Is the Windows Language Pack Installer no longer signed by Microsoft?

Question

The company that i work for uses Privilege Management for escalation of admin rights on standard user accounts based on a library of rules. During the Autopilot process we found that the language pack installer would pop up for about 50% of users but it would prompt for admin creds and users could not continue. To alleviate this issue, we create a privilege management rule that allows "C:\WINDOWS\system32\lpksetup.exe" to run as admin as long as the Publisher has an exact match of "Microsoft Corporation", which it previously did. I received a case from a user that they are getting random prompts for admin rights to run the language pack installer, however, the Language Pack installer shows a Publisher of "Unknown". I then navigated to C:\WINDOWS\system32\ and checked the properties of lpksetup.exe on my PC and saw there was no signed publisher listed anymore. Was the publisher removed from the Language Pack Installer in C:\Windows\System32 or is this a malicious file? If it was removed that seems a bit of an odd choice my MS...

[Moved from Other/For business/Publisher]

Answer 1

Hi Brian. G,

the Windows Language Pack Installer should still be signed by Microsoft. It is possible that the publisher information was removed or not properly displayed due to a system issue or a security software conflict. I recommend running a full system scan with an up-to-date antivirus program to ensure that there are no malicious files on your system. Additionally, you may want to check for any Windows updates or patches that may address this issue.

Hope it is helpful for you.

Kind regards,

Lei

Answer 2

Thank you for letting me know, I have tried using the system file checker from an admin prompt. This did find integrity violations and repaired them so i am hoping this resolves the issue for the handful of users facing this problem. If not i will check from an AV/Malware side.