Silent installation

[aureq]

Hi @idrassi,

I'm wondering if you would consider having a silent install option as part of Veracrypt installer? For example, VeraCrypt Setup 1.23.exe /S or VeraCrypt Setup 1.23.exe /Silent would install the program with all its default options.

I see this as a potential benefit as it would allow IT administrators to deploy this automatically on computers they control (or through an automated Windows install).

[JuliusPIV]

I hope this message finds the reader and their family in great health & high spirits despite the difficult, if not downright punitive, year we've all had.

First, and most obvious question: What's the status of implementing silent/unattended installations?

Before I dive into what might appear to be a rant, please know and understand that I am really just here to seek understanding. If I appear to 'challenge' it's just because I'm passionate. Please know that there is no hate, malice or anger behind this. 👍 :)

I don't know that anyone who has requested this feature has received a full & logically sound answer on why it doesn't exist today, the end of 2020. I've read through a few (but not all) threads both on GitHub as well as on the old codeplex site and the responses I've seen are insufficient and easy to poke holes into. I don't think a technical or even legal explanation has been given as to why we can't have this, especially when one considers that virtually every application has some sort of agreement ( EULA, AUP, ToS etc.) that the installer/operator must agree to. Look at things like Microsoft Office, Adobe Creative Cloud, virtually every application from Litera, Citrix, VMware, VLC, Notepad++, FileZilla, 7Zip, etc. - the list goes on. In fact, some vendors require you to explicitly accept the agreement via a command line argument vs using an MSI property in the transform.

For smaller environments, doing it manually isn't a bit deal. But in an age where everyone is taking security more seriously by adhering to the Principle of Least Privilege, 'visiting' even 60 machines to perform elevated installations requires significantly more time & effort than should be required. This is compounded even further due to the situation created by COVID where most of the workforce is remote.

Those that are asking for this are just looking for a helping hand to simplify what should be a quick & easy task.
I'm hoping we can find the ZOPA, Zone Of Possible Agreement, on getting a silent/unattended install option.

Some of the reasons I've seen around are below.

"the license needs to be accepted explicitly by the user"

Add a command line switch (e.g.: /AcceptEULA) to force the admins/application packagers to accept the EULA. If you want traceability, that's easy: Log it in the installer log file, drop a bread crumb on the file system at the system level, drop a bread crumb in HKLM, put something in the Application Event log - the possibilities are almost endless.

"A better approach for the future is to implement silent installation mode and in this case the user will be presented by the license dialog upon the first run."

This makes sense: The application operator - the one using the app - must accept the license. Ok so allow the installation to execute silently and then display the EULA on the first launch for each user on the machine. If you want traceability, that's easy: drop a bread crumb on the user's user profile on file system, drop a bread crumb in HKCU, put something in the Application Event log with the user's details - the possibilities are almost endless.

"This was inherited from TrueCrypt"

Just because something was done a certain way in the past, it doesn't mean it must continue to be done that way in the future. The old "that's how we've always done it" mindset doesn't mean it's right, the only way and that there aren't better ways.

"there must be some way to log/trace the progress of the install and any errors"

This is what log files and exit codes are for. Installer runs, generates logs, if there's an error, its in the log file, the installer returns a unsuccessful exit code and from there can be be troubleshot thanks to the logs. If the installer succeeds, then that's captured in the log as well and the installer returns a non-error exit code (0, 1641, 3010 etc.)

That being said, you can always extract VeraCrypt binaries (Extract option in the setup) and then copy theses files where ever you want. The drawback is that the user will need administrative privileges to mount volumes.

That doesn't meet the ask of implementing a silent/unattended install [& uninstall] but it is also not the same as installing it normally as the product will not work in environments where users do not have local administrative privileges.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[aureq]

Hi @idrassi before the stalebot closes this issue, I'm wondering if this is something that's still of interest to you? Or, if you have any guidelines for sending a pull request?

Thank you.

[capkwantum]

Hello @idrassi
any updates on this issue?
We are looking for a better option as a "Diff-Installation"

Thank you in advance!

[idrassi]

An MSI for VeraCrypt silent installation has been implemented and first beta version (1.24-Update9-Beta-21-08-01 ) has been published in Sourceforge Nightly Build folder (look for VeraCrypt_Setup_x64_1.24-Update9-Beta-21-08-07.msi).

In order to work, ACCEPTLICENSE=YES must be set in msiexec command line.

Tests and feedback are welcomed on this new installation way.

[JuliusPIV]

An MSI for VeraCrypt silent installation has been implemented and first beta version (1.24-Update9-Beta-21-08-01 ) has been published in Sourceforge Nightly Build folder (look for VeraCrypt_Setup_x64_1.24-Update9-Beta-21-08-07.msi).

