The Setup.exe program is unable to remove security code groups that were created during the installation of SQL Server 2008
Symptoms
Consider the following scenario. You run the Setup.exe program to install Microsoft SQL Server 2008. The Setup.exe program is stopped suddenly before it is completed, either intentionally or because of a power failure. In this scenario, the Setup.exe program is unable to remove security code groups that were created during the installation. Therefore, the computer may be left vulnerable to attack.
Note Code groups are created to allow for users to run the Setup.exe program from a network share.
Resolution
To work around this problem, use the Code Access Security Policy tool to manually remove the security code groups. To do this, follow these steps.
Notes You must have machine-level security policy to use the Code Access Security Policy tool.For more information, visit the following Microsoft Developer Network (MSDN) Web site:
http://msdn.microsoft.com/en-us/library/cb6t8dtz(VS.80).aspx(http://msdn.microsoft.com/en-us/library/cb6t8dtz(VS.80).aspx)If the Code Access Security Policy tool is not located on the computer, reinstallthe Microsoft .NET Framework 3.5. To download the .NET Framework 3.5, visit the following Microsoft Web site:
http://www.microsoft.com/downloads/details.aspx?familyid=333325fd-ae52-4e35-b531-508d977d32a6&displaylang=en(http://www.microsoft.com/downloads/details.aspx?familyid=333325fd-ae52-4e35-b531-508d977d32a6&displaylang=en)Click Start, click Run, type cmd, and then click OK.Locate one orboth of the following folders, depending on your operating system:
32-bit editions of Windows
%systemdrive%\Microsoft.NET\Framework\v2.0.50727
64-bit editions of Windows
Note In 64-bit editions of Windows, you must run the CasPol.exe –q –rg code group command in the following folders: %systemdrive%\Microsoft.NET\Framework\v2.0.50727%systemdrive%\Microsoft.NET\Framework64\v2.0.50727For each security code group that is listed in this step, type the following command, and then press ENTER.
Note You do not have to restart the computer after you run the command for each security code group.
Command
CasPol.exe -q -rg code_group_nameNote In this command, the placeholder code_group_name represents the name of the security code group.
Security code groupsMSVCM80MICROSOFT.SQLSERVER.CHAINER.SETUPMICROSOFT.SQL.CHAINER.PACKAGEMICROSOFT.SQLSERVER.CHAINER.INFRASTRUCTUREMICROSOFT.SQLSERVER.CONFIGURATION.BOOTSTRAPEXTENSIONMICROSOFT.SQLSERVER.SETUP.CHAINER.WORKFLOWMICROSOFT.SQLSERVER.CONFIGURATION.SQLCONFIGBASEMICROSOFT.SQLSERVER.CONFIGURATION.SFCMICROSOFT.SQLSERVER.CONFIGURATION.SETUPEXTENSIONMICROSOFT.SQLSERVER.CONFIGURATION.MSIEXTENSIONMICROSOFT.SQLSERVER.CHAINER.EXTENSIONCOMMONMICROSOFT.SQLSERVER.CONFIGURATION.SCOMICROSOFT.SQLSERVER.CONFIGURATION.CONFIGEXTENSIONMICROSOFT.SQLSERVER.DISCOVERYMICROSOFT.SQLSERVER.CONFIGURATION.UIEXTENSIONMICROSOFT.SQLSERVER.CONFIGURATION.SSTRINGMICROSOFT.SQLSERVER.CONFIGURATION.WIZARDFRAMEWORKMICROSOFT.SQLSERVER.CONFIGURATION.INSTALLWIZARDFRAMEWORKMICROSOFT.SQLSERVER.CONFIGURATION.INSTALLWIZARDMICROSOFT.SQLSERVER.MANAGEMENT.CONTROLSMICROSOFT.SQLSERVER.CONFIGURATIONMICROSOFT.SQLSERVER.CONFIGURATION.CONNECTIONINFOMICROSOFT.SQLSERVER.CONFIGURATION.RULESENGINEEXTENSIONMICROSOFT.SQLSERVER.CONFIGURATION.CLUSTERMSCLUSTERLIBMICROSOFT.SQL.CHAINER.PACKAGEDATAMICROSOFT.SQL.CHAINER.PRODUCTMICROSOFT.NETENTERPRISESERVERS.EXCEPTIONMESSAGEBOXLANDINGPAGEMICROSOFT.SQLSERVER.CONFIGURATION.SLPEXTENSIONMICROSOFT.SQLSERVER.CONFIGURATION.AGENTEXTENSIONMICROSOFT.SQLSERVER.CONFIGURATION.POWERSHELLEXTENSIONMICROSOFT.SQLSERVER.CONFIGURATION.SSISEXTENSIONMICROSOFT.SQLSERVER.CONFIGURATION.ASEXTENSIONMICROSOFT.SQLSERVER.CONFIGURATION.REPL_CONFIGEXTENSIONMICROSOFT.SQLSERVER.CONFIGURATION.MANAGEMENTTOOLSEXTENSIONMICROSOFT.SQLSERVER.CONFIGURATION.SQLSERVER_CONFIGEXTENSIONMICROSOFT.SQLSERVER.CONFIGURATION.SNISERVERCONFIGEXTMICROSOFT.SQLSERVER.CONFIGURATION.SQLBROWSEREXTENSIONMICROSOFT.SQLSERVER.CONFIGURATION.RSEXTENSIONMICROSOFT.SQLSERVER.CONFIGURATION.DMFMICROSOFT.SQLSERVER.CONFIGURATION.SMOMICROSOFT.SQLSERVER.CONFIGURATION.SQLENUMMICROSOFT.SQLSERVER.CONFIGURATION.FULLTEXT_CONFIGEXTENSIONFIXSQLREGISTRYKEYMICROSOFT.SQLSERVER.CHAINER.SETUP.RESOURCESMICROSOFT.SQLSERVER.CHAINER.INFRASTRUCTURE.RESOURCESMICROSOFT.SQLSERVER.CONFIGURATION.BOOTSTRAPEXTENSION.RESOURCESMICROSOFT.SQLSERVER.CONFIGURATION.SQLCONFIGBASE.RESOURCESMICROSOFT.SQLSERVER.CONFIGURATION.SFC.RESOURCESMICROSOFT.SQLSERVER.CONFIGURATION.SETUPEXTENSION.RESOURCESMICROSOFT.SQLSERVER.CONFIGURATION.MSIEXTENSION.RESOURCESMICROSOFT.SQLSERVER.CHAINER.EXTENSIONCOMMON.RESOURCESMICROSOFT.SQLSERVER.CONFIGURATION.SCO.RESOURCESMICROSOFT.SQLSERVER.CONFIGURATION.CONFIGEXTENSION.RESOURCESMICROSOFT.SQLSERVER.DISCOVERY.RESOURCESMICROSOFT.SQLSERVER.CONNECTIONINFO.RESOURCESMICROSOFT.SQLSERVER.CONFIGURATION.UIEXTENSION.RESOURCESMICROSOFT.SQLSERVER.CONFIGURATION.WIZARDFRAMEWORK.RESOURCESMICROSOFT.SQLSERVER.CONFIGURATION.INSTALLWIZARDFRAMEWORK.RESOURCESMICROSOFT.SQLSERVER.CONFIGURATION.INSTALLWIZARD.RESOURCESMICROSOFT.SQLSERVER.MANAGEMENT.CONTROLS.RESOURCESMICROSOFT.SQLSERVER.CONFIGURATION.RESOURCESMICROSOFT.SQLSERVER.CONFIGURATION.CONNECTIONINFO.RESOURCESMICROSOFT.SQLSERVER.CONFIGURATION.RULESENGINEEXTENSION.RESOURCESLANDINGPAGE.RESOURCESIf the security code group is not located on the computer, the following error message is returned:
1. c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727>caspol -remgroup blah
2. Microsoft (R) .NET Framework CasPol 2.0.50727.1433
3. Copyright (c) Microsoft Corporation.All rights reserved.
4.
5. ERROR: Invalid label or name
6.
7. Usage: caspol <option> <args> …
8.
9. caspol -rg
10. caspol -remgroup <label|name>
11. Remove code group at <label|name>
12.
13.
14. where “<mship>” can be:
15. -allcodeAll code
16. -appdirApplication directory
17. -custom <xml_file>Custom membership condition
18. -hash <hashAlg> {-hex <hashValue>|-file <assembly_name>}
19. Assembly hash
20. -pub {-cert <cert_file_name> | -file <signed_file_name> | -hex <hex_string>}
21. Software publisher
22. -gacInstalled in the Global Assembly Cache
23. -site <website>Site
24. -strong {-file <assemblyfile_name> | -hex <public_key>}
25. {<name> | -noname} {<version> | -noversion}
26. Strong name
27. -url <url>URL
28. -zone <zone_name>Zone, where zone can be:
29. MyComputer
30. Intranet
31. Trusted
32. Internet
33. Untrusted
34.
35. where “<flag>” can be any combination of:
36. -exclusive {on|off}
37. Set the policy statement Exclusive flag
38. -levelfinal {on|off}
39. Set the policy statement LevelFinal flag
40. -n[ame] <name>
41. Code group name
42. -d[escription] <desc>
43. Code group description
44.
45. c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727>If the security code group is deleted when you run the caspol.exe –q –rg code group command, the following message is returned:
1. c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727>caspol -remgroup blah
2. Microsoft (R) .NET Framework CasPol 2.0.50727.1433
3. Copyright (c) Microsoft Corporation.All rights reserved.
4.
5. The operation you are performing will alter security policy.
6. Are you sure you want to perform this operation? (yes/no)
7. y
8. Removed code group from the Machine level.
9. Success