UAC prompt from unidentified publisher appears when uninstalling MSIs on Windows Vista and Windows Server 2008

We ran into an issue while testing the final build before we released the Windows Media Center SDK for Windows Vista that I wanted to describe here because it affects all MSI-based setups on Windows Vista and Windows Server 2008.

In preparation for shipping, we digitally signed the MSI for the Windows Media Center SDK.  When an MSI is digitally signed and you try to install it, Windows Vista lists the publisher's information in the User Account Control (UAC) elevation prompt that appears during installation.  In the case of the Windows Media Center SDK setup, the UAC prompt includes the following information:

Windows Media Center SDK
Microsoft Corporation

However, when a user attempts to uninstall the Windows Media Center SDK, the UAC prompt includes the following somewhat scary text:

An unidentified program wants to access your computer

Don't run the program unless you know where it's from or you've used it before.

Unidentified publisher

After some further investigation and discussions with the Windows Installer team, we determined that this behavior happens for all MSI-based setup packages on Windows Vista and Windows Server 2008 during uninstall.  This issue was also previously mentioned on the Windows Vista compatibility team blog.

The reason that this happens is that when installing an MSI, Windows Installer caches a copy of the MSI in the %windir%\Installer folder that is used during uninstall.  The cached MSI is different than the original MSI because Windows Installer removes unnecessary information in order to save disk space.  Once the original MSI is changed, the digital signature is invalidated.  UAC for Windows Vista and Windows Server 2008 always shows a prompt stating that an unidentified program wants to access your computer when you try to install or uninstall an MSI that does not have a valid digital signature.  For more information about how digital signatures work in Windows Installer, check out this blog post by Heath Stewart.

There is not currently anything you can do to avoid this unidentified publisher message when uninstalling an MSI on Windows Vista or Windows Server 2008.  The Windows Installer team is preparing to publish a knowledge base article describing this scenario, but I wanted to let folks know in the meantime in case you run into this issue and attempt to try to resolve it.

<update date="12/4/2006"> Added a link to a blog post written by Heath Stewart about digital signatures in Windows Installer. </update>

<update date="6/15/2008"> Added information to indicate that this issue affects Windows Server 2008 in addition to Windows Vista. </update>