Node.js MSI install fails on Windows 11 due to Smart App Control blocking custom action DLL (Error 1723)

Version

24.15.0

Platform

Microsoft Windows NT 10.0.26200.0 x64

Subsystem

No response

What steps will reproduce the bug?

1. Open an elevated PowerShell session.
2. Run:

   Start-Process winget.exe -ArgumentList 'install --id OpenJS.NodeJS.LTS -e --accept-package-agreements --accept-source-agreements' -Verb RunAs -Wait
   

3. Wait for the installer to start.
4. Observe Windows Security notification:
   • "This app has been blocked partly"
   • "Windows Installer may not work correctly because it could not verify what MSI2C91.tmp was trying to load"
5. Installation fails.

How often does it reproduce? Is there a required condition?

Always, with Smart App Control (SAC) enabled on Windows 11.

What is the expected behavior? Why is that the expected behavior?

winget install --id OpenJS.NodeJS.LTS should complete successfully on Windows 11 with SAC enabled.

What do you see instead?

Installation fails. Windows Security / SAC blocks a temporary DLL loaded by Windows Installer during a custom action. The main MSI package is signed, but installation fails with Error 1723.

Additional information

Application log / MsiInstaller:

Product: Node.js -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run.
Action SetInstallScope, entry: SetInstallScope, library: C:\Windows\Installer\MSI2C91.tmp

CodeIntegrity / Operational:

Code Integrity determined that a process (msiexec.exe) attempted to load C:\Windows\Installer\MSI2C91.tmp that did not meet the Enterprise signing level requirements or violated code integrity policy
Smart App Control Block Details

• MSI payload downloaded by winget is signed and valid (Get-AuthenticodeSignature reports Status : Valid).
• Not caused by winget arguments, GPO, MDM, or domain-join policy.
• Blocked file: C:\Windows\Installer\MSI2C91.tmp loaded by msiexec.exe.
• SmartAppControlState: On
• CI\Policy: VerifiedAndReputablePolicyState = 1
• Block occurs when msiexec.exe loads the temporary DLL for custom action SetInstallScope.

[!NOTE]
The Node.js MSI contains a custom action named SetInstallScope. SAC appears to block the temporary custom-action DLL generated during installation, not the signed MSI package itself. If this is expected, a clearer error message identifying the blocked install step and affected component would help troubleshooting.

[!TIP]
Turn SAC off to work around.
You can turn it on later manually without a clean installation (the former documentation is obsolete if you have gotten recent Windows updates).

首先，在启用 Smart App Control 的 Windows 11 上复现安装过程，并跟踪名为 SetInstallScope 的 MSI 自定义操作。检查 Node.js MSI 如何打包和加载其自定义操作 DLL，然后验证安装是否能在没有 Error 1723 的情况下完成，或者是否会为被阻止的组件生成更清晰的诊断信息。