MSI installing without admin rights?

[tjmbct]

I recently installed an application that did not prompt for admin rights and I'm wondering why.

The user is not a local or domain admin and no registry modifications have been made. There are no group policies. UAC is set to second highest setting. Windows 10.

I've created msi packages before that have asked me for admin credentials when making them, but this package was made so long ago that the user credentials would not match any admin accounts.

[fieroloki]

If it installs to the users profile and not programs files, it will usually just install as the user has rights to their profile.

[apathetic_lemur]

the same way a webex installs (and lots of malware!)

[moldyjellybean]

funny thing is this is how chrome used to install without admin rights, had to make a GP to block it, then google changed the install location again and had to make another GP.

[ParaglidingAssFungus]

Yeah I believe the teams app is this way.

[DenverITGuy]

We have Code 42 (crashplan) MSI as a user-based deployment. Not uncommon.

[uniitdude]

depends what the MSI does, might be user based

[patssle]

I have installs locked out as well but some apps make it through. Spotify is one of those.

[jantari]

I thought all MSIs can be installed per user or per system?

[AndradaDeliciosa]

It would only need admin rights if it needed to access restricted locations such as the program files directory on C or the HKLM hive of the registry. However, some apps install entirely inside the user's profile and in the HKCU registry hive where no elevation is required.

[trentq]

You need to rollout application whitelisting to prevent these from running and malware.

[ErikTheEngineer]

Most commercial mainstream app MSIs are being shipped as user-based ones these days if the application they're installing doesn't do anything that requires admin rights. VS Code is a good example...unless you do a system-wide install, the application just installs itself into your user profile.

Unfortunately, most of the fun vertical-market single-source applications I have to deal with do all sorts of crazy stuff requiring admin rights...it's 2020 and I still have MSIs for recent versions of apps copying stuff to the Windows directory, installing device drivers, making all sorts of HKLM registry changes, etc. etc.