> For the complete documentation index, see [llms.txt](https://newdocs.keeper.io/en/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://newdocs.keeper.io/en/keeperpam/endpoint-privilege-manager/custom-tooling/jobs-and-plugins/custom-plugin-guide/plugin-examples/plugin-install-launcher.md). # Windows Install Launcher {% hint style="warning" %} This feature will be available with the release of EPM v1.3, which is right around the corner! {% endhint %} **Audience:** IT admins and deployment engineers. This page describes **`InstallLauncher`**, a helper component that works with the `RedirectEvaluator` plugin to allow standard users to run `.msi` installers interactively without triggering nested UAC prompts. ## What the `InstallLauncher` Plugin Does When a user with Least Privilege applied tries to open an `.msi` file, the system would normally prompt for administrator credentials through Windows UAC — which standard users cannot satisfy. **`InstallLauncher`** solves this by intercepting the elevation request through the redirect capability and running `msiexec.exe` from within an already-elevated process, bypassing the nested UAC prompt entirely. The result: the user gets the standard Windows Installer interface for the package they selected, and elevation is handled transparently by EPM without requiring admin credentials at the point of install. ## Prerequsites
Version.NET Runtime required on endpoint?
2.0Yes — InstallLauncher is not AOT-compiled in 2.0 and requires the .NET runtime to be installed on the target endpoint before it can execute.
2.1+No — InstallLauncher is AOT-compiled (Ahead-of-Time) and runs standalone.
If you are running EPM v2.0 and InstallLauncher redirects appear to match in the logs but the launcher never executes (or exits immediately), verify the .NET runtime is present on the endpoint. Upgrade to v2.1 or later to remove this dependency. ### Supported Invocation Methods The Install Launcher intercepts `.msi` installer invocations that reach EPM as **PrivilegeElevation** events. In v2.0 and v2.1, the following invocation methods are supported and unsupported: | Invocation method | Supported in 2.0 / 2.1 | | ----------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Request elevation via KeeperClient**, then select the `.msi` file | ✅ Supported | | **KeeperAgent → "+" button (Request Elevation)**, then select the `.msi` file | ✅ Supported | | Double-click the `.msi` in File Explorer | ❌ Not supported (planned for 2.2) | | Right-click the `.msi` → Install | ❌ Not supported (planned for 2.2) | | `msiexec /i .msi` from Command Prompt or PowerShell | ❌ Not supported | | `Start-Process msiexec.exe -Verb RunAs ...` from PowerShell | ⚠️ Triggers a PrivilegeElevation event and the redirect rule matches, but the resulting flow does not produce a full install experience — use the Request Elevation flow instead. | ## How It Works `InstallLauncher` operates as the redirect target in the LaunchPrivilegeElevation flow: 1. The user opens **KeeperClient** (or clicks the **+** button in KeeperAgent) and selects **Request Elevation**. 2. The user browses to the `.msi` file they wish to install. 3. EPM raises a PrivilegeElevation event for `msiexec.exe` targeting the selected `.msi`. 4. The RedirectEvaluator plugin matches the configured rule and redirects execution to `InstallLauncher.exe`. 5. Install Launcher runs the `.msi` under the elevated context provided by EPM — no admin credentials required from the end user. Because `msiexec.exe` is started from within a process that is already elevated, there is no secondary UAC prompt for the installer or any helper processes it spawns. For background on the redirect capability and how redirect rules are evaluated, see [Reference: Redirect Capability](/en/keeperpam/endpoint-privilege-manager/custom-tooling/jobs-and-plugins/custom-plugin-guide/plugins-reference/redirect-capability.md). ## Required Paired PrivilegeElevation Policy {% hint style="info" icon="comment-question" %} **Important:** The RedirectEvaluator SettingsUpdate policy (shown further down) only defines the redirect rule. You must **also** have a PrivilegeElevation policy in place that matches `msiexec.exe` — the redirect fires only after PrivilegeElevation policy evaluation. Without this paired policy, the `.msi` will be re-evaluated as a FileAccess target and the flow will fall through the policy registry. {% endhint %} The paired PrivilegeElevation policy must include `"AllowChildProcesses": true`, since `msiexec.exe` spawns child processes during install. #### Example Paired PrivilegeElevation Policy (abbreviated): ```json { "PolicyName": "Allow msiexec elevation for Install Launcher", "PolicyType": "PrivilegeElevation", "Status": "enforce", "Extension": { "Targets": [ { "ExePattern": "msiexec\\.exe", "AllowChildProcesses": true } ], "Controls": { "AutoApprove": true } } } ``` ## Deployment `InstallLauncher` is built and deployed alongside other EPM components: * **Build output location:** `publishoutput/Jobs/bin/InstallLauncher/` * **Runtime location:** Deploy to the same `Jobs/bin/` directory as other EPM job tools. The `RedirectEvaluator` plugin resolves `InstallLauncher` by short name from `Jobs/bin/`. No additional path configuration is required as long as it is deployed in the standard location. ## Built-in MSI Redirect Rule The default `RedirectEvaluator` plugin definition (`KeeperPrivilegeManager/Plugins/RedirectEvaluator.json`) ships with a redirect rule for `.msi` files already configured