My company has been using serviceui.exe to allow user interaction on installations. In this case we always have to check the option to run the process as 32 bit. This is what we found so far:

• We were able to successfully view the process under the user session in all cases only on Windows 7 64 bits.
• If using Windows 7 32 bits serviceui.exe always fails with exit code -1 on the AppEnforce.log.
  Anderson Cassimiro
  

# Remove the scheduled task if it exists
    $schTaskBlockedAppsName = "$installName" + "_BlockedApps"
    If (Get-ScheduledTask -ContinueOnError $true | Select TaskName | Where { $_.TaskName -eq "\$schTaskBlockedAppsName" } ) {
        Write-Log "Deleting Scheduled Task [$schTaskBlockedAppsName] ..."
        Execute-Process -FilePath $exeSchTasks -Arguments "/Delete /TN $schTaskBlockedAppsName /F"
    }
}

This script performs the installation or uninstallation of an application(s).  

The script is provided as a template to perform an install or uninstall of an application(s). 
The script either performs an "Install" deployment type or an "Uninstall" deployment type.
The install deployment type is broken down in to 3 main sections/phases: Pre-Install, Install, and Post-Install.
The script dot-sources the AppDeployToolkitMain.ps1 script which contains the logic and functions required to install or uninstall an application.
To access the help section,

Deploy-Application.ps1

Deploy-Application.ps1 -DeploymentType "Silent"

Deploy-Application.ps1 -AllowRebootPassThru -AllowDefer

Deploy-Application.ps1 -Uninstall 

The type of deployment to perform. [Default is "Install"]

Specifies whether the installation should be run in Interactive, Silent or NonInteractive mode.
Interactive = Default mode
Silent = No dialogs
NonInteractive = Very silent, i.e. no blocking apps. Noninteractive mode is automatically set if an SCCM task sequence or session 0 is detected.

Allows the 3010 return code (requires restart) to be passed back to the parent process (e.g. SCCM) if detected from an installation. 
If 3010 is passed back to SCCM a reboot prompt will be triggered.

Http://psappdeploytoolkit.codeplex.com

[ValidateSet("Install","Uninstall")] 
[string] $DeploymentType = "Install",
[ValidateSet("Interactive","Silent","NonInteractive")]
[string] $DeployMode = "Interactive",
[switch] $AllowRebootPassThru = $false

*===============================================

* VARIABLE DECLARATION

*===============================================

*===============================================

Variables: Application

*===============================================

Variables: Script - Do not modify this section

Variables: Environment

Dot source the App Deploy Toolkit Functions

*===============================================

* END VARIABLE DECLARATION

*===============================================

*===============================================

* PRE-INSTALLATION

*===============================================

# Show Welcome Message, close web browsers if required, and verify there is enough disk space to complete the install
Show-InstallationWelcome -CloseApps "iexplore,chrome,firefox" -CheckDiskSpace -PersistPrompt

# Show Progress Message (with the default message)
Show-InstallationProgress "Do not open any browsers doing so will probably make this installation fail. Call Jose @ x4524 if you have any problems with the java installation."
Show-BalloonTip "Please do not open any browsers during the installation!" -BalloonTipTitle "Updating Java"
# Uninstall any previous JRE version
Remove-MSIApplications "Java(TM) 6 Update"
Remove-MSIApplications "Java 7 Update"

*===============================================

* INSTALLATION

*===============================================

# Perform installation tasks here

Execute-MSI -Action Install -Path "jre1.7.0_65.msi" -Parameters "SPONSORS=0 ALLUSERS=1 JAVAUPDATE=0 AUTOUPDATECHECK=0 REBOOT=REALLYSUPPRESS WEBSTARTICON=0 SYSTRAY=0   /qn" 

*===============================================

* POST-INSTALLATION

*===============================================

# Disable Java Expiration warning (JRE 7u30+)
Add-Content "$envUserProfile\AppData\LocalLow\Sun\Java\Deployment\deployment.properties" "deployment.expiration.check.enabled=false" -ErrorAction SilentlyContinue

*===============================================

* UNINSTALLATION

*===============================================

# Show Welcome Message, close web browsers if required with a 60 second countdown before automatically closing
Show-InstallationWelcome -CloseApps "iexplore,chrome,firefox" -CloseAppsCountdown "60"

