Windows installer unable to install pip & pip can't install without admin

Python Help
1

Something about security in Windows 10 has changed very recently. I don’t know if it’s just happening to me or if this is a new problem caused by a Windows update. I use Python for development of a lot of different projects so I have been installing new packages with pip every week until last night pip failed. It gave me an error I can’t remember: something about being unable to write a file. While troubleshooting the issue, I attempted to install the packages using a command prompt run as administrator and that worked. It’s good but that hasn’t been a requirement until now.

I decided to uninstall Python and install it again. I use the installer provided at python.org. What I am about to say applies to both 3.12.4 and 3.11.9: I’ve tested it for both! The Python for Windows installer is silently failing to install pip if I install it to my user directory. It cannot elevate its own security permissions to bootstrap pip. If I run the Python for Windows installer as administrator, then it will install pip just fine. If I don’t run it as an administrator, but I choose to install Python 3.11/12 for all users, which goes to C:\Program Files\Python3xx, then it does successfully elevate permission to instlal pip.

In any case, if I do successfully have pip installed I am not able to install any packages with pip unless I am running my command prompt as an administrator. The --user option does not help. It appears that Python/Pip is not allowed to write to its Program Files installation directory, or its AppData local installation directory, or the roaming directory unless I am administrator. It also doesn’t work when I am using a virtual environment created with “python -m venv [path]”. It appears Python is restricted by Windows.

Does anyone have a fix for this or do I need to report this as a bug?

2

The preferred way to run pip on windows is to type

py -m pip

Does that work?

3

No, it definitely didn’t get installed in the situations where it won’t install. Normally a pip executable is put into the …/Python311/Scripts/ directory which is included in the PATH environment variable. It’s missing entirely.

4

Also for anyone wondering what the error looks like when pip fails to install anything, here is the log from my command prompt:

C:\Users\name>pip install scipy
Collecting scipy
  Using cached scipy-1.13.1-cp311-cp311-win_amd64.whl.metadata (60 kB)
Collecting numpy<2.3,>=1.22.4 (from scipy)
  Using cached numpy-2.0.0-cp311-cp311-win_amd64.whl.metadata (60 kB)
Using cached scipy-1.13.1-cp311-cp311-win_amd64.whl (46.2 MB)
Using cached numpy-2.0.0-cp311-cp311-win_amd64.whl (16.5 MB)
ERROR: Could not install packages due to an OSError: [WinError 5] Access is denied
Consider using the `--user` option or check the permissions.

Adding --user changes the final line to be:

Check the permissions.
5

What version of windows 10?

Have you tried making a new user account and seeing if the behavior is repeatable?

6

I understand that you want a pip.exe.

What I wanted to find out is if its only the .exe that is missing or the pip module as well.

Using the py -m pip will show if pip module is installed.
Did you try that command?

7

That’s good reasoning. I have now tried the command and can confirm that it does not work: “No module named pip”. I’d also like to point out that while pip does not install, the only file referencing pip after installation is pip-24.0-py3-none-any.whl which does get put into Python311\Lib\ensurepip\ _bundled\

8

The Windows version is Windows 10 Pro 22H2 19045.4529. I have just done as you suggested and am still having the same issues.

I created a new local account, changed the account type to administrator, signed out and signed into that account, installed Python to user directory and it does not install pip. I reinstall it while running the installer as an administrator and it does install. When I try to install anything with pip in command prompt it will not have permission. It appears to be reproducible on my machine under another account and is not tied to a specific user-based setting.

9

Do you have anti-virus/malware software that might be blocking actions? If so is there a log that can view to confirm the blocking?

10

There are no reported logs in my antivirus or any kind of threat protection system having stopped python from taking action. I had briefly disabled it for a short time to see if it was stopping python from working as intended and that hadn’t made a difference.

11

Please run the following command:

py -3.11 -m ensurepip --default-pip --upgrade
12

I’ve done it and it failed.

C:\Users\name>py -3.11 -m ensurepip --default-pip --upgrade
Looking in links: c:\Users\name\AppData\Local\Temp\tmpyezz34gh
ERROR: Could not install packages due to an OSError: [WinError 5] Access is denied
Consider using the `--user` option or check the permissions.

