Windows Installer

Windows Installer makes it easy for you to manage the software installation and removal process, and modify, repair, and advertise existing applications.

  • Before using Windows Installer, see Checklist: Configuring Windows Installer.
  • For tips about using Windows Installer, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.


Checklist: Configuring Windows Installer

Step | References
Review key concepts about Software Installation, Group Policy, and Active Directory. | Active Directory Users and Computers;Group Policy overview; Software Installation
Set up Group Policy in your organization. | Checklist: Implementing Group Policy in Active Directory
Start Group Policy to apply to the site, domain, or organizational unit containing the users and computers that should receive the software. | Start Group Policy; Ways to start the Group Policy snap-in
Obtain Windows Installer (.msi) packages for your software. | Contact the software vendor
Start Software Installation. | Start Software Installation


Best practices

  • Specifying application categories for your organization.
    Using categories makes it easier for users to find applications in Add or Remove Programs in Control Panel. For more information, see To specify categories for applications to be deployed.
  • Remembering that transforms are applied at deployment time.
    Transforms, or .mst files, are customizations applied to Windows Installer packages. A transform is applied at the time of assignment or publication, not at the time of installation. In practical terms, this means that you should ensure the Modifications tab of the package properties dialog box is set up the way you want it to be before clicking OK. If you neglect to do this and deploy an incorrectly transformed package, then you either have to remove the software and redeploy it, or upgrade the software with a correctly transformed version. For procedures on how to do this, see To remove a managed application and To upgrade a managed application.
  • Assigning or publishing an installation package only once per Group Policy object.
    A Windows Installer package should be assigned or published no more than once in the same Group Policy object. For example, you could assign Microsoft Office to the computers affected by a Group Policy object and then not assign or publish it to users affected by the object.
  • Taking advantage of authoring tools.
    Developers familiar with the files, registry entries, and other requirements for an application to work properly can author native Windows Installer packages using tools available from various software vendors.
  • Repackaging existing software.
    You can use commercially available tools for creating Windows Installer packages for software that does not include natively authored .msi files. These work by comparing a computer's state before and after installation. For best results, perform a clean install.
  • Using System Management Server and Dfs.
    Microsoft Systems Management Server and the Windows Distributed File System (Dfs) are helpful in managing software distribution points—the network shares from which users install their managed software.
  • Assigning or publishing at a high level in the Active Directory hierarchy.
    Exploit inheritance to disseminate the application throughout the organization. Use security descriptors (Access Control Entries or ACEs) on the Group Policy object for finer control over who receives the software. For more information, see Using Security Groups to filter Group Policy.

    Notes

    • Authenticated Users need the Read and Apply Group Policy ACEs to be able to install from the SDP.
    • Administrators need Full Control to manage software.
  • Using Software Installation properties for widely scoped control.
    In the Group Policy console, right-click Software Installation, and then on the context menu, click Properties.

    Where?

    • applicable policy name
    • Computer Configuration (or User Configuration)
    • Software Settings
    • Software Installation

    • This simplifies the administrative process of assigning or publishing a large number of packages with similar properties in a single Group Policy object— for example, when all the software is published and it all comes from the same software distribution point.

  • Using Windows Installer package properties for fine control.
    Proceed to the Software Installation node as described previously, right-click the package in the details pane, and then click Properties. Use this procedure for assigning or publishing a single package.


How to...

  • Use Windows Installer packages with Windows Explorer
  • Use Windows Installer packages with the Add or Remove Programs utility
  • Use the Windows Installer from the command line
  • Configure Group Policy for Windows Installer


Use Windows Installer packages with Windows Explorer

Microsoft Windows graphic

To use Windows Installer packages with Windows Explorer

  1. Open Windows Explorer.
  2. Right-click the Windows Installer package (.msi file), and then click Install, Repair, or Uninstall.

Note

  • XOX.

Related Topics


Use Windows Installer packages with the Add or Remove Programs utility

Microsoft Windows graphic

To use Windows Installer packages with the Add or Remove Programs utility

  1. Open Add or Remove Programs in Control Panel.
  2. Click Change or Remove Programs, and then click the program you want to change or remove.
  3. To change a program, click Change.
  4. To remove a program, click Remove.