# Show Progress Message (with the default message)
Show-InstallationProgress
Show-BalloonTip "Thank you for your patience" -BalloonTipTitle "Installation Completed"
# Perform uninstallation tasks here
Execute-MSI -Action Uninstall -Path "jre1.7.0_65.msi"

*===============================================

* END SCRIPT BODY

*===============================================

Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" -Recurse |
ForEach-Object { Get-ItemProperty $_.pspath } |
Where-Object {$_.Debugger -like "*ShowBlockedAppDialog*"} |
Remove-ItemProperty -Name Debugger

• ... tackTrace)`)"; Write-Log "$exceptionMessage"; Show-DialogBox -Text $exceptionMes ...
• ~~~~~~~~~
  
  • CategoryInfo : ObjectNotFound: (Write-Log:String) [], CommandNotFoundException
  • FullyQualifiedErrorId : CommandNotFoundException
    

• Exit-Script -ExitCode 0 # Otherwise call the Exit-Script function to perform fin ...
• ~~~~~~~~~~~
  
  • CategoryInfo : ObjectNotFound: (Exit-Script:String) [], CommandNotFoundException
  • FullyQualifiedErrorId : CommandNotFoundException
    

Show-InstallationWelcome -CloseApps "concentr,pnamain,receiver,wfcrun32,wfica32" -AllowDefer -DeferTimes 10

Else
{
    Write-Log -Message "Execution failed with exit code [$returnCode]" -Component ${CmdletName} -Severity 3
    If ($FilePath -match 'msiexec')
    {
        Get-MsiExitCodeMessage -MsiErrorCode $returnCode
    }
}

Function Get-MsiExitCodeMessage
{
<#
    .SYNOPSIS
        Get message for MSI error code
    .DESCRIPTION
        Get message for MSI error code by reading it from msimsg.dll
    .PARAMETER MsiErrorCode
        MSI error code
    .EXAMPLE
        Get-MsiExitCodeMessage -MsiErrorCode 1618
    .LINK
        http://msdn.microsoft.com/en-us/library/aa368542(v=vs.85).aspx
#>
    [CmdletBinding()]
    Param
    (
        [Parameter(Mandatory=$true)]
        [ValidateNotNullorEmpty()]
        [uint32]$MsiErrorCode
    )
    
    Begin
    {
        ${CmdletName} = $PSCmdlet.MyInvocation.MyCommand.Name
        
        $MsiErrorCodeMsgSource = @"
        /// Get error message from msimsg.dll resource dll
        using System;
        using System.Text;
        using System.Runtime.InteropServices;
        public class MsiErrorCode
        {
            public static string GetMessageFromMsiErrCode(uint errCode) 
            {
                string libPath = "msimsg.dll";
                IntPtr hModuleInstance = LoadLibraryEx(libPath, IntPtr.Zero, LoadLibraryFlags.LOAD_LIBRARY_AS_DATAFILE);
                
                StringBuilder sb = new StringBuilder(255);
                LoadString(hModuleInstance, errCode, sb, sb.Capacity + 1);
                
                return sb.ToString();
            }
            
            [DllImport("kernel32.dll")]
            static extern IntPtr LoadLibraryEx(string lpFileName, IntPtr hFile, LoadLibraryFlags dwFlags);
            
            enum LoadLibraryFlags : uint
            {
                DONT_RESOLVE_DLL_REFERENCES         = 0x00000001,
                LOAD_IGNORE_CODE_AUTHZ_LEVEL        = 0x00000010,
                LOAD_LIBRARY_AS_DATAFILE            = 0x00000002,
                LOAD_LIBRARY_AS_DATAFILE_EXCLUSIVE  = 0x00000040,
                LOAD_LIBRARY_AS_IMAGE_RESOURCE      = 0x00000020,
                LOAD_WITH_ALTERED_SEARCH_PATH       = 0x00000008
            }
            
            [DllImport("user32.dll", CharSet = CharSet.Auto)]
            static extern int LoadString(IntPtr hInstance, uint uID, StringBuilder lpBuffer, int nBufferMax);
        }
"@

        If (-not ([System.Management.Automation.PSTypeName]'MsiErrorCode').Type)
        {
            Add-Type -TypeDefinition $MsiErrorCodeMsgSource -Language CSharp
        }
    }
    Process
    {
        Try
        {
            Write-Log -Message "Get message for MSI error code [$MsiErrorCode]" -Component ${CmdletName} -Severity 1
            [string]$MsiErrorCodeMsg = [MsiErrorCode]::GetMessageFromMsiErrCode($MsiErrorCode)
            Write-Output $MsiErrorCodeMsg
        }
        Catch
        {
            Write-Log -Message "Failed to get message for MSI error code `n$(Write-ErrorStack)" -Component ${CmdletName} -Severity 3
            Continue
        }
    }
    End
    {
        
