Node.js MSI install fails on Windows 11 due to Smart App Control blocking custom action DLL (Error 1723)

Comienza reproduciendo la instalación de Windows 11 con Smart App Control habilitado y rastrea la acción personalizada de MSI llamada SetInstallScope. Revisa cómo el MSI de Node.js empaqueta y carga su DLL de acción personalizada, y luego verifica que la instalación se complete sin Error 1723 o produzca un diagnóstico más claro para el componente bloqueado.

Version

24.15.0

Platform

Microsoft Windows NT 10.0.26200.0 x64

Subsystem

No response

What steps will reproduce the bug?

1. Open an elevated PowerShell session.
2. Run:

   Start-Process winget.exe -ArgumentList 'install --id OpenJS.NodeJS.LTS -e --accept-package-agreements --accept-source-agreements' -Verb RunAs -Wait
   

3. Wait for the installer to start.
4. Observe Windows Security notification:
   • "This app has been blocked partly"
   • "Windows Installer may not work correctly because it could not verify what MSI2C91.tmp was trying to load"
5. Installation fails.

How often does it reproduce? Is there a required condition?

Always, with Smart App Control (SAC) enabled on Windows 11.

What is the expected behavior? Why is that the expected behavior?

winget install --id OpenJS.NodeJS.LTS should complete successfully on Windows 11 with SAC enabled.

What do you see instead?

Installation fails. Windows Security / SAC blocks a temporary DLL loaded by Windows Installer during a custom action. The main MSI package is signed, but installation fails with Error 1723.

Additional information

Application log / MsiInstaller:

Product: Node.js -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run.
Action SetInstallScope, entry: SetInstallScope, library: C:\Windows\Installer\MSI2C91.tmp

CodeIntegrity / Operational:

Code Integrity determined that a process (msiexec.exe) attempted to load C:\Windows\Installer\MSI2C91.tmp that did not meet the Enterprise signing level requirements or violated code integrity policy
Smart App Control Block Details

• MSI payload downloaded by winget is signed and valid (Get-AuthenticodeSignature reports Status : Valid).
• Not caused by winget arguments, GPO, MDM, or domain-join policy.
• Blocked file: C:\Windows\Installer\MSI2C91.tmp loaded by msiexec.exe.
• SmartAppControlState: On
• CI\Policy: VerifiedAndReputablePolicyState = 1
• Block occurs when msiexec.exe loads the temporary DLL for custom action SetInstallScope.

[!NOTE]
The Node.js MSI contains a custom action named SetInstallScope. SAC appears to block the temporary custom-action DLL generated during installation, not the signed MSI package itself. If this is expected, a clearer error message identifying the blocked install step and affected component would help troubleshooting.

[!TIP]
Turn SAC off to work around.
You can turn it on later manually without a clean installation (the former documentation is obsolete if you have gotten recent Windows updates).