Note

  • XOX

Related Topics


Use Windows Installer from the command line

  • Install a package using the command line
  • Remove a package using the command line
  • Repair a package using the command line
  • Advertise a package using the command line
  • Create an administrative installation package from the command line
  • Create an installation log file using the command line
  • Installing a transform using the command line
  • Installing and Advertising a product with transforms using the command line


Install a transform using the command line

Microsoft Windows graphic

To install a transform using the command line

  1. Open Command Prompt.
  2. From the command window, type msiexec /i package TRANSFORMS=transform list and then press ENTER.

    3. Where:

    i means to install a product.

    TRANSFORMS is a property that is used to specify what transform (.mst) files should be applied to the package. This is a list of paths separated by semicolons.

    package is the name of the Windows Installer package file (.msi).

For more information, see To install and advertize a product using a transform using the command line.

Notes

  • XOX.
  • Windows Installer command-line switches are not case-sensitive.
  • For more information on the command-line options, see Related Topics.

Related Topics


Install and advertise a product with a transform using the command line

Microsoft Windows graphic

To install and advertise a product using a transform with the command line

  1. Open Command Prompt.
  2. From the command window, type msiexec package /j[u][m] /t transform list and then press ENTER.

    3. Where:

    j means to advertise a product. This option ignores any property values entered on the command line.

    u means to advertise to the current user.

    m means to advertise to all users of this computer.

    t means to apply transform to advertised package.

    package is the name of the Windows Installer package file.

For more information, see To advertise a package using the command line.

Notes

  • XOX.
  • Windows Installer command-line switches are not case-sensitive.
  • For more information on the command-line options, see Related Topics.

Related Topics


Install a package using the command line

Microsoft Windows graphic

To install a package using the command line

  1. Open Command Prompt.
  2. From the command window, type msiexec /i [package|product_code] and then press ENTER.

    3. Where:

    package is the name of the Windows Installer package file.

    product_code is the globally unique identifier (GUID) of the Windows Installer package.

Notes

  • XOX.
  • Windows Installer command-line switches are not case-sensitive.
  • For more information on the command-line options, see Related Topics.

Related Topics


Remove a package using the command line

Microsoft Windows graphic

To remove a package using the command line

  1. Open Command Prompt.
  2. From the command window, type msiexec /x [package|ProductCode] and then press ENTER.

    3. Where:

    package is the name of the Windows Installer package file.

    ProductCode is the globally unique identifier (GUID) of the Windows Installer package.

Notes

  • XOX.
  • Windows Installer command-line switches are not case-sensitive.
  • For more information on the command-line options, see Related Topics.

Related Topics


Repair a package using the command line

Microsoft Windows graphic

To repair a package using the command line

  1. Open Command Prompt.
  2. From the command window, type msiexec /f[p][o][e][d][c][a][u][m][s][v] {package|ProductCode} and then press ENTER.

    3. Where:

    /f enables one or more of the following command-line options:

    p - Reinstall only if the file is missing.

    o - Reinstall if the file is missing or if an older version is installed.

    e - Reinstall if the file is missing or an equal or older version is installed.

    d - Reinstall if the file is missing or a different version is installed.

    c - Reinstall if the file is missing or the stored checksum does not match the calculated value.

    a - Force all the files to be reinstalled.

    u - Rewrite all the required user-specific registry entries.

    m - Rewrite all the required computer-specific registry entries.

    s - Overwrite all the existing shortcuts.

    v - Run from source and re-cache the local package.

    package is the name of the Windows Installer package file.

    ProductCode is the globally unique identifier (GUID) of the Windows Installer package.

Notes

  • XOX.
  • Windows Installer command-line switches are not case-sensitive.
  • The default parameter for this command-line option is /fpecms.
  • For more information on the command-line options, see Related Topics.

Related Topics


Advertise a package using the command line

Microsoft Windows graphic

To advertise a package using the command line

  1. Open Command Prompt.
  2. From the command window, type msiexec /j[u][m] package and then press ENTER.

    3. Where:

    u means to advertise to the current user.

    m means to advertise to all users of this computer.

    package is the name of the Windows Installer package file.

