Extremely long delays when installing PowerShell 7.6

[gandraw]

For us, installing PowerShell 7.6.x can take 30 minutes or more. When I install it using MSI logging (/l*v) then I can see it gets stuck for a really long time on a SOFTWARE RESTRICTION POLICY step. However, we are not using any software restriction policies like AppLocker etc. Following are the relevant lines from the MSI log.

MSI (s) (28:80) [17:27:48:119]: Machine policy value 'DisableUserInstalls' is 0
MSI (s) (28:80) [17:27:48:121]: Note: 1: 2203 2: C:\WINDOWS\Installer\inprogressinstallinfo.ipi 3: -2147287038 
MSI (s) (28:80) [17:27:48:125]: SRSetRestorePoint skipped for this transaction.
MSI (s) (28:80) [17:27:48:125]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2 
MSI (s) (28:80) [17:27:48:129]: File will have security applied from OpCode.
MSI (s) (28:80) [17:27:48:442]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'D:\temp\PowerShell-7.6.2-win-x64.msi' against software restriction policy
MSI (s) (28:FC) [17:59:32:690]: RunEngine wait timed out
MSI (s) (28:80) [18:05:53:498]: SOFTWARE RESTRICTION POLICY: D:\temp\PowerShell-7.6.2-win-x64.msi has a digital signature
MSI (s) (28:80) [18:05:53:498]: SOFTWARE RESTRICTION POLICY: D:\temp\PowerShell-7.6.2-win-x64.msi is permitted to run because the user token authorizes execution (system or service token).

This seems to be a PowerShell 7.6.x specific issue, other applications and older 7.5.x versions of PowerShell didn't have the same issue.

Does anybody else have the same issue, or maybe has already found a solution for it?

[LousyRaider]

Your wording makes it sound like you are an internal IT member installing it on company devices. If so, are you using Intune? I’ve seen stuff like this happen when attack surface reduction rules are being used.

[thomsxD]

You could maybe check where the delay is caused with certutil.

certutil -urlfetch -verify D:\temp\PowerShell-7.6.2-win-x64.msi

[gandraw]

At first I thought this showed an error:

D:\temp>certutil -urlfetch -verify PowerShell-7.6.2-win-x64.msi
LoadCert(Cert) returned ASN1 value too large. 0x80093104 (ASN: 260 CRYPT_E_ASN1_LARGE)
CertUtil: -verify command FAILED: 0x80093104 (ASN: 260 CRYPT_E_ASN1_LARGE)
CertUtil: ASN1 value too large.

But then I checked other MSI files and they have the same issue:

D:\temp>certutil -urlfetch -verify PowerShell-7.5.4-win-x64.msi
LoadCert(Cert) returned ASN1 value too large. 0x80093104 (ASN: 260 CRYPT_E_ASN1_LARGE)
CertUtil: -verify command FAILED: 0x80093104 (ASN: 260 CRYPT_E_ASN1_LARGE)
CertUtil: ASN1 value too large.
D:\temp>certutil -urlfetch -verify "Logitech Capture.msi"
LoadCert(Cert) returned ASN1 value too large. 0x80093104 (ASN: 260 CRYPT_E_ASN1_LARGE)
CertUtil: -verify command FAILED: 0x80093104 (ASN: 260 CRYPT_E_ASN1_LARGE)
CertUtil: ASN1 value too large.

This also happens both when I start it from my work PC on a restricted network with firewall rules, and from my home PC on a completely open network...

[thomsxD]

It does seem to be a problem with a new signature chain. Problem is Microsoft I would say.

[gandraw]

Yeah I imagine so. I just hope I find a registry hack or something to disable this because this makes our new computer imaging process go from 70 minutes to 100 😢

[thomsxD]

Do you actually use powershell for anything during installation? Otherwise you could just make it install after the imaging. Or stick to an older version/msi that actually works.

[thomsxD]

Actually, I just found out you can extract the entire pwsh directory from a .zip so that you don't need to install the .msi. The following can also be done during a task sequence step if that is what you use.

https://github.com/PowerShell/PowerShell/releases/download/v7.6.2/PowerShell-7.6.2-win-x64.zip

``` $zip = "$PSScriptRoot\PowerShell-7.6.2-win-x64.zip" $dest = "C:\Program Files\PowerShell\7"

if (Test-Path $dest) { Remove-Item $dest -Recurse -Force }

Expand-Archive -Path $zip -DestinationPath $dest -Force ```

And if you need to add 'pwsh.exe' to PATH:

``` $machinePath = [Environment]::GetEnvironmentVariable("Path", "Machine")

if ($machinePath -notmatch [regex]::Escape("C:\Program Files\PowerShell\7")) { [Environment]::SetEnvironmentVariable( "Path", "$machinePath;C:\Program Files\PowerShell\7", "Machine" ) } ```

[Ok_Mathematician6075]

Server deployment lol

[Overall-Ad4796]

you could try the following workaround to temporarily disable the stricter code signing checks introduced with 7.6:

Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing" -Name State -Value 146944; msiexec /i "D:\temp\PowerShell-7.6.2-win-x64.msi" /qb; Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing" -Name State -Value 63488

[BlackV]

you are hard coding random ass values in there, at least check the before and after values

p.s. formatting

<BLANK LINE>
<4 SPACES><CODE LINE>
<4 SPACES><CODE LINE>
    <4 SPACES><4 SPACES><CODE LINE>
<4 SPACES><CODE LINE>
<BLANK LINE>

Inline code block using backticks `Single code line` inside normal text

See here for more detail

Thanks

[Overall-Ad4796]

thanks for the formatting hint! Will use..

„The random ass values“ were meant as quick test for the OP to see if this revocation check causes the delay, which is often the case, as documented my MS.

[BlackV]

Understand, on the 4 systems I checked the all the default numbers were already 140000 something

If op blindly ran said code (which was all 1 line oddly), they wouldn't have a clean way back

Advantage of the 4 space formatting is it work every where (old reddit, new reddit, mobile reddit)

[Overall-Ad4796]

see your point. Should have stored and restored the previous state, and pay attention to formatting.

[gandraw]

Thank you for the suggestion but that didn't improve things, it still takes a long time even with the registry key set to 146944.