    }
}

# If MSI install, check to see if the MSI installer service is available or if another MSI install is already underway
If ($FilePath -match 'msiexec')
{
    $MsiExecAvailable = Test-MsiExecMutex -MsiExecWaitTime $(New-TimeSpan -Minutes 10)
    If (-not $MsiExecAvailable)
    {
        Write-Log -Message "Another MSI installation is already in progress. Wait for the installation to complete before trying this installation again." -Component ${CmdletName} -Severity 3
        Exit-Script -ExitCode 1618
    }
}

Function Test-MsiExecMutex
{
<#
    .SYNOPSIS
        Wait, up to a timeout, for the MSI installer service to become free.
    .DESCRIPTION
        The _MSIExecute mutex is used by the MSI installer service to serialize installations
        and prevent multiple MSI based installations happening at the same time.
        Wait, up to a timeout (default is 10 minutes), for the MSI installer service to become free
        by checking to see if the MSI mutex, "Global\\_MSIExecute", is available.
    .PARAMETER MsiExecWaitTime
        The length of time to wait for the MSI installer service to become available.
        This variable must be specified as a [timespan] variable type using the [New-TimeSpan] cmdlet.
        Example of specifying a [timespan] variable type: New-TimeSpan -Minutes 5
    .OUTPUTS
        Returns true for a successful wait, when the installer service has become free.
        Returns false when waiting for the installer service to become free has exceeded the timeout.
    .EXAMPLE
        Test-MsiExecMutex
    .EXAMPLE
        Test-MsiExecMutex -MsiExecWaitTime $(New-TimeSpan -Minutes 5)
    .EXAMPLE
        Test-MsiExecMutex -MsiExecWaitTime $(New-TimeSpan -Seconds 60)
    .LINK
        http://msdn.microsoft.com/en-us/library/aa372909(VS.85).aspx
#>
    [CmdletBinding()]
    Param
    (
        [Parameter(Mandatory=$false)]
        [ValidateNotNullOrEmpty()]
        [timespan]$MsiExecWaitTime = $(New-TimeSpan -Minutes 10)
    )
    
    Begin
    {
        ${CmdletName} = $PSCmdlet.MyInvocation.MyCommand.Name
        $PSParameters = New-Object -TypeName PSObject -Property $PSBoundParameters
        
        Write-Log -Message "Function Start" -Component ${CmdletName} -Severity 1
        If (-not [string]::IsNullOrEmpty($PSParameters))
        {
            Write-Log -Message "Function invoked with bound parameters [$PSParameters]" -Component ${CmdletName} -Severity 1
        }
        Else
        {
            Write-Log -Message "Function invoked without any bound parameters" -Component ${CmdletName} -Severity 1
        }
        
        $IsMsiExecFreeSource = @"
        using System;
        using System.Threading;
        public class MsiExec
        {
            public static bool IsMsiExecFree(TimeSpan maxWaitTime)
            {
                /// <summary>
                /// Wait (up to a timeout) for the MSI installer service to become free.
                /// </summary>
                /// <returns>
                /// Returns true for a successful wait, when the installer service has become free.
                /// Returns false when waiting for the installer service has exceeded the timeout.
                /// </returns>
                
                // The _MSIExecute mutex is used by the MSI installer service to serialize installations
                // and prevent multiple MSI based installations happening at the same time.
                // For more info: http://msdn.microsoft.com/en-us/library/aa372909(VS.85).aspx
                const string installerServiceMutexName = "Global\\_MSIExecute";
                Mutex MSIExecuteMutex = null;
                var isMsiExecFree = false;
                
                try
                {
                    MSIExecuteMutex = Mutex.OpenExisting(installerServiceMutexName,
                                    System.Security.AccessControl.MutexRights.Synchronize);
                    isMsiExecFree = MSIExecuteMutex.WaitOne(maxWaitTime, false);
                }
                catch (WaitHandleCannotBeOpenedException)
                {
                    // Mutex doesn't exist, do nothing
                    isMsiExecFree = true;
                }
                catch (ObjectDisposedException)
                {
                    // Mutex was disposed between opening it and attempting to wait on it, do nothing
                    isMsiExecFree = true;
                }
                finally
                {
                    if (MSIExecuteMutex != null && isMsiExecFree)
                    MSIExecuteMutex.ReleaseMutex();
                }
                
