[Package Issue]: JohnMacFarlane.Pandoc user install asks for administrator credentials

[apaulfox]

Please confirm these before moving forward

• I have searched for my issue and not found a work-in-progress/duplicate/resolved issue.
• I have not been informed if the issue is resolved in a preview version of the winget client.

Category of the issue

Installation issue.

Brief description of your issue

When trying to install JohnMacFarlane.Pandoc in user scope, the installer asks for administrator credentials. It appears that the flags aren't specified correctly in the installer.yaml file. It specifies:
- Architecture: x64 Scope: user InstallerUrl: https://github.com/jgm/pandoc/releases/download/3.6.2/pandoc-3.6.2-windows-x86_64.msi InstallerSha256: E9A8036CC298AE3D92105D5909C805A0A069CC988E7938703C4041B3E24A13AA InstallerSwitches: Custom: ALLUSERS=1

I believe it should be:
- Architecture: x64 Scope: user InstallerUrl: https://github.com/jgm/pandoc/releases/download/3.6.2/pandoc-3.6.2-windows-x86_64.msi InstallerSha256: E9A8036CC298AE3D92105D5909C805A0A069CC988E7938703C4041B3E24A13AA InstallerSwitches: Custom: ALLUSERS=2 MSIINSTALLPERUSER=1

These settings appear to work correctly when I run the installer standalone

Steps to reproduce

Install JohnMacFarlane.Pandoc in user scope using:
winget install -e --id JohnMacFarlane.Pandoc --scope User

Actual behavior

User Account Control window pops up asking for an admin user name and password.

Expected behavior

Application installers in user scope without administrator permission.

Environment

Windows Package Manager v1.9.25200
Copyright (c) Microsoft Corporation. All rights reserved.

Windows: Windows.Desktop v10.0.19045.4894
System Architecture: X64
Package: Microsoft.DesktopAppInstaller v1.24.25200.0

Winget Directories
-------------------------------------------------------------------------------------------------------------------------------
Logs                               %LOCALAPPDATA%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\DiagOutputDir
User Settings                      %LOCALAPPDATA%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\settings.json
Portable Links Directory (User)    %LOCALAPPDATA%\Microsoft\WinGet\Links
Portable Links Directory (Machine) C:\Program Files\WinGet\Links
Portable Package Root (User)       %LOCALAPPDATA%\Microsoft\WinGet\Packages
Portable Package Root              C:\Program Files\WinGet\Packages
Portable Package Root (x86)        C:\Program Files (x86)\WinGet\Packages
Installer Downloads                %USERPROFILE%\Downloads

Links
---------------------------------------------------------------------------
Privacy Statement   https://aka.ms/winget-privacy
License Agreement   https://aka.ms/winget-license
Third Party Notices https://aka.ms/winget-3rdPartyNotice
Homepage            https://aka.ms/winget
Windows Store Terms https://www.microsoft.com/en-us/storedocs/terms-of-sale

Admin Setting                             State
--------------------------------------------------
LocalManifestFiles                        Disabled
BypassCertificatePinningForMicrosoftStore Disabled
InstallerHashOverride                     Disabled
LocalArchiveMalwareScanOverride           Disabled
ProxyCommandLineOptions                   Disabled
DefaultProxy                              Disabled

Screenshots and Logs

No response

[similar-issues-ai]

We've found some similar issues:

• [Package Issue]: JohnMacFarlane.Pandoc #118528 , similarity score: 86%

If any of the above are duplicates, please consider closing this issue out and adding additional context in the original issue.

Note: You can give me feedback by 👍 or 👎 this comment.

[apaulfox]

We've found some similar issues:

• [Package Issue]: JohnMacFarlane.Pandoc #118528 , similarity score: 86%

If any of the above are duplicates, please consider closing this issue out and adding additional context in the original issue.

Note: You can give me feedback by 👍 or 👎 this comment.

It looks as though this issue was previously (partially?) solved in the scope of #118528, but was re-introduced in an update.

[a-mnich]

There`s two different scenarios that need to be considered.

Initial Installation:
The installer arguments of user and machine got mixed up during a version upgrade. I will create PRs to switch them after which winget should perform a correct user installation again.

Version Upgrade:
In order for winget to correctly recognize a per-user installation the registry entries need to be written to HKCU. In my tests Pandoc always wrote its ARP registry entries to HKLM during initial installation. This means that even though the application itself was correctly installed as per-user, winget will recognize this as machine installation for the next version upgrade which will then trigger the UAC prompt again.
I don't see a way to fix this within winget unless there is a combination of installer arguments that save the ARP registry entries in the correct place. Otherwise the Pandoc installer needs to be adapted to correctly save the ARP entries.

Suggested Install Arguments by @apaulfox :

msiexec.exe /i C:\Users\WDAGUtilityAccount\Downloads\JohnMacFarlane.Pandoc_3.6.2\Pandoc_3.6.2_User_X64_wix_en-US.msi ALLUSERS=2 MSIINSTALLPERUSER=1 /qn

DisplayName    : Pandoc 3.6.2
DisplayVersion : 3.6.2
Publisher      : John MacFarlane
ProductCode    : {C09543E4-2E4C-4F2C-8688-EA6E43F9DBE5}
Scope          : Machine

Correct Machine Install Arguments :

msiexec.exe /i C:\Users\WDAGUtilityAccount\Downloads\JohnMacFarlane.Pandoc_3.6.2\Pandoc_3.6.2_User_X64_wix_en-US.msi ALLUSERS=1 /qn

DisplayName    : Pandoc 3.6.2
DisplayVersion : 3.6.2
Publisher      : John MacFarlane
ProductCode    : {C09543E4-2E4C-4F2C-8688-EA6E43F9DBE5}
Scope          : Machine

Correct User Install Arguments :

msiexec.exe /i C:\Users\WDAGUtilityAccount\Downloads\JohnMacFarlane.Pandoc_3.6.2\Pandoc_3.6.2_User_X64_wix_en-US.msi ALLUSERS=2 /qn

DisplayName    : Pandoc 3.6.2
DisplayVersion : 3.6.2
Publisher      : John MacFarlane
ProductCode    : {C09543E4-2E4C-4F2C-8688-EA6E43F9DBE5}
Scope          : Machine

My tests with a direct installation through msiexec.exe as well as an adaption of the current winget manifest always concluded with the same ARP entries.

[apaulfox]

Looks like the pandoc installer is created with WiX, but the package config doesn't explicitly place anything in HKLM. There's probably some WiX defaults for ARP entries, but I'm not sure what controls this.

[apaulfox]

It looks like the update issue is a known issue with winget, as Windows installer always puts ARP entries in HKLM: microsoft/winget-cli#3011