Notes

  • XOX.
  • If you want to install the application with elevated privileges, use the /jm option.
  • Windows Installer command-line switches are not case-sensitive.
  • For more information on the command-line options, see Related Topics.

Related Topics


Create an administrative installation package from the command line

Microsoft Windows graphic

To create an administrative installation package from the command line

  1. Open Command Prompt.
  2. From the command window, type msiexec /a package and press ENTER.

    3. Where:

    package is the name of the Windows Installer package file.

Notes

  • XOX.
  • Windows Installer command-line switches are not case-sensitive.
  • For more information on the command-line options, see Related Topics.

Related Topics


Create an installation log file using the command line

Microsoft Windows graphic

To create an installation log file using the command line

  1. Open Command Prompt.
  2. From the command window, type msiexec /i package [/L][i][w][e][a][r][u][c][m][p][v][+][!] log_file.txt, and then press ENTER.

    3. Where:

    package is the name of the Windows Installer package

    /L indicates to log information. The following flags specify which information to log:

    i - Status messages

    w - Nonfatal warnings

    e - All error messages

    a - Start up of actions

    r - Action-specific records

    u - User requests

    c - Initial user interface parameters

    m - Out-of-memory

    p - Terminal properties

    v - Verbose output

    + - Append to existing file

    ! - Flush each line to the log

    * - Wildcard: log all information except for the v option.

    log_file.txt - the name and path of the text log file.

Notes

  • XOX.
  • Windows Installer command-line switches are not case-sensitive.
  • To include the v option in a log file using the wildcard flag, type /L*v at the command prompt.
  • The Windows Installer log file options can also be used with the uninstall and repair processes.
  • For more information on the command-line options, see Related Topics.

Related Topics


Configure Group Policy for Windows Installer

  • Configure Windows Installer Group Policy computer options
  • Configure Windows Installer Group Policy user options


Configure Windows Installer Group Policy computer options

Microsoft Windows graphic

To configure Windows Installer Group Policy computer options

  1. Open Group Policy.
  2. In the console tree, click the Windows Installer node.

    3. Where?

    • applicable policy name
    • Computer Configuration
    • Administrative Templates
    • Windows Components
    • Windows Installer
  3. In the details window, double-click one of the following policies:
    • Disable Windows Installer
    • Always install with elevated privileges
    • Disable rollback
    • Disable browse dialog box for new source
    • Disable patching
    • Disable IE security prompt for Windows Installer scripts
    • Enable user control over installs
    • Enable user to browse for source while elevated
    • Enable user to use media source while elevated
    • Enable user to patch elevated products
    • Allow admin to install from Terminal Services session
    • Cache transforms in secure location on workstation
    • Disallow user installs
    • Disable creation of System Restore checkpoint
    • Logging
  4. In the Group Policy Property dialog box, set the options you want to use, and then click OK.

Notes

  • To open Group Policy to edit the local Group Policy object, click Start, click Run, type gpedit.msc, and then press ENTER.
  • For more information on Windows Installer Group Policy computer options, see Related Topics.
  • For additional information on starting Group Policy, see Related Topics.

Related Topics


Configure Windows Installer Group Policy user options

Microsoft Windows graphic

To configure Windows Installer Group Policy user options

  1. Open Group Policy.
  2. In the console tree, click the Windows Installer node.

    3. Where?

    • applicable policy name
    • User Configuration
    • Administrative Templates
    • Windows Components
    • Windows Installer
  3. In the details window, double-click one of the following policies:
    • Always install with elevated privileges
    • Search order
    • Disable rollback
    • Disable media source for any install
  4. In the Group Policy Property dialog box, set the options you want to use, and then click OK.

Notes

  • To open Group Policy to edit the local Group Policy object, click Start, click Run, type gpedit.msc, and then press ENTER.
  • For more information on Windows Installer Group Policy user options, see Related Topics.
  • For information on starting Group Policy, see Related Topics.

