签名MSP补丁在Windows更新后免UAC静默安装的标准方案咨询

背景 #

我们有一款Windows客户端软件，初始安装需要管理员权限，过去数年一直通过UAC Patching机制分发同证书签名的MSP补丁——权限受限用户可静默应用补丁，运行稳定。

问题现象 #

2025年8月12日安装修复CVE-2025-50173的Windows更新（KB5063709、KB5063878）后，原本可由受限用户正常应用的补丁，现在必须输入管理员凭据才能安装；且静默模式下无提示，管理员执行也会报错。

日志分析 #

补丁权限验证正常 #

日志显示补丁通过软件限制策略，处于unrestricted授权级别：

MSI (s) (E4:C4): SOFTWARE RESTRICTION POLICY: Verifying patch --> 'C:\...\patch.msp' against software restriction policy
MSI (s) (E4:C4): SOFTWARE RESTRICTION POLICY: C:\...\patch.msp has a digital signature
MSI (s) (E4:C4): SOFTWARE RESTRICTION POLICY: C:\...\patch.msp is permitted to run at the 'unrestricted' authorization level.

补丁符合LUA补丁标准，本应自动提权 #

日志表明补丁满足LUA补丁条件，且安装进程已处于提权状态：

MSI (s) (04:F0): MSI_LUA: Setting AdminUser property to 1 because the product is already installed managed and per-machine
MSI (s) (04:F0): PROPERTY CHANGE: Adding AdminUser property. Its value is '1'.
MSI (s) (04:F0): MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated.
MSI (s) (04:F0): PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is '1'.
MSI (s) (04:F0): PROPERTY CHANGE: Adding Privileged property. Its value is '1'.
MSI (s) (E4:C4): Product is admin assigned: LocalSystem owns the publish key.
MSI (s) (E4:C4): Product is managed.
MSI (s) (E4:C4): Running product with elevated privileges: Product is assigned.
MSI (s) (E4:C4): Validating digital signature of file 'C:\...\d99c0.msp'
MSI (s) (E4:C4): File 'C:\...\d99c0.msp' is a validly signed file and validates according to authoring of MSI package
MSI (s) (E4:C4): Patch C:\...\patch.msp will be applied because it meets the LUA patch criteria

新更新触发的限制导致失败 #

Windows更新后，MSI将补丁判定为“repair”操作，静默模式下无法弹出凭据提示，直接报错：

MSI (s) (C4:00): MSI_LUA: Installation UI level is silent but Credential prompt required as the user is running repair and deployment compliance state is 3 so failing in future

后续日志明确错误原因：

MSI (s) (C4:00): MSI_LUA: Credential prompt is required now as the user is running repair
MSI (s) (C4:00): MSI_LUA: Elevation prompt disabled for silent installs
MSI (s) (C4:00): Note: 1: 1730 
MSI (s) (C4:00): Error 1730. You must be an Administrator to remove this application. To remove this application, you can log on as an Administrator, or contact your technical support group for assistance.

对比未安装该更新的设备，同一补丁日志仅标记为“minor upgrade patch”，无repair/remove相关判定。

已尝试的非理想方案 #

• Autodesk支持建议修改注册表（如DisableLUAInRepair）：有效但权限范围过大，签名补丁本不应需要此类操作
• 考虑AllowLockdownPatch：存在安全风险，非理想选择

核心问题 #

针对此次Windows更新的变更，是否存在标准、受支持的方式，让签名MSP补丁在静默模式下无需管理员凭据即可正常应用？

内容的提问来源于stack exchange，提问作者DSway