Traceback (most recent call last):
  File "<frozen runpy>", line 198, in _run_module_as_main
  File "<frozen runpy>", line 88, in _run_code
  File "C:\Users\name\AppData\Local\Programs\Python\Python311\Lib\ensurepip\__main__.py", line 5, in <module>
    sys.exit(ensurepip._main())
             ^^^^^^^^^^^^^^^^^
  File "C:\Users\name\AppData\Local\Programs\Python\Python311\Lib\ensurepip\__init__.py", line 286, in _main
    return _bootstrap(
           ^^^^^^^^^^^
  File "C:\Users\name\AppData\Local\Programs\Python\Python311\Lib\ensurepip\__init__.py", line 202, in _bootstrap
    return _run_pip([*args, *_PACKAGE_NAMES], additional_paths)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\name\AppData\Local\Programs\Python\Python311\Lib\ensurepip\__init__.py", line 103, in _run_pip
    return subprocess.run(cmd, check=True).returncode
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\name\AppData\Local\Programs\Python\Python311\Lib\subprocess.py", line 571, in run
    raise CalledProcessError(retcode, process.args,
subprocess.CalledProcessError: Command '['C:\\Users\\name\\AppData\\Local\\Programs\\Python\\Python311\\python.exe', '-W', 'ignore::DeprecationWarning', '-c', '\nimport runpy\nimport sys\nsys.path = [\'C:\\\\Users\\\\name\\\\AppData\\\\Local\\\\Temp\\\\tmpyezz34gh\\\\setuptools-65.5.0-py3-none-any.whl\', \'C:\\\\Users\\\\name\\\\AppData\\\\Local\\\\Temp\\\\tmpyezz34gh\\\\pip-24.0-py3-none-any.whl\'] + sys.path\nsys.argv[1:] = [\'install\', \'--no-cache-dir\', \'--no-index\', \'--find-links\', \'C:\\\\Users\\\\name\\\\AppData\\\\Local\\\\Temp\\\\tmpyezz34gh\', \'--upgrade\', \'setuptools\', \'pip\']\nrunpy.run_module("pip", run_name="__main__", alter_sys=True)\n']' returned non-zero exit status 1.
13

Please run the following command:

icacls.exe "%LocalAppData%\Programs\Python\Python311\Lib\site-packages"

This command displays the discretionary access control list (DACL) of the “site-packages” directory in your installation of Python. Normally there should be an entry for each of the following accounts/groups: “SYSTEM”, “BUILTIN\Administrators”, and the current user account. Each entry should grant the access “(I)(OI)(CI)(F)” – i.e. full control of the directory and its files and subdirectories.

14

Given the explanation, that sounds correct. This is the result:

C:\Users\name>icacls.exe "%LocalAppData%\Programs\Python\Python311\Lib\site-packages"
C:\Users\name\AppData\Local\Programs\Python\Python311\Lib\site-packages NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
                                                                         BUILTIN\Administrators:(I)(OI)(CI)(F)
                                                                         ELIAS-Z390\name:(I)(OI)(CI)(F)

Successfully processed 1 files; Failed processing 0 files
15

This is a fresh installation, right? If so, let’s delete a couple directories. In the CMD shell, run the following commands:

rd /q /s "%LocalAppData%\Programs\Python\Python311\Lib\site-packages"
rd /q /s "%LocalAppData%\Programs\Python\Python311\Scripts"

Now run the pip installation again, this time with the addition of --verbose in case maybe that might provide another clue:

 py -3.11 -m ensurepip --default-pip --upgrade --verbose
16

Yeah, I have been removing any remnant Python directories each time I uninstall. The result with --verbose is long and generally shows the same error.

