CSCF: MSI Packages and Local Windows Accounts

All MSI packaged software normally contains two sets of components which are applied by the Windows Installer service on any local PC. Inspite of the minor significance of the User Components, if they can not be applied to the user's profile when the programme is first run, the Windows Installer will cancel the run attempt. The user can not run the application. Therefore, it is very important that each user must have read access to the source MSI file from where the computer installed the Computer Components of the package.

Currently, all CSCF MSI packages are maintained on a redundant domain share created by our domain controllers. All domain users can be granted access to this share as well as the SYSTEM account for all domain member computers. Unfortunately, we've been unable to grant local user accounts from domain computers access to this share.

The practical upshot of that deficiency is that some of our MSI packaged software can not be used by local workstation accounts. For example, Mozilla FireFox and Symantec Antivirus both want to install user components upon startup. Unfortunately, since CSCF has already given default support for local workstation accounts on CSCF Standard Windows Workstations, this is a problem we can not ignore by saying that only domain accounts are valid.

After much research and consulting (and head bashing), we now have some standard packaging practices for reducing these types of application startup failures. The goal in all of these steps is to ensure that the Windows Installer never attempts to contact the source MSI for a package when any common user runs the application.