Related Topics


Concepts

This section provides general background information about Windows Installer:

  • Windows Installer overview
  • Understanding Windows Installer
  • Using Windows Installer
  • Resources


Windows Installer overview

Windows Installer is a component of the Windows operating system that simplifies the application installation process.

Windows Installer manages the installation and removal of applications by applying a set of centrally defined setup rules during the installation process. These setup rules define the installation and configuration of the installed application. You can also use this service to modify, repair, or remove an existing application. The Windows Installer technology consists of the Windows Installer service for the Windows operating systems and the package (.msi) file format used to hold information regarding the application set up and installations.

Windows Installer is also an extensible software management system. It manages the installation, addition, and deletion of software components, monitors file resiliency, and maintains basic disaster recovery with rollbacks. Windows Installer supports installing and running software from multiple sources, and can be customized by developers that want to install custom applications.


Understanding Windows Installer

This section covers:

  • Windows Installer features
  • Windows Installer technologies


Windows Installer features

With Windows Installer and the .msi package file format, software installation and removal has become more reliable and resilient while providing a larger set of installation options. Windows Installer performs the following tasks:

  • Restores original computer state upon installation failure: Windows Installer keeps track of all changes made to the system during the application installation process. If the installation fails, Windows Installer can restore, or roll back, the system to its initial state.
  • Helps prevent certain forms of inter-application conflicts: Windows Installer enforces installation rules that help to prevent conflicts with shared resources between existing applications. Such conflicts can be caused when an install operation makes updates to a dynamic link library (.dll) shared by an existing application, or when an operation deletes a .dll shared by another application.
  • Reliably removes existing programs: Windows Installer can reliably uninstall any program it previously installed. It removes all the associated registry entries and application files, except for those shared by other installed software. You can uninstall an application at any time after a successful installation. (Removal should not be confused with rollback, which restores a computer to its initial state when an installation failure has occurred.)
  • Diagnoses and repairs corrupted applications: An application can query Windows Installer to determine whether an installed application has missing or corrupted files. If any are detected, Windows Installer repairs the application by recopying only those files found to be missing or corrupted.
  • Supports on-demand installation of application features: Windows Installer can be configured to initially install a minimal subset of an application. Later, additional components can be automatically installed the first time the user accesses features that require those components. This is known as advertising. For example, Windows Installer could install Microsoft Word with a minimal set of features. The first time the user tried to access a mail merge function (not included with the original installation), Windows Installer would automatically install the mail merge component. Similarly, Windows Installer can also purge components that go unused in an application. For example, Windows Installer could be configured to remove the mail merge component if it goes unused for 60 days.
  • Supports unattended application installation: Installation packages can be configured to require no installation process interaction from the user. During the installation process, Windows Installer can query the computer for desktop attributes, including determining whether any applications were previously installed by Windows Installer.
  • Supports 32-bit and 64-bit applications: 32-bit applications can be installed on 64-bit machines.
  • Supports .NET technology: The Microsoft .NET Framework is a new platform for building integrated, service-oriented applications that gather information from, and interact with, a wide variety of sources, regardless of the platforms or languages in use. The .NET Framework and the common language runtime can deliver write-once, compile-once, run-anywhere application development. Specifically, .NET delivers code reuse, code specialization, resource management, multi-language development, security, deployment, and administration. The .NET architecture now separates application components so that an application always loads the components with which it was built and tested. If the application runs after installation, then the application should always run. Application installation dysfunctions caused by replacement of original .dlls with .dlls developed for later versions are eliminated.
  • Integrated with Side by Side components: This feature eliminates .dll version conflicts by permitting an application to be bound to the version of the component it was designed and tested with, regardless of the computer that hosts the application. Side-by-side components support the simultaneous execution of multiple versions of each component.
  • Integrated with Software Restriction Policies: This feature provides virus protection support, including protection from Trojan Horse viruses and worms propagated through e-mail and the Web. Software Restriction Policies make the simple, point-and-click, active context user experience safe. Group Policy implements them as part of the list of trusted applications, and Windows Installer operates with applications permitted by these Software Restriction Policies.


