Has Windows-Installer always admin-rights?

[Dominikus Ernst]

Hello,

I found out, that it is possible to launch a repair-installation-routine of
Acrobat Reader 7.0.7 on WinXP-ProSP2 as restricted user, by using the
MSI-File under C:\Program Files\Adobe\Acrobat 7.0\Setup Files\RdrBig705.
I noticed that by using gpedit.msc one can change the behaviour of windows
installer, both under "user-templates" (?) and "Computer templates"
/Administration Templates/Windows-Components/Windows Installer (? translated
from German...). However, even by deactivating the option to run the
Windows-Installer with elevated rights under both "user-templates" and
"Computer-Templates", the repair Installation was still possible. My
questions in detail:
-Have all MSI-packages full administrator-rights?
-Isn't that dangerous? Couldn't come malware as MSI-packages and then could
be installed by anyone even under LUA?
-Are there restrictions like only installations wich has been installed
previously get elevated rights?
- How can I prohibit restricted users from being allowed to install any
MSI-packages, while admins are still allowed to do so?

Thanks in advance!

 

[Steven L Umbach]

MSI packages do not have system powers unless always install with elevated
privileges is enabled. Offhand I don't know why that application can be
repaired unless Windows allows such once an application is installed or
unless the MSI package has been assigned/published via Group Policy Software
Installation at the domain level . What I would do is to logon as a regular
user and try to install a new application to see if that can be done
assuming that the application is not published via Group Policy Software
Installation. --- Steve