                return isMsiExecFree;
            }
        }
"@
        
        If (-not ([System.Management.Automation.PSTypeName]'MsiExec').Type)
        {
            Add-Type -TypeDefinition $IsMsiExecFreeSource -Language CSharp
        }
    }
    Process
    {
        Try
        {
            If ($MsiExecWaitTime.TotalMinutes -gt 0)
            {
                [string]$WaitLogMsg = "$($MsiExecWaitTime.TotalMinutes) minutes"
            }
            Else
            {
                [string]$WaitLogMsg = "$($MsiExecWaitTime.TotalSeconds) seconds"
            }
            Write-Log -Message "Check to see if the MSI installer service is available. Wait up to [$WaitLogMsg] for the installer service to become available." -Component ${CmdletName} -Severity 1
            [boolean]$IsMsiExecInstallFree = [MsiExec]::IsMsiExecFree($MsiExecWaitTime)
            
            If ($IsMsiExecInstallFree)
            {
                Write-Log -Message "The MSI installer service is available to start a new installation." -Component ${CmdletName} -Severity 1
            }
            Else
            {
                Write-Log -Message "The MSI installer service is not available because another installation is already in progress." -Component ${CmdletName} -Severity 1
            }
            Return $IsMsiExecInstallFree
        }
        Catch
        {
            Write-Log -Message "There was an error while attempting to check if the MSI installer service is available `n$(Write-ErrorStack)" -Component ${CmdletName} -Severity 3
        }
    }
    End
    {
        Write-Log -Message "Function End" -Component ${CmdletName} -Severity 1
    }
}

Function Import-AuthenticodeCertificateFromFile
{
<#
    .SYNOPSIS
        Import the signed certificate embedded in a file into the certificate store for all users on the local computer
    .DESCRIPTION
        Import the Authenticode certificate from a file into a certificate store for all users on the machine
    .PARAMETER FilePath
        Path to the file which contains the signed certificate
    .PARAMETER StoreName
        Name of the certificate store that the certificate should be added to. Default store is 'TrustedPublisher'.
    .EXAMPLE
        Import the certificate into the default 'TrustedPublisher' certificate store.
        Import-AuthenticodeCertificateFromFile -FilePath "F:\SCCM\ConfigurationManager.psd1"
    .EXAMPLE
        Import the certificate into the 'Root' certificate store.
        Import-AuthenticodeCertificateFromFile -FilePath "F:\SCCM\ConfigurationManager.psd1" -Store 'Root'
    .LINK
        http://msdn.microsoft.com/en-us/library/windows/hardware/ff537890(v=vs.85).aspx
        http://msdn.microsoft.com/en-us/library/ie/ms537361(v=vs.85).aspx
    .NOTES
        An authenticode certificate always gets added to the 'TrustedPublisher' certificate store. It may also
        need to be added to the 'Root' certificate store if the authenticode certificate does not have a
        trusted Certification Authority in the 'Root' certificate store.
#>
    [CmdletBinding()]
    Param
    (
        [Parameter(Mandatory=$true)]
        [ValidateNotNullorEmpty()]
        $FilePath,
        [Parameter(Mandatory=$false)]
        [ValidateNotNullorEmpty()]
        [ValidateSet('TrustedPublisher','Root','AddressBook','AuthRoot','CertificateAuthority','Disallowed','My','TrustedPeople')]
        $StoreName = 'TrustedPublisher'
    )
    
    Begin
    {
        ${CmdletName} = $PSCmdlet.MyInvocation.MyCommand.Name
        $PSParameters = New-Object -TypeName PSObject -Property $PSBoundParameters
        
        Write-Log -Message "Function Start" -Component ${CmdletName} -Severity 1
        If (-not [string]::IsNullOrEmpty($PSParameters))
        {
            Write-Log -Message "Function invoked with bound parameters [$PSParameters]" -Component ${CmdletName} -Severity 1
        }
        Else
        {
            Write-Log -Message "Function invoked without any bound parameters" -Component ${CmdletName} -Severity 1
        }
    }
    Process
    {
        Try
        {
            Write-Log -Message "Get the Authenticode signing certificate from file [$FilePath]" -Component ${CmdletName} -Severity 1
            $Certificate = Get-AuthenticodeSignature -FilePath $FilePath -ErrorAction 'Stop'
            