Windows Installer technologies

Windows Installer technologies are divided into two parts that work in combination: a client-side installer service (Msiexec.exe) and a package file (.msi file). Windows Installer uses the information contained within a package file to install the application.

Installer service
Windows Installer is an operating system service that allows the operating system to manage the installation process.
Installer program
The Msiexec.exe program is a component of Windows Installer. This program uses a dynamic link library, Msi.dll, to read the package files (.msi), apply transforms (.mst), and incorporate command-line options. The installer performs all installation-related tasks: copying files onto the hard disk, making registry modifications, creating shortcuts on the desktop, and displaying dialog boxes to query user installation preferences when necessary.

When Windows Installer is installed on a computer, the file association capabilities of the operating system are modified to recognize the .msi file type. When a file with the .msi extension is double-clicked, the operating system associates the .msi file with Windows Installer and runs the Msiexec.exe application.

Installation package file
Each package (.msi) file contains a relational type database that stores all the instructions and data required to install (and uninstall) the program across many installation scenarios. For example, a package file could contain instructions for installing an application when a prior version of the application is already installed. The package file could also contain instructions for installing the software on a computer where that application has never been present.

Because the database is relational, changes made to one table are propagated automatically throughout the database. This is a very efficient process for introducing consistent changes into the installation process that simplifies customizing a large application or group of applications. The Windows Installer database tables reflect the general layout of the entire group of applications, including:

  • Available features
  • Components
  • Relationships between features and components
  • Necessary registry settings

The Windows Installer database (.msi file) consists of multiple interrelated tables that together compose a relational database of the information necessary to install a group of features. The following table describes the groups of related tables:

Group | Description
Core table group | Describes the fundamental features and components of the application and installer package.
File table group | Contains the files associated with the installation package.
Registry table group | Contains the registry entries.
System table group | Tracks the tables and columns of the installation database.
Locator table group | Used to search the registry, installer configuration data, directory tree, or .ini files for the unique signature of a file.
Program installation group | Holds properties, bitmaps, shortcuts, and other elements needed for the application installation.
Installation procedure group | Manages the tasks performed during the installation by standard actions and custom actions.
Transforms
The installation process can be manipulated by applying transforms (.mst) to the installation database. A transform makes changes to elements of the database. For example, Windows Installer can use a transform file to change the language in the user interface of an application. The Windows Installer transform files modify the installation package file at installation time, and can therefore dynamically affect the installation behavior.

Customization transforms, much like patches, remain cached on the computer. These transforms are applied to the base package file whenever Windows Installer needs to perform a configuration change to the installation package. Transforms are applied at initial installation; they cannot be applied to an already installed application.


Using Windows Installer

This section covers:

  • Windows Installer in managed environments
  • Command-line options
  • Managing options for computers through Group Policy
  • Managing options for users through Group Policy


Windows Installer in managed environments

Windows Installer is an integral part of IntelliMirror, and a core component of the Windows Group Policy-based change and configuration management technology. For more information on IntelliMirror, see IntelliMirror.

By using the IntelliMirror technologies, Group Policy, and change and configuration management, administrators can approve certain applications, specifying that all configuration operations on those applications (installation, removal, and repair) run as the local system account. The administrator has control and management of the file system and registry, and Windows Installer performs user-initiated software installations. Only applications that are approved by the administrator run with elevated privileges.

For more information on Group Policy and software installation, see How to use the Software Installation snap-in.

Windows Installer can be used to perform installations locally, or to use the Systems Management Server for centralized control of software distribution and installation.

For more information on Group Policy, see Group Policy and Using Windows Installer.

Administrators use Windows Active Directory, IntelliMirror, and Group Policy to assign and publish applications to groups of users or computers within the enterprise. Active Directory is a secure, distributed, partitioned, and replicated directory service that provides management services. These services include a standardized method of locating resources within the enterprise, and applying Group Policy to objects managed by Active Directory.

For more information on Active Directory, see Active Directory.

On the client computer, Windows Installer is a core component of the software installation and maintenance feature. For more information related to software installation, see Understanding Software Installation. Windows Installer provides enhanced resiliency features on Windows desktops, regardless of whether that desktop exists in a server-managed environment.


