Windows Install Launcher

This feature will be available with the release of EPM v1.3, which is right around the corner!

Audience: IT admins and deployment engineers. This page describes InstallLauncher, a helper component that works with the RedirectEvaluator plugin to allow standard users to run .msi installers interactively without triggering nested UAC prompts.

What the InstallLauncher Plugin Does

When a user with Least Privilege applied tries to open an .msi file, the system would normally prompt for administrator credentials through Windows UAC — which standard users cannot satisfy. InstallLauncher solves this by intercepting the elevation request through the redirect capability and running msiexec.exe from within an already-elevated process, bypassing the nested UAC prompt entirely.

The result: the user gets the standard Windows Installer interface for the package they selected, and elevation is handled transparently by EPM without requiring admin credentials at the point of install.

Prerequsites

Version	.NET Runtime required on endpoint?
2.0	Yes — InstallLauncher is not AOT-compiled in 2.0 and requires the .NET runtime to be installed on the target endpoint before it can execute.
2.1+	No — InstallLauncher is AOT-compiled (Ahead-of-Time) and runs standalone.

If you are running EPM v2.0 and InstallLauncher redirects appear to match in the logs but the launcher never executes (or exits immediately), verify the .NET runtime is present on the endpoint. Upgrade to v2.1 or later to remove this dependency.

Supported Invocation Methods

The Install Launcher intercepts .msi installer invocations that reach EPM as PrivilegeElevation events. In v2.0 and v2.1, the following invocation methods are supported and unsupported:

Invocation method	Supported in 2.0 / 2.1
Request elevation via KeeperClient, then select the .msi file	✅ Supported
KeeperAgent → "+" button (Request Elevation), then select the .msi file	✅ Supported
Double-click the .msi in File Explorer	❌ Not supported (planned for 2.2)
Right-click the .msi → Install	❌ Not supported (planned for 2.2)
msiexec /i <package>.msi from Command Prompt or PowerShell	❌ Not supported
Start-Process msiexec.exe -Verb RunAs ... from PowerShell	⚠️ Triggers a PrivilegeElevation event and the redirect rule matches, but the resulting flow does not produce a full install experience — use the Request Elevation flow instead.

How It Works

InstallLauncher operates as the redirect target in the LaunchPrivilegeElevation flow:

1. The user opens KeeperClient (or clicks the + button in KeeperAgent) and selects Request Elevation.

2. The user browses to the .msi file they wish to install.

3. EPM raises a PrivilegeElevation event for msiexec.exe targeting the selected .msi.

4. The RedirectEvaluator plugin matches the configured rule and redirects execution to InstallLauncher.exe.

5. Install Launcher runs the .msi under the elevated context provided by EPM — no admin credentials required from the end user.

Because msiexec.exe is started from within a process that is already elevated, there is no secondary UAC prompt for the installer or any helper processes it spawns.

For background on the redirect capability and how redirect rules are evaluated, see Reference: Redirect Capability.

Required Paired PrivilegeElevation Policy

Important: The RedirectEvaluator SettingsUpdate policy (shown further down) only defines the redirect rule. You must also have a PrivilegeElevation policy in place that matches msiexec.exe — the redirect fires only after PrivilegeElevation policy evaluation. Without this paired policy, the .msi will be re-evaluated as a FileAccess target and the flow will fall through the policy registry.

The paired PrivilegeElevation policy must include "AllowChildProcesses": true, since msiexec.exe spawns child processes during install.

Example Paired PrivilegeElevation Policy (abbreviated):

{
  "PolicyName": "Allow msiexec elevation for Install Launcher",
  "PolicyType": "PrivilegeElevation",
  "Status": "enforce",
  "Extension": {
    "Targets": [
      {
        "ExePattern": "msiexec\\.exe",
        "AllowChildProcesses": true
      }
    ],
    "Controls": {
      "AutoApprove": true
    }
  }
}

Deployment

InstallLauncher is built and deployed alongside other EPM components:

• Build output location: publishoutput/Jobs/bin/InstallLauncher/

• Runtime location: Deploy to the same Jobs/bin/ directory as other EPM job tools.

The RedirectEvaluator plugin resolves InstallLauncher by short name from Jobs/bin/. No additional path configuration is required as long as it is deployed in the standard location.

Built-in MSI Redirect Rule

The default RedirectEvaluator plugin definition (KeeperPrivilegeManager/Plugins/RedirectEvaluator.json) ships with a redirect rule for .msi files already configured under metadata.redirect.rules:

{
  "sourceExePattern": "msiexec\\.exe",
  "commandLinePattern": "\\.msi",
  "elevationOnly": true,
  "targetExe": "InstallLauncher",
  "targetArguments": "\"{FilePath}\" {CommandLine}"
}

This rule matches any privilege elevation request where msiexec.exe is invoked with an .msi path on the command line, and redirects it to InstallLauncher with the file path and original command line as arguments.

