az upgrade is blocked by policy: The system administrator has set policies to prevent this installation

[chriskuech]

When I run az upgrade, I get a prompt saying "The system administrator has set policies to prevent this installation".

Does your installer use unsigned powershell scripts?

[yonzhan]

@jiasli for awareness

[chriskuech]

Looks like this is only a bug in az upgrade. The msi works fine for upgrading versions with the aforementioned group policy.

[jiasli]

Does your installer use unsigned powershell scripts?

No. No script is involved. The lines for installing MSI in az upgrade are

azure-cli/src/azure-cli/azure/cli/command_modules/util/custom.py

Lines 133 to 135 in 3d14ca2

	elif installer == 'MSI':
	logger.debug("Update azure cli with MSI from https://aka.ms/installazurecliwindows")
	exit_code = subprocess.call(['powershell.exe', '-NoProfile', "Start-Process msiexec.exe -Wait -ArgumentList '/i https://aka.ms/installazurecliwindows'"]) # pylint: disable=line-too-long

Does it work if you directly call this command from Command Prompt?

powershell.exe -NoProfile Start-Process msiexec.exe -Wait -ArgumentList '/i https://aka.ms/installazurecliwindows'

Also, could you open regedit.exe, go to HKLM\Software\Policies\Microsoft\Windows\Installer and see if DisableMSI is configured? If so, is it possible to delete it?

You may do the same thing in Group Policy Editor: open gpedit.msc and check Local Computer Policy > Computer Configuration > Administrative Templates > Windows Components > Windows Installer > Turn off Windows Installer. If it is enabled, disable it if possible.

References

• https://docs.microsoft.com/en-us/windows/win32/msi/disablemsi
• https://answers.microsoft.com/en-us/windows/forum/all/this-installation-is-forbidden-by-system-policy/ac1986be-a063-4b7b-834f-8fa56a8c0d04?page=1
• https://kb.vmware.com/s/article/1016563
• https://admx.help/?Category=Windows_8.1_2012R2&Policy=Microsoft.Policies.MSI::DisableMSI

[vermegi]

I ended up installing/upgrading by running:
Invoke-WebRequest -Uri https://aka.ms/installazurecliwindows -OutFile .\AzureCLI.msi; Start-Process msiexec.exe -Wait -ArgumentList '/I AzureCLI.msi /quiet'; rm .\AzureCLI.msi
As described here: https://docs.microsoft.com/en-us/cli/azure/install-azure-cli-windows?tabs=azure-powershell (Microsoft MSI with command).
I ran this from an administrative PowerShell prompt. I used the same prompt for the az upgrade, which failed with the above policy blocker.
The MSI install was successful.

[vermegi]

The above "powershell.exe -NoProfile Start-Process msiexec.exe -Wait -ArgumentList '/i https://aka.ms/installazurecliwindows'"
Fails with:
Start-Process : A positional parameter cannot be found that accepts argument 'https://aka.ms/installazurecliwindows'.
At line:1 char:1

• Start-Process msiexec.exe -Wait -ArgumentList /i https://aka.ms/insta ...

•   + CategoryInfo          : InvalidArgument: (:) [Start-Process], ParameterBindingException
    + FullyQualifiedErrorId : PositionalParameterNotFound,Microsoft.PowerShell.Commands.StartProcessCommand
  

[jiasli]

@vermegi, you will need to try the command in Command Prompt, not PowerShell:

powershell.exe -NoProfile Start-Process msiexec.exe -Wait -ArgumentList '/i https://aka.ms/installazurecliwindows'

The caller PowerShell will interpret single quotes ' and strip them when calling powershell.exe.