Command-line options

The Windows Installer command-line syntax includes the following options:

Option Parameters Definition
/i {package|ProductCode} Installs or configures a product.

For example, to install a product from A:\Example.msi, use the following command:
msiexec /i A:\Example.msi

For more information, see To install a package using the command line.

For information about installing transforms using the command line, see To install a transform using using the command line and To install and advertise a product with the command line.
/a package Administrative installation option.

For more information, see To create an administrative installation package from the command line.
/f [p][o][e][d][c][a][u][m][s][v]

{package|ProductCode}

 Repairs a product. This option ignores any property values entered on the command line.

p - Reinstall only if file is missing.

o - Reinstall if file is missing or if an older version is installed.

e - Reinstall if file is missing or an equal or older version is installed.

d - Reinstall if file is missing or a different version is installed.

c - Reinstall if file is missing or the stored checksum does not match the calculated value.

a - Force all files to be reinstalled.

u - Rewrite all required user-specific registry entries.

m - Rewrite all required computer-specific registry entries.

s - Overwrite all existing shortcuts.

v - Run from source and re-cache the local package.

For example, you can repair the installation package using the following command:
msiexec /fpecms Example.msi

For more information, see To repair a package using the command line.
/x {package|ProductCode} x - Uninstalls a product.

For example, you can remove or uninstall a package using the following command:
msiexec /x Example.msi

For more information, see To remove a package using the command line.
/j [u|m]package

[u|m]package /t transform list

[u|m]package /g LanguageID

 Advertises a product. This option ignores any property values entered on the command line.

u - Advertise to the current user.

m - Advertise to all users of the computer.

g - Language identifier.

t - Apply transform to advertised package.

For example, you can advertise a package to all users of this computer using the following command:
msiexec /jm Example.msi

For more information, see To advertise a package using the command line and To install and advertise a product with the command line.
/L [i][w][e][a][r][u][c][m][p][v][+][!]logfile Specifies the path to the log file. The following flags indicate which information to log:

i - Status messages

w - Nonfatal warnings

e - All error messages

a - Startup of actions

r - Action-specific records

u - User requests

c - Initial user interface parameters

m - Out-of-memory

p - Terminal properties

v - Verbose output

+ - Append to existing file

! - Flush each line to the log

* - Wildcard; log all information except for the v option.

To include the v option, specify /L*v.

For example, to install a package and create a log file that contains the information related to the status, out-of-memory, and error messages, use the following command:
msiexec /i Example.msi /Lime logfile.txt

For more information, see To create an installation log file using the command line.
/p PatchPackage Applies a patch. To apply a patch to an installed administrative image you must combine options as follows:

/p - PatchPackage

/a - package

For example, to apply a patch to an administrative installation package, use the following syntax:
msiexec /p <PatchPackage> /a Example.msi

/q {n|b|r|f} Sets user interface level.

qn - No user interface.

qb - Basic user interface.

qr - Reduced user interface with a modal dialog box displayed at the end of the installation.

qf - Full user interface with a modal dialog box displayed at the end.

qn+ - No user interface except for a modal dialog box displayed at the end.

qb+ - Basic user interface with a modal dialog box displayed at the end.

qb- - Basic user interface with no modal dialog boxes.

Please note that /qb+- is not a supported user interface level.

The modal box is not displayed if the user cancels the installation.

For example, to display the basic user interface options during the package installation, use the following command:
msiexec /qb Example.msi

/? or /h none Displays copyright information for the Windows Installer.

? or h - Displays the Windows Installer version and copyright information.

For example, to display the version and copyright information, use the following command:
msiexec /?

/y module y - Calls the system API DllRegisterServer to self-register modules passed on the command line. For example:
msiexec /y my_file.dll.

This option is used only for registry information that cannot be added using the registry tables of the .msi file.
/z module z - Calls the system API DllUnRegisterServer to unregister modules passed on the command line. For example:
msiexec /z my_file.dll.

This option is used only for registry information that cannot be removed using the registry tables of the .msi file.


