving SCHTASKS and its arguments as follows:

[POWERSHELLEXE] &amp; SCHTASKS /Create /TN TASKNAME

I can't post the exact code I used for the powershell version as I moved on to using WiX QtExec http://wixtoolset.org/documentation/manual/v3/customactions/qtexec.html.

It requires putting the script into the attribute "Value" instead of "ExeCommand" used in the original question, and the formatting is a little different for each.

WiX CustomAction with elevated privileges SCHTASKS “Access Denied”

1 Answers