Loading
Win 11 Smart App Control (SAC) issues with InstallShield InstallScript projects and PS Custom actions

Windows 11 has a new security functionality known as SAC - https://support.microsoft.com/en-gb/topic/what-is-smart-app-control-285ea03d-fa88-4d56-882e-6698afdb7003

InstallShield does not complies with Win11 SAC.

 

InstallScript projects or Projects with PowerShell Custom Actions create an intermediate unsigned .tmp file during installation/uninstallation action, and tries to execute the same.

 

These .tmp files have random names on each execution. They cannot be whitelisted with Microsoft SAC.

Since these InstallShield created temporary files don't have a digital signature, these cannot be trusted by Microsoft SAC as the publisher of the file cannot be verified/trusted.

 

We are expecting an esteemed organization like InstallShield to prioritize looking into this issue and provide a resolution to its users in a fast paced manner.

Attached images for reference.

SAC2.png

 

 


rogersmot likes this.
  • Has any progress been made with this? We recently had a report that one of our InstallShield setup programs won't work with Smart App Control because the MSI isn't digitally signed. I presume that MSI is the TMP file mentioned here because we don't bundle an MSI file in it.

     

    Is the solution to create an MSI file that is digitally signed and skip the more advanced InstallShield interface?

    Expand Post
  • I'm hitting the same issue as Prateek, which is not the signed MSI issue that DataAnalyzer mentioned. Preface: My installer (Basic MSI) is pretty straightforward but makes heavy use of InstallScript. All of my install files, including the msi, mst, and exe files are all digitally signed.

     

    Here is what I've observed:

    • Launch my setup.exe which explodes my .msi and other files into a temporary directory
    • During runtime of my installer, InstallShield will create temporary files, e.g. MSIE9FC.tmp, when it needs to execute InstallScript
    • I analyzed these .tmp files (I quickly copied them out before the automatically disappeared) and they're just DLLs, but they are NOT renamed DLLs. It's like InstallShield creates them on the fly by stitching together other files.
    • These .tmp files (e.g. MSIE9FC.tmp) are unsigned which makes sense since they are created on-the-fly.
    • Windows SAC will **sometimes** block loading these .tmp files causing this popup:
    • image
    • I do not know why SAC sometimes blocks this, but sometimes allows it.

     

    I'm not too sure how to proceed. Are Prateek and I the only ones hitting this problem?

     

     

    Expand Post

Loading
Win 11 Smart App Control (SAC) issues with InstallShield InstallScript projects and PS Custom actions