Update fails on machine requiring administration privileges to install software

rgad

Seems 1Password doesn't digitally sign their install files, and such, 1password doesn't automatically update its software and I'm constantly having to run download the new install file and then install with administrator credentials to allow 1Password to update.
Further, the Chrome extension seems to require needing to run Chrome as an administrator the first time for the chrome extension to work after an update.
Can you guys try to fix this? Its really annoying considering the amount of updates you release.
Thx

---

1Password Version: 6.7.457 although I'm being told there's an update.
Extension Version: 4.6.12.90
OS Version: Windows 10
Sync Type: 1Password.com

MikeT

Hi @rgad,

Thanks for reporting this.

We do sign our files including our installer (here's Virustotal.com's report confirming the signature) and we don't require administrative rights anymore as of 1Password 6.8. 1Password 6.7 may require at the very end of the install but you can deny it and it'll still install.

It sounds the installer wasn't able to install anything due to locked files, we've seen this frequently with certain anti-malware solutions. Can you tell me which anti-malware solution you're using? Try this:

1. First, download but do not yet install 1Password 6.8.496 from here: https://1Password.com/downloads/
2. Uninstall your current 1Password version via the Control Panel or Apps & Features if you're on Windows 10
3. Reboot your computer and then run the 1Password 6.8 installer you've downloaded from step 1.

That should get 1Password updated on your PC but the next update may not work if it was your anti-malware solution. You may have to whitelist 1Password to allow it to install updates.

Further, the Chrome extension seems to require needing to run Chrome as an administrator the first time for the chrome extension to work after an update.

Can you clarify what you mean? When installing an update, the 1Password extension will disable itself for 20-30 seconds to allow 1Password to finish its install. It should re-enable itself in a minute or two or you can just restart Chrome.

However, no admin right is required either. Only Chrome handles the extension installation and extensions cannot require admin rights like this.

MikeT

One more thing, do not run the 1Password installer with admin rights, it is not never the right thing to do for any situations.

Installing an app with admin rights is also not a good idea and is a security risk, it should not be done in general. The proper thing is for the app to ask you for admin rights when it needs it.

rgad

Mike,
I cannot uninstall 1Password as its not showing up in my installed programs (either in Control Panel, or VIA apps in Settings). Is there a manual way to uninstall?

MikeT

Hi @rgad,

Open Windows File Explorer and enter the following in the address bar: %LOCALAPPDATA%\1Password\app\6\

You should see a file called unins000.exe. Run it to uninstall 1Password.

You'll also want to log into your administrator account and run the uninstaller in there as well. Installing 1Password with admin rights may have added its installer/uninstaller to your admin account instead.

rgad

Okay, Malwarebytes completely uninstalled, 1Password uninstalled and re-installed (still required administration privileges to install). We'll see what happens next time you guys update.. something tells me I'll be coming back. Thanks for your help

Greg

@rgad: Thank you for keeping us posted! Did you install 6.8.496? As Mike mentioned above, we do not require administrative rights as of 1Password 6.8, so I am not sure why they are required on your side.

Thanks in advance! :+1:

Cheers,
Greg

rgad

nope....

AGAlumB

@rgad: I'm a bit confused, as we haven't been releasing updates lately. But nevertheless, that's no good at all. Just to confirm, did you already uninstall 1Password completely as Mike suggested, and install it without admin rights? This is simply not how 1Password works:

(still required administration privileges to install)

So it sounds like you're installing as admin anyway, perhaps accidentally. It really appears that installing it with admin rights is the root (no pun intended) cause, as the update process does not use that if you're running it in a different account, so definitely install it without and let me know.

rgad

this is a company PC, and all company PC require admin rights to install any software (part of group policy). Thankfully I am an admin..

bundtkate

@rgad: If the need to install as admin is enforced by Group Policy, there may be no avoiding the need to install with admin rights. As Greg mentioned, admin rights aren't requested by 1Password as of version 6.8, so any continued request for admin permissions would likely be resulting from Group Policy. Still, your screenshot a few replies up indicates an update is available, which shouldn't be the case if you're using version 6.8 since this is the latest version. When you uninstalled 1Password initially, did you reboot before reinstalling and are you certain you downloaded and ran the installer for the latest version of 1Password? If Malwarebytes was causing trouble, the reboot in particular can be key. Those files that were locked and thus not able to be replaced may not be unlocked until you've rebooted. I'd give uninstalling, rebooting, then reinstalling the latest version another try to see if this fixes that update request.

AGAlumB

@rgad: Just to clarify in case it helps, the problem isn't admin itself, but rather that you need to install 1Password as the user account you want to use it under. Otherwise its files will be owned by another account and cannot be updated by the one you're using in that case.

rgad

So you guys have no implementation/workflow for enterprise? Hmm.. ok..

bundtkate

@rgad: We do have a method for enterprise deployment, but it is designed for when the enterprise itself is using 1Password and they have one or more IT people deploying 1Password to everyone's user folder. It's also not as flexible as some enterprises would likely need, which is something we definitely want to improve on. Still, taking some steps from that deployment method may help out here. Could you try xcopying your 1Password folder to your user folder? Here's how:

1. Find your 1Password folder. It's likely in Program Files and should have 3 subfolders: app, data and logs. The logs folder is a more recent development, so it may not be there if you're on an older version of the app. Xcopy the 1Password folder to %LOCALAPPDATA%.