C:\Users\name>py -3.11 -m ensurepip --default-pip --upgrade --verbose
Using pip 24.0 from C:\Users\name\AppData\Local\Temp\tmpelwhd4vu\pip-24.0-py3-none-any.whl\pip (python 3.11)
Looking in links: c:\Users\name\AppData\Local\Temp\tmpelwhd4vu
ERROR: Could not install packages due to an OSError.
Consider using the `--user` option or check the permissions.
Traceback (most recent call last):
  File "C:\Users\name\AppData\Local\Temp\tmpelwhd4vu\pip-24.0-py3-none-any.whl\pip\_internal\commands\install.py", line 377, in run
    requirement_set = resolver.resolve(
                      ^^^^^^^^^^^^^^^^^
  File "C:\Users\name\AppData\Local\Temp\tmpelwhd4vu\pip-24.0-py3-none-any.whl\pip\_internal\resolution\resolvelib\resolver.py", line 95, in resolve
    result = self._result = resolver.resolve(
                            ^^^^^^^^^^^^^^^^^
  File "C:\Users\name\AppData\Local\Temp\tmpelwhd4vu\pip-24.0-py3-none-any.whl\pip\_vendor\resolvelib\resolvers.py", line 546, in resolve
    state = resolution.resolve(requirements, max_rounds=max_rounds)
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\name\AppData\Local\Temp\tmpelwhd4vu\pip-24.0-py3-none-any.whl\pip\_vendor\resolvelib\resolvers.py", line 397, in resolve
    self._add_to_criteria(self.state.criteria, r, parent=None)
  File "C:\Users\name\AppData\Local\Temp\tmpelwhd4vu\pip-24.0-py3-none-any.whl\pip\_vendor\resolvelib\resolvers.py", line 173, in _add_to_criteria
    if not criterion.candidates:
  File "C:\Users\name\AppData\Local\Temp\tmpelwhd4vu\pip-24.0-py3-none-any.whl\pip\_vendor\resolvelib\structs.py", line 156, in __bool__
    return bool(self._sequence)
           ^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\name\AppData\Local\Temp\tmpelwhd4vu\pip-24.0-py3-none-any.whl\pip\_internal\resolution\resolvelib\found_candidates.py", line 155, in __bool__
    return any(self)
           ^^^^^^^^^
  File "C:\Users\name\AppData\Local\Temp\tmpelwhd4vu\pip-24.0-py3-none-any.whl\pip\_internal\resolution\resolvelib\found_candidates.py", line 143, in <genexpr>
    return (c for c in iterator if id(c) not in self._incompatible_ids)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\name\AppData\Local\Temp\tmpelwhd4vu\pip-24.0-py3-none-any.whl\pip\_internal\resolution\resolvelib\found_candidates.py", line 44, in _iter_built
    for version, func in infos:
  File "C:\Users\name\AppData\Local\Temp\tmpelwhd4vu\pip-24.0-py3-none-any.whl\pip\_internal\resolution\resolvelib\factory.py", line 297, in iter_index_candidate_infos
    result = self._finder.find_best_candidate(
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\name\AppData\Local\Temp\tmpelwhd4vu\pip-24.0-py3-none-any.whl\pip\_internal\index\package_finder.py", line 890, in find_best_candidate
    candidates = self.find_all_candidates(project_name)
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\name\AppData\Local\Temp\tmpelwhd4vu\pip-24.0-py3-none-any.whl\pip\_internal\index\package_finder.py", line 831, in find_all_candidates
    page_candidates = list(page_candidates_it)
                      ^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\name\AppData\Local\Temp\tmpelwhd4vu\pip-24.0-py3-none-any.whl\pip\_internal\index\sources.py", line 127, in page_candidates
    for url in self._path_to_urls.page_candidates:
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\name\AppData\Local\Temp\tmpelwhd4vu\pip-24.0-py3-none-any.whl\pip\_internal\index\sources.py", line 83, in page_candidates
    self._scan_directory()
  File "C:\Users\name\AppData\Local\Temp\tmpelwhd4vu\pip-24.0-py3-none-any.whl\pip\_internal\index\sources.py", line 63, in _scan_directory
    if _is_html_file(url):
       ^^^^^^^^^^^^^^^^^^
  File "C:\Users\name\AppData\Local\Temp\tmpelwhd4vu\pip-24.0-py3-none-any.whl\pip\_internal\index\sources.py", line 45, in _is_html_file
    return mimetypes.guess_type(file_url, strict=False)[0] == "text/html"
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\name\AppData\Local\Programs\Python\Python311\Lib\mimetypes.py", line 312, in guess_type
    init()
  File "C:\Users\name\AppData\Local\Programs\Python\Python311\Lib\mimetypes.py", line 374, in init
    db.read_windows_registry()
  File "C:\Users\name\AppData\Local\Programs\Python\Python311\Lib\mimetypes.py", line 259, in read_windows_registry
    _mimetypes_read_windows_registry(add_type)
PermissionError: [WinError 5] Access is denied
Traceback (most recent call last):
  File "<frozen runpy>", line 198, in _run_module_as_main
  File "<frozen runpy>", line 88, in _run_code
  File "C:\Users\name\AppData\Local\Programs\Python\Python311\Lib\ensurepip\__main__.py", line 5, in <module>
    sys.exit(ensurepip._main())
             ^^^^^^^^^^^^^^^^^
  File "C:\Users\name\AppData\Local\Programs\Python\Python311\Lib\ensurepip\__init__.py", line 286, in _main
    return _bootstrap(
           ^^^^^^^^^^^
  File "C:\Users\name\AppData\Local\Programs\Python\Python311\Lib\ensurepip\__init__.py", line 202, in _bootstrap
    return _run_pip([*args, *_PACKAGE_NAMES], additional_paths)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\name\AppData\Local\Programs\Python\Python311\Lib\ensurepip\__init__.py", line 103, in _run_pip
    return subprocess.run(cmd, check=True).returncode
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\name\AppData\Local\Programs\Python\Python311\Lib\subprocess.py", line 571, in run
    raise CalledProcessError(retcode, process.args,
subprocess.CalledProcessError: Command '['C:\\Users\\name\\AppData\\Local\\Programs\\Python\\Python311\\python.exe', '-W', 'ignore::DeprecationWarning', '-c', '\nimport runpy\nimport sys\nsys.path = [\'C:\\\\Users\\\\name\\\\AppData\\\\Local\\\\Temp\\\\tmpelwhd4vu\\\\setuptools-65.5.0-py3-none-any.whl\', \'C:\\\\Users\\\\name\\\\AppData\\\\Local\\\\Temp\\\\tmpelwhd4vu\\\\pip-24.0-py3-none-any.whl\'] + sys.path\nsys.argv[1:] = [\'install\', \'--no-cache-dir\', \'--no-index\', \'--find-links\', \'C:\\\\Users\\\\name\\\\AppData\\\\Local\\\\Temp\\\\tmpelwhd4vu\', \'--upgrade\', \'-v\', \'setuptools\', \'pip\']\nrunpy.run_module("pip", run_name="__main__", alter_sys=True)\n']' returned non-zero exit status 1.
17

