`az upgrade` fails on Windows 10: The system administrator has set policies to prevent this installation.

[heaths]

This is autogenerated. Please review and update as needed.

Describe the bug

When I run az upgrade, the MSI is downloaded and script generated (first progress dialog) but then I get an error shown below. I am on a Microsoft-managed (employee) machine, so there may be additional policies in place.

Command Name
az upgrade

Errors:

The MSI log (I have logging enabled with "voicewarmupx") shows:

MSI (c) (58:C8) [11:07:07:434]: Using WinHttp to perform URL download
MSI (c) (58:C8) [11:07:07:435]: File path is a URL. Downloading file. . .
MSI (c) (58:C8) [11:07:07:452]: Msi WinHttp: Performing auto proxy detection
MSI (c) (58:C8) [11:07:07:455]: MSI WinHttp: Proxy Settings Proxy: (none) | Bypass: (none) | AccessType: 0
MSI (c) (58:C8) [11:07:08:374]: StatusCode is:[200]
MSI (c) (58:C8) [11:07:08:377]: Downloading https://aka.ms/installazurecliwindows to local file C:\Users\heaths\AppData\Local\Temp\MSIEA5E.tmp
MSI (c) (58:C8) [11:07:12:144]: Machine policy value 'DisableUserInstalls' is 0
MSI (c) (58:C8) [11:07:12:284]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'https://aka.ms/installazurecliwindows' against software restriction policy
MSI (c) (58:C8) [11:07:12:288]: 
MSI (c) (58:C8) [11:07:12:290]: Deleting URL local copy C:\Users\heaths\AppData\Local\Temp\MSIEA5E.tmp.
MSI (c) (58:C8) [11:07:12:295]: MainEngineThread is returning 1625

The existing package, 2.26.1, is installed per-machine. The new package, 2.27.0, also has ALLUSERS=1 authored in the Property dialog so this should be allowed. In the past, I was prompted for UAC confirmation, but even now running az upgrade from an elevated prompt fails.

Installing the MSI myself succeeds.

To Reproduce:

Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.

• Put any pre-requisite steps here...
• az upgrade

Expected Behavior

Installs, which it did some time ago (maybe a few months ago).

Environment Summary

Windows-10-10.0.19041-SP0
Python 3.8.9
Installer: MSI

azure-cli 2.26.1 *

Extensions:
azure-devops 0.18.0

Additional Context

[yonzhan]

@jiasli for awareness

[heaths]

Note I can't repro this when executing "msiexec /i https://aka.ms/installazurecliwindows" directly. In fact, using python interactive I can run the following (similar to what you do here but without the unnecessary invocation of powershell.exe, which forces additional dependencies) with err:

subprocess.call(['msiexec.exe', '/i', 'https://aka.ms/installazurecliwindows'])

Note, however, this runs in interactive mode, which when I run az upgrade doesn't happen. You appear to run basic mode, which would require passing, for example, /qb.

[jiasli]

Thanks @heaths for reporting this issue to us. I am also using a Microsoft domain-joined machine but couldn't repro this issue...

This issue was previously report at #18566 but I haven't find the root cause yet.

The code CLI uses to launch the MSI installation is

azure-cli/src/azure-cli/azure/cli/command_modules/util/custom.py

Lines 133 to 135 in 3d14ca2

	elif installer == 'MSI':
	logger.debug("Update azure cli with MSI from https://aka.ms/installazurecliwindows")
	exit_code = subprocess.call(['powershell.exe', '-NoProfile', "Start-Process msiexec.exe -Wait -ArgumentList '/i https://aka.ms/installazurecliwindows'"]) # pylint: disable=line-too-long

without the unnecessary invocation of powershell.exe, which forces additional dependencies

The author of this line of code can't remember why powershell.exe is called here. If it is truly unnecessary, I can remove it.

In fact, using python interactive I can run the following with err

Just want to confirm, you can hit the same The system administrator has set policies to prevent this installation error in a Python interactive shell?

What if you use python.exe to initiate the installation in Command Prompt?

"C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe" -c "import subprocess; subprocess.call(['powershell.exe', '-NoProfile', \"Start-Process msiexec.exe -Wait -ArgumentList '/i https://aka.ms/installazurecliwindows'\"])"

Thanks for the information.

[jiasli]

I can repro this issue now on my laptop. Looks like some policy gets pushed/updated recently.

Commands I used to trigger this error:

"C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe" -c "import subprocess; subprocess.call(['msiexec.exe', '/i', 'https://aka.ms/installazurecliwindows'])"

or even

msiexec.exe /i https://aka.ms/installazurecliwindows

Adding Display options like /qb and /qf doesn't help. I still see this error.

msiexec.exe /i https://aka.ms/installazurecliwindows /qb
msiexec.exe /i https://aka.ms/installazurecliwindows /qf

Running these commands from an Admin Command Prompt doesn't help either.

However, it works if I download this package to a local folder and install with

msiexec.exe /i D:\azure-cli-2.27.0.msi

[heaths]

I think it only appeared to work for me because it was installed, and MSI years the cached MSI on that case, so the discouraged copy wasn't used.

So it would be good to download it first. I've worked with MSI for over 20 years and letting it download the package was never ideal.

Optionally, if the install fails you could print the path to the downloaded copy and not delete it so the user can install it themselves. Though, I suppose you do print the URL so that's probably fine as well.

[jiasli]

I think it only appeared to work for me because it was installed, and MSI years the cached MSI on that case, so the discouraged copy wasn't used.

I don't really understand this sentence. Do you mind rephrasing it?

So it would be good to download it first. I've worked with MSI for over 20 years and letting it download the package was never ideal.

True, and this issue is only hit when we let msiexec.exe do the downloading.

Optionally, if the install fails you could print the path to the downloaded copy and not delete it so the user can install it themselves.

Suppose we still let msiexec.exe do the downloading, do you happen to know how to retrieve the .msi file downloaded by msiexec.exe?

Though, I suppose you do print the URL so that's probably fine as well.

Using the URL will require the user to re-download the .msi file with a web browser. If we can retrieve the .msi file downloaded by msiexec.exe, the user won't need to download the .msi file again.

Alternatively, CLI can download the .msi file first and install it with msiexec.exe, then it will also work.

[heaths]

When an MSI detects that the ProdcutCode and ProductVersion are already installed, it uses the MSI already in the undocumented cache location (I replied offline where that is, but you must not mess with anything in there ever or you could corrupt it and cause the whole thing to be deleted, breaking every MSI on the machine).

If you let msiexec.exe download the MSI it is deleted when processing is finished, which also occurs right before the error dialog comes up.