[JENKINS-71643] Windows silent install behaves different than graphical install

[jenkins-infra-bot]

hi,

I'm trying to install Jenkins on Windows from commandline for a different
user. My usecase is, that Jenkins should be executed as a normal user (Service account) and i want to use a different user (Administrator) to do the installation for security reasons.

In the attached log file the admin is called 'Developer' and the normal user is called 'DeveloperNonadmin'

Expectation: The following command works when executed from an elevated shell:
msiexec /i D:\path\to\jenkins.msi /quiet /lv! D:\path\to\logfile.log SERVICE_USERNAME= SERVICE_PASSWORD= INSTALLDIR=D:\Jenkins PORT=8080

Actual behaviour:
The command only works when i have installed Jenkins for the service account by manually executing the GUI version of the installer. So my workaround is that i install Jenkins via the GUI installer, then uninstall it, then run my script that executes this command and does the customization afterwards.

Conclusion:
The graphical installer does soemthing that the silent installation does not do.

 

PS: i've chosen _unsorted as components because i don't know which component this actually is

---

Originally reported by johnnydoesstuff, imported from: Windows silent install behaves different than graphical install

• assignee: slide_o_mix
• status: Open
• priority: Minor
• component(s): packaging
• label(s): windows
• resolution: Unresolved
• votes: 0
• watchers: 2
• imported: 2025-11-26

Raw content of original issue

hi,

I'm trying to install Jenkins on Windows from commandline for a different
user. My usecase is, that Jenkins should be executed as a normal user (Service account) and i want to use a different user (Administrator) to do the installation for security reasons.

In the attached log file the admin is called 'Developer' and the normal user is called 'DeveloperNonadmin'

Expectation: The following command works when executed from an elevated shell:
msiexec /i D:\path\to\jenkins.msi /quiet /lv! D:\path\to\logfile.log SERVICE_USERNAME=<username> SERVICE_PASSWORD=<password> INSTALLDIR=D:\Jenkins PORT=8080

Actual behaviour:
The command only works when i have installed Jenkins for the service account by manually executing the GUI version of the installer. So my workaround is that i install Jenkins via the GUI installer, then uninstall it, then run my script that executes this command and does the customization afterwards.

Conclusion:
The graphical installer does soemthing that the silent installation does not do.

 

PS: i've chosen _unsorted as components because i don't know which component this actually is

environment

- Windows 10 VM (Hyper-V VM)<br/>
- Jenkins 2.401.2

1 attachment

• logfile-1.log

[jenkins-infra-bot]

johnnydoesstuff:

• Original comment link
• Raw content of original comment:

  I got an update on this and an easier workaround:
  
  For a silent install, the Installer has to be launched from an elevated shell, which means that it is completely executed as an admin user. This also means, that the 'INSTALLDIR' is created for this admin user and that the service account does not have the permissions to access this directory. The consequence is, that the service account is unable to start Jenkins, even if the the directory is something like D:\Jenkins.
   
  My workaround for this is that, before starting the installer, i 
  1. Create the install directory
  2. Then i assign the service account full control over that directory: icacls.exe "D:\Jenkins" /grant "DeveloperNonadmin:(OI)(CI)(F)"
   
  This command assigns
  
  	
  Full access (F)
  	
  for all objects in that direcotry (OI)
  	
  and for all subdirectories (CI)
  	
  refer to https://4sysops.com/archives/icacls-list-set-grant-remove-and-deny-permissions/#rtoc-9 for further reference
   
  So the root-cause seems that the installer is not assigning the permissions for the install directory to the service account.
  
  
  

I got an update on this and an easier workaround:

For a silent install, the Installer has to be launched from an elevated shell, which means that it is completely executed as an admin user. This also means, that the 'INSTALLDIR' is created for this admin user and that the service account does not have the permissions to access this directory. The consequence is, that the service account is unable to start Jenkins, even if the the directory is something like D:\Jenkins.
 
My workaround for this is that, before starting the installer, i 
1. Create the install directory
2. Then i assign the service account full control over that directory: icacls.exe "D:\Jenkins" /grant "DeveloperNonadmin:(OI)(CI)(F)"
 
This command assigns

• Full access (F)
• for all objects in that direcotry (OI)
• and for all subdirectories (CI)
• refer to https://4sysops.com/archives/icacls-list-set-grant-remove-and-deny-permissions/#rtoc-9 for further reference
   
  So the root-cause seems that the installer is not assigning the permissions for the install directory to the service account.

[jenkins-infra-bot]

slide_o_mix:

• Original comment link
• Raw content of original comment:

  Thanks for the debug, I'll look into this. I have never really tried the silent install method, so its probably something I should look at testing somehow 
  

Thanks for the debug, I'll look into this. I have never really tried the silent install method, so its probably something I should look at testing somehow