The access-denied error occurs in mimetypes._mimetypes_read_windows_registry(). This is a known bug, gh-100256. A subkey of HKCR in your system’s registry is restricted for some reason. The builtin function _mimetypes_read_windows_registry() is supposed to skip inaccessible keys, but due to a bug it actually raises an exception.

As a workaround, you can modify the method MimeTypes.read_windows_registry() in “Lib\mimetypes.py” to comment out a few lines, and replace the line elif _winreg: with the line if _winreg:.

    # Accelerated function if it is available
    # if _mimetypes_read_windows_registry:
    #    _mimetypes_read_windows_registry(add_type)
    # elif _winreg:
    if _winreg:
        self._read_windows_registry(add_type)

The fallback method self._read_windows_registry() is more resilient than the builtin function.

1 Like
18

Here’s a little function to find the inaccessible key in HKCR:

import winreg

def find_bad_key():
    hkcr = winreg.HKEY_CLASSES_ROOT
    i = 0
    while True:
        try:
            name = winreg.EnumKey(hkcr, i)
            i += 1
        except OSError:
            break
        try:
            with winreg.OpenKey(hkcr, name) as hkey:
                pass
        except OSError:
            return name

Once you know the name of the offending subkey in HKCR, run regedit with admin access, right-click the key in the tree, select “permissions”, and grant read access to the “Users” group.

2 Likes
19

Impressive, you are onto something! I vaguely remember restricting a key in HKCR a long time ago and I think I did it to prevent an application from force changing a file’s association on me. I don’t know why it hadn’t affected me until now but since you mentioned it I will absolutely try the workaround and I’ll go back and undo that HKCR restriction.

1 Like
20

I tried the function through a script, but the returned result was None. It’s okay though, I remembered what I had restricted and undid the restriction. It was either the .ips or .bps file type so I had removed the restriction on both and now my pip functionality is returned. Thank you Eryk Sun. This is a known bug but also a trap I unwittingly set up on myself.

And thanks to the others for taking the time to also suggest troubleshooting steps. I hope this thread can be of help to others facing a similar issue.

1 Like