Windows 7 MSI Fix Raisers Edge All Users MSILockPermissions

Jump to: navigation, search

Pretty simple fix for this.

CreateFolder Table

CreateFolder Table
  • Sets directories for MSILockPermissions to set permissions on (cant use references in Directory table, need specifying here)

Inifile Table

Inifile Table
  • Adds relevant settings into the BBupdate.ini

Edit deploy.ini

Deploy.ini in the installer ALSO needs altering to match BBupdate.ini values as this sets the ODBC settings in HKLM during the install, which a user doesn't have permissions to change.

Description=RE7 Development
ClientName=RE7 Development

MSILockPermissionsEx Table

MSILockPermissionsEx Table

Sets permissions on files/folders/registry - in this example on folders using SDDL.

This is a generic 'Program Files' permission plus Users having write.

Dont use with LockPermissions table, need one or other.

MSILockPermissionsEx needs Windows Installer v5 (Windows 7)

This table isn't in Insted, you will need ORCA >= 5 to add the table (you can enter it manually in Insted but its a bit of a faff). Once done you can alter it all normally in Insted.

subinacl examples for SDDL

Subinacl.exe /keyreg "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Blackbaud" /display=sddl

Subinacl.exe /file "C:\Program Files (x86)" /display=sddl

Note, Don't forget to strip off any non generic SID's! like S-xx-xx-xxxxxxxxxxxxxxxxx

Registry Table

Registry Table
  • Register the RE7Outlook.dll (this is equivalent of 'c:\windows\SysWOW64\regsvr32.exe RE7Outlook.dll') into HKR (Root = 0)
  • Add RE7 Outlook addin to HKLM (Root=2) rather than HKU

Shortcut Table

Shortcut Table
  • Delete desktop shortcuts

Silent install

Sample batch file

@echo off
::Raisers Edge 7.92
msiexec /i "%~dp0The Raisers Edge.msi" TRANSFORMS="%~dp0raiser.mst" /q
::Outlook web components
"%~dp0owc11.exe" /quiet
::Raisers Edge Update Patch 6, note you cant patch the original MSI with this patch and BBPatch.exe must be with it.
msiexec /p "%~dp0Patchpackage.msp" /q
::Visual Basic for Applications Version
msiexec /i "%~dp0ISSetupPrerequisites\Visual Basic for Applications Version 2627.01\vba6.msi" /q

Silent install from SCCM/SYSTEM account

Sample batch file,

  • Note using "psexec -s" to emulate a SYSTEM account install on local machine, this would be removed on a live one.
@echo off
::Run from UNC share, will need SYSTEM Account access
"%~dp0psexec.exe" -s msiexec /i "%~dp0The Raisers Edge.msi" TRANSFORMS="%~dp0raiser.mst" /q
"%~dp0psexec.exe" -s cmd /c ("%~dp0owc11.exe" /quiet)
"%~dp0psexec.exe" -s cmd /c (^
copy /y "%~dp0Patchpackage.msp" ^%%temp^%% ^
& copy /y "%~dp0BBPatch.exe" ^%%temp^%% ^
& pushd ^%%temp^%% ^
& msiexec /p ^"^%%temp^%%\Patchpackage.msp^" /q ^

More details about this here about how this works


You can only download the mobile service addition online, it doesnt come with the original software. Installing it once via the web, the entire "C:\Program Files (x86)\Blackbaud\Mobile Service" folder can be copied and a ser vice created and started (and permissions set to allow users to stop and start it)

xcopy "%~dp0Mobile Service" "C:\Program Files (x86)\Blackbaud\Mobile Service" /e /i /y
sc create "Blackbaud Mobile Service" start= auto binpath= "C:\Program Files (x86)\Blackbaud\Mobile Service\Blackbaud.Mobile.ServiceHost.exe"
rem (A;;RPWPCR;;;BU) adds users to start stop, can use subinacl with grant
sc start "Blackbaud Mobile Service"


Nice explanation of MsiLockPermissionsEx

MSDNs explanation of MSILockPermissionsEx table

SDDL basic explanation


blog comments powered by Disqus