Managing options for computers through Group Policy

Windows Installer can be configured using Group Policy and Active Directory to manage the computer installation options.

The following table shows policies concerned with managing the Group Policy computer options for Windows Installer. To configure these policies, start Group Policy as described in Start the Group Policy snap-in. Next, in the console tree, click the Windows Installer node.

Where?

  • applicable policy name
  • Computer Configuration
  • Administrative Templates
  • Windows Installer
Policy Details
Disable Windows Installer Disables or restricts the use of Windows Installer.

This policy can prevent users from installing software on their system, or permit users to install only those programs offered by an administrator.

If you enable this policy, you can use the options in the Disable Windows Installer box to establish an installation policy.

Never
Windows Installer is fully enabled. Users can install and upgrade software. Windows Installer is enabled by default in Windows.
For non-managed apps only
Users can install only those programs that an administrator assigns (offers on the desktop) or publishes (adds to Add or Remove Programs).
Always
Windows Installer is disabled.

Note

  • This policy affects Windows Installer only. It does not prevent users from using other methods to install and upgrade programs.
Always install with elevated privileges Windows Installer uses system permissions when it installs any program on the system.

This policy extends to all programs the elevated privileges usually reserved for programs that have been assigned to the user (offered on the desktop) or the computer (installed automatically), or made available in Add or Remove Programs in Control Panel. This policy lets users install programs that require access to directories that the user might not have permission to view or change, including directories on highly restricted computers.

If you disable this policy, or do not configure it, the system applies the current user's permissions when it installs programs that are not distributed or offered by an administrator.

Note

  • This policy appears in both the Computer Configuration and User Configuration folders. To make this policy effective, you must enable the policy in both folders.
Disable rollback This policy prohibits Windows Installer from generating and saving the files it needs to reverse an interrupted or unsuccessful installation.

Disable rollback also prevents Windows Installer from recording the original state of the system and frequency of changes it makes during installation, and prevents Windows Installer from retaining files it intends to delete later. As a result, Windows Installer cannot restore the computer to its original state if the installation does not complete.

This policy is designed to reduce the amount of temporary disk space required to install programs. Disable rollback also prevents malicious users from interrupting an installation to gather data about the internal state of the computer or to search secure system files. However, because an incomplete installation can render the system or a program inoperable, do not use this policy unless essential.

This policy appears in both the Computer Configuration and User Configuration folders. To make this policy effective, you must enable the policy in both folders.
Disable browse dialog box for new source Prevents users from searching for installation files when adding features or components to an installed program.

This policy disables the Browse button next to the Use feature from list in the Windows Installer dialog box. Users must select an installation file source from the Use features from list configured by the administrator.

This policy applies even when the installation is running in the user's security context.

If you disable this policy or do not configure it, the Browse button is enabled when an installation is running in the user's security context, but only administrators can browse when an installation is running with elevated system privileges, such as installations offered on the desktop or in Add or Remove Programs.

This policy affects Windows Installer only. It does not prevent users from using other browsers, such as Windows Explorer or My Network Places, to search for installation files.
Disable patching Prevents users from installing patches to upgrade their programs.

Patches are updates or upgrades that replace only those program files that have changed. Because patches can be easy vehicles for malicious programs, some installations prohibit their use.

This policy applies only to installations that run in the user's security context. By default, users who are not administrators cannot apply patches to installations that run with elevated system privileges, such as those offered on the desktop or in Add or Remove Programs.
Disable IE security prompt for Windows Installer scripts Allows Web-based programs to install software on the computer without notifying the user.

By default, when a script hosted by an Internet browser attempts to install a program on the system, the system warns the user and prompts the user to either allow or refuse the installation. This policy suppresses the warning and allows the installation to proceed without user intervention.

This policy is designed for enterprises that use Web-based tools to distribute programs to their employees. However, because it might pose a security risk, it should be applied cautiously.
Enable user control over installs

Permits users to change installation options that typically are available only to administrators.

This policy bypasses some of the security features of Windows Installer. It permits installations to complete that otherwise would be halted due to a security violation.