2. After xcopy is done, pass the /setup (which runs silently) command line argument to update the registry to enable Native Messaging support, which is needed to communicate with the 1Password extensions: %LOCALAPPDATA%\1Password\6\app\AgileBits.OnePassword.Desktop /setup

Give using 1Password a try and make sure everything is still working properly. Also, please do let us know if you're still seeing an update prompt afterwards and specifically what version is installed. We may want to take a closer look at some things as the fact that you're being prompted for an update at all when you theoretically installed the latest version is still nagging me a bit.

AGAlumB

@rgad: Installing every app as admin is incredibly risky, so I don't see many "enterprises" even allowing that, much less requiring it. :unamused:

rgad

@bundtkate My 1Password app already resides in my appdata folder (appdata\local).. so, not really sure what you're suggesting I do there..

@brenty We image all our machines, which includes a variety of software, we push additional items using SCCM. User laptops are locked down and so administration rights are required to install software. This may assign some data to the administrative login account depending on how your setup works. We have over 5000 machines running, and we've never run into a problem like this that requires so much hand holding to install software.

AGAlumB

@rgad: I hear you. But then again, neither have we seen this much trouble with what's really a very simple install (no system files, everything in one folder, etc.), and we have a lot more than 5000 users. I'm not sure why you're still having trouble with this.

Let's get back to basics. If you've tried all of our suggestions, I'm not sure why it wouldn't work only for you. Are the permissions maybe incorrect, since you're installing as admin but the files are located in the user folder? Use cases like yours are exactly why we don't require admin rights anymore, but I'm wondering if that's just making it easier for you to get into trouble, installing as admin anyway so it can't work properly without admin rights. From your description, it really sounds like it's something to do with your process. I just haven't heard of anyone else having these issues:

Seems 1Password doesn't digitally sign their install files,

Yes, we do:

So I wonder if your certificate store is messed up, if you're seeing something different.

and such, 1password doesn't automatically update its software and I'm constantly having to run download the new install file and then install with administrator credentials to allow 1Password to update.

1Password 6 doesn't require admin rights at all, as that was something many of our customers have requested. I was going to post a screenshot...but I realized that there's no way for me to show it not requiring admin rights.

Further, the Chrome extension seems to require needing to run Chrome as an administrator the first time for the chrome extension to work after an update.

I've never heard of anyone having to run Chrome as admin for any reason, and certainly it isn't something that the 1Password extension requires (there isn't a way for us to even do that). The only thing I can think of is that because you've installed 1Password as admin, its Native Messaging host which connects to Chrome also needs to run as admin now, hence requiring the escalation in Chrome as well. You're right that 1Password is different than other apps you're installing, as it has these moving parts because you expect to be able to use it in the browser.

Anyway, I think maybe you're getting hung up on the folder here. The purpose of Kate's suggestion was to ensure that the user account which needs to run the app is the one that owns the files. Have you tried that? But at the end of the day, if you're pushing installs remotely anyway, you could do the same for each new version of 1Password (rather than having it autoupdate, which it cannot if file ownership is wrong). Just make sure you don't delete %LOCALAPPDATA%\1Password\data or the app will need to be setup again. Otherwise copying over the program files should work.

rgad

@bundtkate per @brenty's comments, I tried your suggestions.

not sure if this is related or not, or if you mistyped, but you listed the URL as:
%LOCALAPPDATA%\1Password\6\app\AgileBits.OnePassword.Desktop /setup

on my setup its:
%LOCALAPPDATA%\1Password\app\6\AgileBits.OnePassword.Desktop /setup

however the issue seems to persist..

@brenty I reapplied permissions to the entire 1Password folder in appdata giving the local user (myself) full control over all files, and that didn't resolve the issue either.

See image
attached, trying to update from within 1Password, the app sees the new version, and it able to download it, but just sits on updating...

bundtkate

@rgad: I feel like when I pop in here, it's always with something piddly (sorry!), but did you fully exit 1Password (1Password menu > Exit) and restart your browser after reapplying permissions? My concern being that one of the processes behind the scenes may not have exited and thus still be running as admin and need admin permissions to terminate them for the update.

As for that link, you're right. I'm not sure if we swapped that at some point or if the article I ganked that language from is just wrong, but since I wrote the article in the first place, I have only myself to blame. Thanks for pointing it out and I'm off to fix it. :chuffed:

rgad

@bundtkate I restarted my machine, and quit all associated 1Password processes and applications, made sure no browsers were running and reapplied permissions.

As you can see from attached image, that did not resolve this issue.

It seems support doesn't have a solution for this, is that correct? Short of not installing the program with administration credentials, which isn't an option.

If you install 1Password under one profile, is it available to other profiles?

AGAlumB

It seems support doesn't have a solution for this, is that correct? Short of not installing the program with administration credentials, which isn't an option.

@rgad: Right, 1Password needs to be run under the user account that it's installed as. That is an option tat Windows readily supports (and that has been generally recommended on Windows for over a decade now), but unfortunately we don't have any control over the restrictions other parties institute. :(

If you install 1Password under one profile, is it available to other profiles?

Correct. 1Password is installed and run in the user folder, so it would need to be installed for each individual user. Otherwise one could have it running while another tries to update it — essentially the same problem you're running into here. I'm sorry I don't have better news for you. :blush:

rgad

@brenty @bundtkate seeing as 1Password isn't designed to install updates on my machine, is there a way to disable all notifications about updates so I don't receive them?

AGAlumB

@rgad: It isn't possible to specifically disable the notifications, but you can disable automatic updates in 1Password Settings > Updates so that you can just install them on your own.