Re: BUG #16341: Installation with EnterpriseDB Community installer in NT AUTHORITY\SYSTEM context not possible

Hi,

On Fri, Apr 3, 2020 at 7:47 PM PG Bug reporting form <noreply(at)postgresql(dot)org>
wrote:

> The following bug has been logged on the website:
>
> Bug reference: 16341
> Logged by: Enrico La Torre
> Email address: pg(dot)dba(dot)iit(dot)team(at)gmail(dot)com
> PostgreSQL version: 9.6.17
> Operating system: Windows Server 2016
> Description:
>
> Hi,
>
> it could be that the same bug was reported in
>
> /message-id/16001-fa33ba75a039fc7d%40postgresql.org
> , but nobody answered until today.
>
> It is impossible for me to install PostgreSQL 9.6.17 with the EnterpriseDB
> installer (free Community Edition) on Windows Server 2016 in the security
> context of NT AUTHORITY\SYSTEM.

Can you elaborate this please?

> If I start the installer with a regular
> domain admin account, which is also local administrator, the installer
> starts.
>
> OK

> I receive the error message:
> "Error running icacls "C:\Windows\Temp/postgresql_installer_ca555e4059" /T
> /Q /grant "<DOMAIN>/<COMPUTERNAME>$:(OI)(CI)F":
> C:\Windows\Temp/postgresql_installer_ca555e4059\*: Access is denied"
>
> I disclaimed The log file of the installer
> 'C:\Windows\Temp\install-postgresql.log' is never written.
>
> There must be files starting with bitrock*

> SYSTEM has FULL CONTROL for 'C:\Windows\Temp'. Created directories in this
> directory by SYSTEM inherit FULL CONTROL from the parent. But if I check
> the
> temporary directory '.\postgresql_installer_ca555e4059' I see that the
> inheritance is disabled for this particular directory. Only the principal
> named <DOMAIN>/<COMPUTERNAME>$ has FULL CONTROL not SYSTEM.
>
> Sure, once I receive the logs I may ask you to get the ACLs for some
directories which will give us more clues.

> The same issue is also true for PostgreSQL 12.2. The last time this
> procedure worked that I know is with the installer for PostgreSQL 9.6.12.
>
> Kind regards
>
>

--
Sandeep Thakkar