Chained MSI installation fails in Device Guard Enforced mode

Murali, Priya 21 Reputation points
2021-05-12T11:58:23.763+00:00

I have a installer (msi), where App2 installer is embedded in App1 installer - Chained installer.
In a regular windows 10 machine, when i install App1, both App1 and App2 get installed in their respective installation path.

Now, in Device Guard environment, in the Audit mode, I ran the installer for App1, and both App1 and App2 got installed. But the Event viewer, Under Code Integrity, had logs for App1 binaries, and not for App2 binaries.
As a result, even after creating the audit policy and deploying Device guard in Enforced mode, my installation rolls back when App2 is being installed.
I collected installation logs, and when the App2 installation starts, i see the below error code:
"MainEngineThread is returning 1625"
Note: i also used the PackageInspector and created the relevant catalog file.

I need help here, to know, why the App2 binaries were not captured in the Event viewer during Audit mode.
Is the chained installer not supported or is there a different way to audit such installers?
Guidance here, to unblock this situation, is much appreciated.

I have followed the links to create the code integrity policies and the catalog files:
https://blogs.technet.microsoft.com/ukplatforms/2017/04/04/getting-started-with-windows-10-device-guard-part-1-of-2/

https://blogs.technet.microsoft.com/ukplatforms/2017/05/04/getting-started-with-windows-10-device-guard-part-2-of-2/

Windows 10 Security
Windows 10 Security
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
2,767 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Jenny Feng 14,081 Reputation points
    2021-05-13T02:33:05.523+00:00

    @Murali, Priya
    Hi,
    Error #1625 is a Windows error that comes up during installation if a security policy on the computer has been enabled. You can adjust the setting to allow you to install but you will have to login as an Administrator to make the changes.

    Try the following method:
    Click on Start and type gpedit.msc then press Enter
    Select Administrative Templates under Computer Configuration
    Double-click on Windows Components-Windows Installer
    Go to Turn off Windows Installer and double-click on it to change the current state. Enabled means installation is restricted, resulting to Error #1625.
    Select Not Configured and click OK to save the changes
    Click OK on the error prompt and retry installing.

    Hope above information can help you.

    ============================================

    If the Answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.