under `metadata.redirect.rules`: ```json { "sourceExePattern": "msiexec\\.exe", "commandLinePattern": "\\.msi", "elevationOnly": true, "targetExe": "InstallLauncher", "targetArguments": "\"{FilePath}\" {CommandLine}" } ``` This rule matches any privilege elevation request where `msiexec.exe` is invoked with an `.msi` path on the command line, and redirects it to `InstallLauncher` with the file path and original command line as arguments. To modify or extend this rule — for example to restrict it to specific directories, add `nonAdminOnly`, or add rules for other installer types — edit `Plugins/RedirectEvaluator.json` directly on the endpoint, or push an updated configuration using a `SettingsUpdate` policy. See [Plugin: RedirectEvaluator](/en/keeperpam/endpoint-privilege-manager/custom-tooling/jobs-and-plugins/custom-plugin-guide/plugin-examples/redirectevaluator-plugin-configuration.md) for details on deploying rule changes centrally. ## Placeholder Tokens The `targetArguments` field in a redirect rule supports the following tokens, which `RedirectEvaluator` expands before passing them to `InstallLauncher`:
TokenValue
{FilePath}Full path of the .msi file from the elevation request
{FileName}Base file name only (e.g. installer.msi)
{Directory}Directory containing the file
{CommandLine}Command line from the original elevation request (may be empty)
The default rule uses `"{FilePath}" {CommandLine}`, which passes the full path quoted (to handle spaces) followed by any additional arguments the user or calling application supplied. ## Elevation File Extensions EPM's companion apps (Keeper Agent and Keeper Client) use a file called `elevation-allowed-extensions.json`, deployed alongside the application executable, to determine which file extensions are eligible to trigger a privilege elevation request. The `.msi` extension is included in this list by default. **To customize the allowed extensions for your deployment**, create a JSON file with the following structure and point to it using the `KEEPER_ELEVATION_EXTENSIONS_CONFIG` environment variable: ```json { "windows": [".msi", ".exe"], "linux": [".sh", ".run"], "macos": [".pkg", ".dmg"] } ``` If you omit a platform key, the built-in default for that platform is preserved. Set the environment variable `KEEPER_ELEVATION_EXTENSIONS_CONFIG` to the full path of your custom file to override the default at runtime. ## User Interface `InstallLauncher` launches `msiexec.exe` using `UseShellExecute`, which means the Windows Installer UI is fully native. Whatever interface the `.msi` package and its arguments specify is what the user sees: * No custom arguments → standard interactive installation wizard. * `/quiet` or `/qn` in the command line → silent or reduced-UI install, as defined by the package. There is no additional EPM-provided UI. `InstallLauncher` is transparent to the user. ## Silent Mode / Automation By default, `InstallLauncher` does not write anything to stderr during a normal interactive elevation — there is nothing extra for the user to see or dismiss. When running in automated or scripted contexts where a console is attached and you want failure details surfaced, enable silent mode using any of the following:
MethodValue
Command-line flag--silent or --quiet-ui or /silent
Environment variableKEEPER_INSTALL_LAUNCHER_SILENT=1 or KEEPER_INSTALL_LAUNCHER_SILENT=true
In silent mode, if `msiexec.exe` exits with a non-zero code, `InstallLauncher` writes a short failure summary to `stderr`. The process exit code is always the Windows Installer exit code regardless of this setting. ## CLI Reference `InstallLauncher` can also be invoked directly from a command prompt or script, independently of the redirect flow. This is useful for testing, automation, and scripted deployments. **Basic install:** ``` InstallLauncher C:\path\to\package.msi ``` **Silent install:** ``` InstallLauncher --silent C:\path\to\package.msi /qn ``` **Full msiexec control (repair, uninstall, product code):** ``` InstallLauncher -- /x {PRODUCT-CODE} /qn ``` Use `--` as a separator when you need to pass arguments that begin with `/` or `-` directly to `msiexec.exe` without `InstallLauncher` interpreting them as its own flags. Everything after `--` is forwarded verbatim.
ArgumentDescription
<path>.msi [args]Path to the .msi file, optionally followed by msiexec arguments
-- <msiexec args>Pass arguments directly to msiexec.exe (use for repair, uninstall, product codes)
--silent / --quiet-ui / /silentPrint failure details to stderr when msiexec exits non-zero
## Summary
TopicDetail
What it doesRuns msiexec.exe from an already-elevated process so .msi files install without a UAC prompt
How it's triggeredVia the RedirectEvaluator built-in MSI redirect rule in the LaunchPrivilegeElevation flow
Where to deployJobs/bin/InstallLauncher/ alongside other EPM job tools
Default ruleShips in Plugins/RedirectEvaluator.json; matches msiexec.exe + .msi on the command line
UINative Windows Installer UI; no EPM interface added
Silent mode--silent or KEEPER_INSTALL_LAUNCHER_SILENT=1 — stderr failure summary only; exit code is always the msiexec result
Allowed extensionsConfigured via elevation-allowed-extensions.json; override path with KEEPER_ELEVATION_EXTENSIONS_CONFIG
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://newdocs.keeper.io/en/keeperpam/endpoint-privilege-manager/custom-tooling/jobs-and-plugins/custom-plugin-guide/plugin-examples/plugin-install-launcher.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.