In order to work, ACCEPTLICENSE=YES must be set in msiexec command line.

Tests and feedback are welcomed on this new installation way.

Wow this is great news thank you so very much for taking the time to consider and implement! I haven't test it yet but I'll put that on the agenda for next week.

[aureq]

Hi @idrassi

Thank you so much for implementing this feature. In sort, it works as expected. But more details below.

Environment:

• Windows 10 x64 21h1 (up to date)
• AMD 5950x
• Veracrypt latest stable release installed

Silent upgrade:
msiexec /package VeraCrypt_Setup_x64_1.24-Update9-Beta-21-08-07.msi /qn ACCEPTLICENSE=YES

Results:

• Completely silent install (/qn)
• Computer restarted after installation completed
• VeryCrypt 1.24-Update9-Beta-21-8-07 is showing in the about box
• Windows shortcut to launch the app is working as previously
• Able to mount and access test volume as expected

Note:
For users/admins who don't want to immediately reboot and the end of the installation, you may want to add /promptrestart or /norestart

[Marco98]

Hi @idrassi

Many thanks on providing a msi package👍. You saved me and many others a big headache when trying to automate the installation.

I tested it on two seperate machines. One fresh install and one existing install. Works as expected on both.
When installing over an existing installation, it leaves an orphan registry key from the .exe-installer at
HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\VeraCrypt
which results in Windows showing the old and the new version in the installed software list.

For me personally this isn't an issue and i do not think many people will switch from .exe- to .msi-installer unless they know what they're doing.

[capkwantum]

An MSI for VeraCrypt silent installation has been implemented and first beta version (1.24-Update9-Beta-21-08-01 ) has been published in Sourceforge Nightly Build folder (look for VeraCrypt_Setup_x64_1.24-Update9-Beta-21-08-07.msi).

In order to work, ACCEPTLICENSE=YES must be set in msiexec command line.

Tests and feedback are welcomed on this new installation way.

Thank you for this change!

I have some problems with restart after the installation. Neither /norestart nor REBOOT=REALLYSUPPRESS are helping to prevent the restart windows from popping up

Any ideas?

Cheers

[idrassi]

Thank you all for your feedback.
I have implemented /norestart compatibility and I fixed the duplicated entries for VeraCrypt if it was installed using exe previously.
I have uploaded 1.25-RC1 build containing this to Sourceforge Night Build under "Windows" folder.
As usual, feedback are welcomed.

PS: 1.24-Update9 will be skipped in favor of 1.25 because of the changes in supported OS

[Marco98]

Hi @idrassi
Many thanks for your work 👍🏻
However directory for the nightly windows builds at sourceforge seems to be empty right now:

[kasra130]

An MSI for VeraCrypt silent installation has been implemented and first beta version (1.24-Update9-Beta-21-08-01 ) has been published in Sourceforge Nightly Build folder (look for VeraCrypt_Setup_x64_1.24-Update9-Beta-21-08-07.msi).

In order to work, ACCEPTLICENSE=YES must be set in msiexec command line.

Tests and feedback are welcomed on this new installation way.

Hey I cant find the MSI anywhere.. Any chance you could post it?

[smallfry42]

An MSI for VeraCrypt silent installation has been implemented and first beta version (1.24-Update9-Beta-21-08-01 ) has been published in Sourceforge Nightly Build folder (look for VeraCrypt_Setup_x64_1.24-Update9-Beta-21-08-07.msi).
In order to work, ACCEPTLICENSE=YES must be set in msiexec command line.
Tests and feedback are welcomed on this new installation way.

Hey I cant find the MSI anywhere.. Any chance you could post it?

I'd like that very much.

[idrassi]

I have uploaded version 1.25-RC2 of the MSI to https://sourceforge.net/projects/veracrypt/upload/VeraCrypt%20Nightly%20Builds/Windows/. I'm also attaching it below with its PGP signature.
Feedback is welcomed.

VeraCrypt_Setup_x64_1.25-RC2.zip

[sreith1]

Thanks for the msi-Release!

I tested deploying the msi in an Windows Domain per Group Policy. For ACCEPTLICENSE=YES I created an mst file by Orca.

Both installation and uninstalling work like a charm!

(I didn't manage to prevent installing desktop icons by INSTALLDESKTOPSHORTCUT testing the values "", 0 and NO, but thats a minor limitation.)

[idrassi]

MSI package with silent install support is now part of standard VeraCrypt distribution.

[gkourtellas]

hi

i know this is closed but, am i the only one that i cant make it work silently ?
i m using the latest msi from here https://www.veracrypt.fr/en/Downloads.html and although it recognizes the switches, it doenst install