To modify or extend this rule — for example to restrict it to specific directories, add nonAdminOnly, or add rules for other installer types — edit Plugins/RedirectEvaluator.json directly on the endpoint, or push an updated configuration using a SettingsUpdate policy. See Plugin: RedirectEvaluator for details on deploying rule changes centrally.

Placeholder Tokens

The targetArguments field in a redirect rule supports the following tokens, which RedirectEvaluator expands before passing them to InstallLauncher:

Token	Value
{FilePath}	Full path of the .msi file from the elevation request
{FileName}	Base file name only (e.g. installer.msi)
{Directory}	Directory containing the file
{CommandLine}	Command line from the original elevation request (may be empty)

The default rule uses "{FilePath}" {CommandLine}, which passes the full path quoted (to handle spaces) followed by any additional arguments the user or calling application supplied.

Elevation File Extensions

EPM's companion apps (Keeper Agent and Keeper Client) use a file called elevation-allowed-extensions.json, deployed alongside the application executable, to determine which file extensions are eligible to trigger a privilege elevation request. The .msi extension is included in this list by default.

To customize the allowed extensions for your deployment, create a JSON file with the following structure and point to it using the KEEPER_ELEVATION_EXTENSIONS_CONFIG environment variable:

{
  "windows": [".msi", ".exe"],
  "linux": [".sh", ".run"],
  "macos": [".pkg", ".dmg"]
}

If you omit a platform key, the built-in default for that platform is preserved. Set the environment variable KEEPER_ELEVATION_EXTENSIONS_CONFIG to the full path of your custom file to override the default at runtime.

User Interface

InstallLauncher launches msiexec.exe using UseShellExecute, which means the Windows Installer UI is fully native. Whatever interface the .msi package and its arguments specify is what the user sees:

• No custom arguments → standard interactive installation wizard.

• /quiet or /qn in the command line → silent or reduced-UI install, as defined by the package.

There is no additional EPM-provided UI. InstallLauncher is transparent to the user.

Silent Mode / Automation

By default, InstallLauncher does not write anything to stderr during a normal interactive elevation — there is nothing extra for the user to see or dismiss.

When running in automated or scripted contexts where a console is attached and you want failure details surfaced, enable silent mode using any of the following:

Method	Value
Command-line flag	--silent or --quiet-ui or /silent
Environment variable	KEEPER_INSTALL_LAUNCHER_SILENT=1 or KEEPER_INSTALL_LAUNCHER_SILENT=true

In silent mode, if msiexec.exe exits with a non-zero code, InstallLauncher writes a short failure summary to stderr. The process exit code is always the Windows Installer exit code regardless of this setting.

CLI Reference

InstallLauncher can also be invoked directly from a command prompt or script, independently of the redirect flow. This is useful for testing, automation, and scripted deployments.

Basic install:

InstallLauncher C:\path\to\package.msi

Silent install:

InstallLauncher --silent C:\path\to\package.msi /qn

Full msiexec control (repair, uninstall, product code):

InstallLauncher -- /x {PRODUCT-CODE} /qn

Use -- as a separator when you need to pass arguments that begin with / or - directly to msiexec.exe without InstallLauncher interpreting them as its own flags. Everything after -- is forwarded verbatim.

Argument	Description
<path>.msi [args]	Path to the .msi file, optionally followed by msiexec arguments
-- <msiexec args>	Pass arguments directly to msiexec.exe (use for repair, uninstall, product codes)
--silent / --quiet-ui / /silent	Print failure details to stderr when msiexec exits non-zero

Summary

Topic	Detail
What it does	Runs msiexec.exe from an already-elevated process so .msi files install without a UAC prompt
How it's triggered	Via the RedirectEvaluator built-in MSI redirect rule in the LaunchPrivilegeElevation flow
Where to deploy	Jobs/bin/InstallLauncher/ alongside other EPM job tools
Default rule	Ships in Plugins/RedirectEvaluator.json; matches msiexec.exe + .msi on the command line
UI	Native Windows Installer UI; no EPM interface added
Silent mode	--silent or KEEPER_INSTALL_LAUNCHER_SILENT=1 — stderr failure summary only; exit code is always the msiexec result
Allowed extensions	Configured via elevation-allowed-extensions.json; override path with KEEPER_ELEVATION_EXTENSIONS_CONFIG