Unable to uninstall program from WiX created MSI

问题

After installing osquery with an MSI made with WiXToolSet (Using the script provided by osquery), I tried uninstalling it which failed. Also it didn't show as a program in the appwiz. (Link to the script - https://github.com/osquery/osquery/blob/master/tools/deployment/make_windows_package.ps1)

I've tried using both the MSI itself - osquery.msi /uninstall and the unsintall string - msiexec /I{'uninstallstring'}. I also tried repairing using the /fv option.

The code the script used with WiX to create the MSI:

@'
<?xml version='1.0' encoding='windows-1252'?>
<?define OsqueryVersion = 'OSQUERY_VERSION'?>
<?define OsqueryUpgradeCode = 'ea6c7327-461e-4033-847c-acdf2b85dede'?>
<Wix xmlns="http://schemas.microsoft.com/wix/2006/wi" xmlns:util="http://schemas.microsoft.com/wix/UtilExtension">
  <Product
    Name='osquery'
    Manufacturer='Facebook'
'@
$wix += "`n    Id='$(New-Guid)'`n"
$wix +=
@'
    UpgradeCode='$(var.OsqueryUpgradeCode)'
    Language='1033'
    Codepage='1252'
    Version='$(var.OsqueryVersion)'>
    <Package Id='*'
      Keywords='Installer'
      Description='osquery standalone installer'
      Comments='Facebooks opensource host intrusion detection agent'
      Manufacturer='Facebook'
      InstallerVersion='200'
      Platform='x64'
      Languages='1033'
      Compressed='yes'
      SummaryCodepage='1252' />
    <MediaTemplate EmbedCab="yes" />
    <MajorUpgrade
      DowngradeErrorMessage="A later version of osquery is already installed. Setup will now exit." />
    <Condition Message='A newer version of osquery is already installed.'>
      NOT NEWERVERSIONDETECTED
    </Condition>
    <Condition Message="You need to be an administrator to install this product.">
        Privileged
    </Condition>
    <Property Id='SOURCEDIRECTORY' Value='packs'/>
    <PropertyRef Id="WIX_ACCOUNT_LOCALSYSTEM" />
    <PropertyRef Id="WIX_ACCOUNT_USERS" />
    <PropertyRef Id="WIX_ACCOUNT_ADMINISTRATORS" />
    <Directory Id='TARGETDIR' Name='SourceDir'>
      <Directory Id='ProgramFiles64Folder'>
        <Directory Id='INSTALLFOLDER' Name='osquery'>
          <Directory Id='DaemonFolder' Name='osqueryd'>
            <Component Id='osqueryd'
                Guid='41c9910d-bded-45dc-8f82-3cd00a24fa2f'>
                <CreateFolder>
                <Permission User="[WIX_ACCOUNT_USERS]" Read="yes"
                  ReadExtendedAttributes="yes" Traverse="yes"
                  ReadAttributes="yes" ReadPermission="yes" Synchronize="yes"
                  GenericWrite="no" WriteAttributes="no"/>
                <Permission User="[WIX_ACCOUNT_ADMINISTRATORS]" GenericAll="yes"/>
                <Permission User="[WIX_ACCOUNT_LOCALSYSTEM]" GenericAll="yes"/>
              </CreateFolder>
              <File Id='osqueryd'
                Name='osqueryd.exe'
                Source='OSQUERY_DAEMON_PATH'
                KeyPath='yes'/>
              <ServiceInstall Id='osqueryd'
                Name='osqueryd'
                Account='NT AUTHORITY\SYSTEM'
                Arguments='--flagfile="C:\Program Files\osquery\osquery.flags"'
                Start='auto'
                Type='ownProcess'
                Vital='yes'
                ErrorControl='normal'/>
              <ServiceControl Id='osqueryd'
                Name='osqueryd'
                Stop='both'
                Start='install'
                Remove='uninstall'
                Wait='no'/>
            </Component>
          </Directory>
          <Component Id='osqueryi' Guid='6a49524e-52b0-4e99-876f-ec50c0082a04'>
            <File Id='osqueryi'
              Name='osqueryi.exe'
              Source='OSQUERY_SHELL_PATH'
              KeyPath='yes'/>
          </Component>
          <Component Id='extras' Guid='3f435561-8fe7-4725-975a-95930c44d063'>
            <File Id='osquery.conf'
              Name='osquery.conf'
              Source='OSQUERY_CONF_PATH'
              KeyPath='yes'/>
            <File Id='osquery.flags'
              Name='osquery.flags'
              Source='OSQUERY_FLAGS_PATH'/>
            <File Id='osquery.man'
              Name='osquery.man'
              Source='OSQUERY_MAN_PATH'/>
            <File Id='osquery_utils.ps1'
              Name='osquery_utils.ps1'
              Source='OSQUERY_UTILS_PATH'/>
            <File Id='manage_osqueryd.ps1'
              Name='manage-osqueryd.ps1'
              Source='OSQUERY_MGMT_PATH'/>
'@

When trying to use the MSI to uninstall I saw the following message : This patch package could not be opened. Verify that the patch package exists and that you can access it, or contact the application vendor to verify that this is a valid Windows Installer patch package When trying to use the uninstall string I see this message: This action is only valid for products that are currently installed

回答1:

Upgrade Code Retrieval: How can I find the Upgrade Code for an installed MSI file? (if you want to test the below with another package family, find upgrade code via methods described here).

Debugging: To find the product code (provided it is actually defined), maybe try to run this code:

Set installer = CreateObject("WindowsInstaller.Installer")
Set upgrades = installer.RelatedProducts("ea6c7327-461e-4033-847c-acdf2b85dede")

For Each u In upgrades
   MsgBox u, vbOKOnly, "Product Code: "
Next

Procedure: 1) copy & paste the script into notepad, 2) save as ANSI file: "Find Related Products.vbs" on desktop, 3) double click script file to run. Make a note of the product codes shown by the message boxes (if any). Hit CTRL + C to copy content of the actual VBScript dialog.

Uninstall: From the cmd.exe using the product code you found by running the script above:

msiexec.exe /x {Product-Code}

Alternative: Browse through %SystemRoot%\Installer manually if you can't get the above to work, and follow the advice in section 4 here. Locate the right MSI, right click and go "Uninstall".

Links:

Powershell: Uninstall application by UpgradeCode

来源：https://stackoverflow.com/questions/57291664/unable-to-uninstall-program-from-wix-created-msi

标签

wix

windows-installer

msiexec

osquery