MSIEXEC issue

[jameswestley]

We are experiencing some issue with this, Luckily these users are in test mode but in a couple of days they will be deployed to live.

If you see below this is the alert, Do you think its o.k. To create an exception rule for this. What are your thoughts?

TESTMODE: The current application 'C:\WINNT\system32\services.exe' (as user NT AUTHORITY\SYSTEM) is trying to execute the new application 'C:\WINNT\system32\msiexec.exe'. The user would have been prompted as to the action to take

[a-vazquez]

I guess upgrading to 4.0.3 will resolve the issue.

[jameswestley]

what a stupid answer..em why ?

[tsteger1]

This is caused when a user logs on and a Windows Installer installed product tries to verify the installation (it's profile specific). Whatever the product is, it's configured to look for the installation files using the msiexec and that's what triggers the installation alert. Unfortunately it's a pretty broad exception you'd have to make to allow it. You might want to look at the app that's causing it first before making an exception.

Tom

[rspoon17]

James,

I was wondering if you ever got an answer to this message, and if not what you eventually tried. We are seeing the same message on all our clients several times a day.

Rusty

[owensgl]

CSA 4.5 fix this problem with a rule that give services.exe access to the system directory

Greg Owens