Summary

Behavior involves custom actions failing to run in a MSI installer package.

Symptoms

Custom action fails to run during the installation. The unexpected behavior exposed in a verbose Windows Installer log as: Lost connection to custom action server process. Attempting to regenerate.

When an install attempts to run your custom action fails to execute. The custom action terminates and the message in log file indicates:

MSI (c) : Invoking remote custom action.
MSI (c) : Lost connection to custom action server process. Attempting to regenerate.

Cause

With the possibility of a vulnerability, it may be intentional that Windows KB3139923 changes Windows Installer custom actions in the event KB3072630 is installed. The Windows KB3072630 is expected to change Windows Installer behavior and then fix a potential custom action vulnerability.

Furthermore, the Microsoft article for KB3072630 indicates:

"After you install this security update, the behavior of custom actions for accessing user hives in the registry will have changed. This security update more strictly enforces the requirement that only custom actions that use impersonation can access HKCU for the current user.

The following is the new behavior:

• Custom actions with impersonation can access HKCU for the current user.
• Custom action that run as System will access HKCU for System instead of HKCU for the current user.

After you install this security update, if you find that some registry keys in HKCU are no longer set by custom actions, you may have to re-design the MSI package so that this custom action is impersonated."

Steps To Reproduce

A Windows machine with Windows update KB3139923 installed.

Resolution

There are at least two approaches to address the unexpected behavior:

* Uninstall the update KB3139923.
* Apply Windows update KB3072630 after update KB3139923.

Additional Information

KB3072630 - MS15-074: Vulnerability in Windows Installer service could allow elevation of privilege: July 14, 2015

KB3139923 - Windows installer (MSI) repair doesn't work when MSI package is installed on an HTTP share in Windows

Microsoft Security Bulletin MS15-074 - Important

Related KB Articles

To create a verbose installer log see:

Logging an MSI Installation