Problems executing actions on users - PowerShell

Content Authoring
2

It’s not a matter of permissions, it’s a matter of environment. Try it yourself, outside of BigFix.
Set up two user accounts, “Administrator” and “User1”. If you perform a per-user install of ‘dotPeek’, as User1, you should not see that in Add/Remove Programs or your PowerShell script when you run as Administrator. If you looked up the actual uninstall command and executed it, it likely still would not work as expected because the uninstaller is referencing values under HKEY_CURRENT_USER – and the definition of HKEY_CURRENT_USER for ‘User1’ is different than the mount of HKEY_CURRENT_USER for the user ‘Administrator’.

There are several approaches you can take; none of them particularly easy.

  1. You can invest in MDM. BigFix provides a pretty nice one, but you do have to deal with enrolling your users/machines. With MDM policy you can take control of user environment setup.

  2. You could check out the thread updated yesterday at Thread execution failed - #17 by JasonWalker about using the ‘override’ commands to execute processes like this uninstall in the logged-on user context. You’ll need to craft Relevance so the task is only relevant when there is a logged-on user, and that user has the registry key or file in their profile to indicate the thing is installed; and configure the Action Settings to either ‘reapply while relevant’ or ‘reapply whenever it becomes relevant again’ so that the uninstall is repeated the next time a user with the per-user-install logs on.

  3. You could craft the uninstall as a Logon Script so that every time a user logs on, your PowerShell executes, checks whether the thing is installed, and uninstalls it. The Logon Script runs as the current user, so that should take care of the user-context.

  4. You could configure an ActiveSetup script, which is very similar to the Logon Script, except that it only runs one time for each user the next time they log on; if they reinstall the product again after you remove it, ActiveSetup won’t run repeatedly to get rid of it again. This is a very little-documented area of Windows but I do have some discussion and examples posted at Delete Multiple Office Profiles in Registry Keys Under HKEY_Users - #5 by JasonWalker

If anyone else has options for managing per-user installs I’d love to hear them, but I think this is a pretty good overview of the options as I know them today.

1 Like