            Write-Log -Message "Open a X.509 certificate store object for [LocalMachine\$StoreName]" -Component ${CmdletName} -Severity 1
            $Store = New-Object System.Security.Cryptography.X509Certificates.X509Store([System.Security.Cryptography.X509Certificates.StoreName]::$StoreName,'LocalMachine')
            $Store.Open("MaxAllowed")
            
            Write-Log -Message "Adding certificate to X.509 certificate store [$StoreName]" -Component ${CmdletName} -Severity 1
            $Store.Add($Certificate.SignerCertificate) | Out-Null
            $Store.Close()
        }
        Catch
        {
            Write-Log -Message "Failed to add certificate to X.509 certificate store `n$(Write-ErrorStack)" -Component ${CmdletName} -Severity 3
            Exit-Script -ExitCode 20
        }
    }
    End
    {
        Write-Log -Message "Function End" -Component ${CmdletName} -Severity 1
    }
}

Function Import-PSModule
{
    [CmdletBinding()]
    Param
    (
        [string]$Name
    )
    
    Begin
    {
        ${CmdletName} = $PSCmdlet.MyInvocation.MyCommand.Name
        $PSParameters = New-Object -TypeName PSObject -Property $PSBoundParameters
        
        Write-Log -Message "Function Start" -Component ${CmdletName} -Severity 1
        If (-not [string]::IsNullOrEmpty($PSParameters))
        {
            Write-Log -Message "Function invoked with bound parameters [$PSParameters]" -Component ${CmdletName} -Severity 1
        }
        Else
        {
            Write-Log -Message "Function invoked without any bound parameters" -Component ${CmdletName} -Severity 1
        }
    }
    Process
    {
        If (-not (Get-Module -Name $Name))
        {
            If (Get-Module -ListAvailable | Where-Object { $_.Name -eq $Name })
            {
                Try
                {
                    Write-Log -Message "Load PowerShell Module [$Name]" -Component ${CmdletName} -Severity 1
                    Import-Module -Name $Name -DisableNameChecking -ErrorAction 'Stop'
                    Return $true
                }
                Catch
                {
                    Write-Log -Message "Failed to load PowerShell module [$Name] `n$(Write-ErrorStack)" -Component ${CmdletName} -Severity 3
                    Return $false
                }
            } # end if module available then import
            Else
            {
                Write-Log -Message "PowerShell module [$Name] is not available for import. Failed to load PowerShell module [$Name]" -Component ${CmdletName} -Severity 3
                Return $false
            } # module not available
        } # end if module not available
        Else
        {
            Write-Log -Message "PowerShell Module [$Name] already loaded" -Component ${CmdletName} -Severity 1
            Return $true
        } # module already loaded
    }
    End
    {
        Write-Log -Message "Function End" -Component ${CmdletName} -Severity 1
    }
} # end function Import-PSModule

Show-InstallationWelcome -CloseApps "iexp.......... -DeferTimes 3  -DeferDays 3 

[31-07-2014 14:40:18] [Pre-Installation] The date/time specified [2014. augustus 3. 14:40:18] is not specified in a format recognised by the current culture [hu-HU] (at Get-UniversalDate, C:\Windows\ccmcache\1d\AppDeployToolkit\AppDeployToolkitMain.ps1: line 2263
at Show-InstallationWelcome, C:\Windows\ccmcache\1d\AppDeployToolkit\AppDeployToolkitMain.ps1: line 2488
at <ScriptBlock>, C:\Windows\ccmcache\1d\Deploy-Application.ps1: line 86)
[31-07-2014 14:40:18] [Pre-Installation] Displaying Dialog Box with message: [The date/time specified [2014. augustus 3. 14:40:18] is not specified in a format recognised by the current culture [hu-HU] (at Get-UniversalDate, C:\Windows\ccmcache\1d\AppDeployToolkit\AppDeployToolkitMain.ps1: line 2263
at Show-InstallationWelcome, C:\Windows\ccmcache\1d\AppDeployToolkit\AppDeployToolkitMain.ps1: line 2488
at <ScriptBlock>, C:\Windows\ccmcache\1d\Deploy-Application.ps1: line 86)]...

If ($dateTime -match "Z$") { $dateTime = $dateTime -replace "Z$","" }