Per-User vs. Per-Machine Installations

InstallShield 2015

Project: This information applies to Basic MSI projects.

Two Windows Installer properties, along with the current user’s privileges, affect where the configuration information such as your product’s shortcuts and registry entries are stored on a target machine—to the All Users profile or the current user’s profile:

ALLUSERS determines where the configuration information is stored.
MSIINSTALLPERUSER indicates that the Windows Installer should install the package for only the current user.

The MSIINSTALLPERUSER property is available with Windows Installer 5 and on Windows 7 or Windows Server 2008 R2. Earlier versions of Windows Installer and Windows ignore this property.

You can set the ALLUSERS and MSIINSTALLPERUSER properties for your project through the Property Manager. You can also set these properties using the following methods:

At the command line
Through a custom action
In the CustomerInformation and ReadyToInstall dialogs

ALLUSERS, MSIINSTALLPERUSER, and Windows 7 or Windows Server 2008 R2

If the ALLUSERS property is set to 2 and MSIINSTALLPERUSER is set to 1, the Windows Installer performs a per-user installation.

During a per-machine installation, the Windows Installer requires elevated privileges, and it directs files and registry entries to per-machine locations. If User Account Control (UAC) is available on the target system, a per-machine installation typically prompts for consent or credentials, depending on the access level of the user. During a per-user installation, the Windows Installer does not prompt for credentials, and it redirects files and registry entries to per-user locations.

For more information, see Single Package Authoring on the MSDN Web site.

Effects of ALLUSERS on Windows Vista and Later

Custom actions that have an in-script execution setting of deferred in system context are used to perform an action with the rights granted to the LocalSystem account on Windows, since the Windows Installer service runs in the system context. Actions not marked as deferred in system context run with user impersonation and have the rights that the user who launches the installation has.

When a per-user installation (that is, one where ALLUSERS is not set) is run, deferred-in-system-context actions run in the same context in which normal deferred or immediate custom actions run, which is with user impersonation. This can potentially cause a run-time issue with the custom action in the following circumstances:

The user who launches the Windows Installer installation is not an administrator; or the user is running the installation on Windows Vista or later, the user is part of the Administrators group, and the user does not have administrator privileges by default.
The custom action attempts to modify a resource in a per-machine location on the machine, such as a file in the Program Files folder, or a registry key or value in HKEY_LOCAL_MACHINE.

While this may not be an issue with Windows XP or earlier versions of Windows, Windows Vista and later do not give users full administrator privileges by default. Therefore, since a deferred-in-system-context action runs with user impersonation when ALLUSERS is not set, the custom action could fail.

The recommended method for preventing this behavior is to specify that a per-machine installation should always be performed by setting ALLUSERS to 1 in the Property Manager. Per-machine installations are generally easier to manage than per-user installations.

Default Value of ALLUSERS

The ALLUSERS property is set to 1 by default in all Basic MSI projects. If you configure your installation so that it can be installed per user without administrative privileges, you may want to consider changing the value of the ALLUSERS property or removing this property from your project.

Default Controls on the ReadyToInstall Dialog

Use the Show Per-User Option setting in the General Information view to specify whether you want to give end users the option of installing your product for all users or for only the current user. Available options for the Show Per-User Option setting are:

NoInstallShield does not set any related properties. At run time, the ReadyToInstall dialog does not include the buttons that let end users specify how they want to install the product. This is the default value.
YesInstallShield sets the ISSupportPerUser property equal to 1.

If the following conditions are true at run time, the ReadyToInstall dialog includes the per-user and per-machine buttons:

The ISSupportPerUser property is equal to 1.
The target system has Windows 7 or later, or Windows Server 2008 R2 or later.
The product is not already installed on the target system.

The buttons on the ReadyToInstall dialog let end users specify how they want to install the product. If elevated privileges are required, the shield icon is included on the all-users button. If an end user selects the per-user button, the ALLUSERS property is set to 2, and the MSIINSTALLPERUSER property is set to 1. If an end user selects the all-users button, the ALLUSERS property is set to 1, and the MSIINSTALLPERUSER property is not set.

Note: Selecting No for the Show Per-User Option setting in the General Information view does not prevent end users from setting MSIINSTALLPERUSER from the command line when they run your installation. If your installation does not support this, you may want to add a launch condition or other run-time check to prevent this from occurring.

Default Controls on the CustomerInformation Dialog

By default, the CustomerInformation dialog in all Basic MSI projects does not display the radio button group that enables end users to specify whether they want to install the product for all users or for only the current user. This is the recommended implementation for this dialog.

To display the radio button group that lets end users set ALLUSERS from the CustomerInformation dialog:

1. In the View List under User Interface, click Dialogs.
2. In the Dialogs explorer, under All Dialogs, expand the CustomerInformation dialog, and then click Behavior. InstallShield displays the list of controls for the CustomerInformation dialog.
3. At the bottom of the lower-right pane, click the Conditions tab. In the upper-right pane, InstallShield displays the conditions for the selected control.
4. In the list of controls, click DlgRadioGroupText. InstallShield displays this control’s conditions in the upper-right pane.
5. In the upper-right pane, right-click the row that contains the condition whose value is 1 and whose action is Hide, and then click Delete.
6. Repeat steps 4 and 5 for the RadioGroup control.

See Also