The security features of Windows Installer prevent users from changing installation options that are typically reserved for administrators, such as specifying the directory to which files are installed. If Windows Installer detects that an installation package has permitted the user to change a protected option, it stops the installation and displays an error message. These security features operate only when the installation program is running in a privileged security context in which the installation program has access to directories that are denied to the user.

This policy is designed for less restrictive environments. It can be used to circumvent errors in an installation program that prevent software from being installed.
Enable user to browse for source while elevated Users can search for installation files during privileged installations.

This policy enables the Browse button on the Use feature from dialog box. Users can search for installation files, even when the installation program is running, with elevated system privileges. By default, only system administrators can browse during installations with elevated privileges, such as installations offered on the desktop or displayed in Add or Remove Programs.

Because the installation is running with elevated system privileges, users can browse through directories that their own permissions would not allow.

This policy does not affect installations that run in the user's security context. For more information, see the "Disable browse dialog box for new source " policy.
Enable user to use media source while elevated Users can install programs from removable media, such as floppy disks and CD-ROMs, during privileged installation.

This policy permits all users to install programs from removable media, even when the installation program is running with elevated system privileges. By default, users can install programs from removable media only when the installation runs in the user's security context. During privileged installations, such as those offered on the desktop or displayed in Add or Remove Programs, only system administrators can install from removable media.

This policy does not affect installation that run in the user's security context. By default, users can install from removable media when the installation runs in their own security context.

For more information, see the "Disable media source for any install " policy in Managing options for users through Group Policy
Enable user to patch elevated products Users can upgrade programs during privileged installations.

This policy permits all users to install patches, even when the installation program is running with elevated privileges. Patches are updates or upgrades that replace only those program files that have changed. Because patches can easily be vehicles for malicious programs, some installations prohibit their use.

By default, only system administrators can apply patches during installations with elevated privileges, such as installations offered on the desktop or displayed in Add or Remove Programs.

This policy does not affect installations that run in the user's security context. By default, users can install patches to programs that run in their own security context. Also, see the "Disable patching" policy.
Allow administrator to install from Terminal Services session Terminal Services administrators can install and configure programs remotely.

By default, system administrators can install programs only when they are logged on to the computer on which the program is being installed. This policy creates a special exception for computers running Terminal Services.

This policy affects system administrators only. Other users cannot install programs remotely.
Cache transforms in secure location on workstation Copies of transform files are saved in a secure location on the local computer.

Transform files consist of instructions to modify or customize a program during installation. By default, Windows Installer stores transform files in the Application Data directory in the user's profile. When a user reinstalls, removes, or repairs an installation, the transform file is available, even if the user is on a different computer, or isn't connected to the network.

If you enable this policy, the transform file is saved in a secure location on the user's computer instead of in the user profile. Because Windows Installer requires the transform file in order to repeat an installation in which the transform file was used, the user must be using the same computer or be connected to the original or identical media to reinstall, remove, or repair the installation.

This policy is designed for enterprises that must take special precautions to prevent unauthorized or malicious editing of transform files.
Logging

Enter one or more of the following installation log mode options:

[i][w][e][a][r][u][c][m][p][v][o]

This policy specifies the types of events that Windows Installer records in its transaction log for each installation. The log, msi.log, appears in the Temp directory of the system volume.

To indicate that an event type is recorded, enter the letter representing the event type. You can enter the letters in any order, and list as many or as few event types as you want. To disable logging, delete all of the letters from the box.

The Windows Installer logging options are as follows:

Mode | Log entry
i | Status messages
w | Non-fatal warnings
e | All error messages
a | Startup of actions
r | Action-specific records
u | User requests
c | Initial user interface parameters
m | Out-of-memory
p | Terminal properties
v | Verbose output
o | Out of disk space messages

Notes

  • If you disable this policy, or do not configure it, Windows Installer logs the default event types, represented by the letters iweap.
  • You can include all possible events in the installation log file by entering iwearucmpvo. However, doing so will add considerable time to the installation process.


Managing options for users through Group Policy

Windows Installer can be configured using Group Policy and Active Directory to manage the user installation options.

This table shows policies concerned with managing the Group Policy user options for Windows Installer. To configure these policies, start Group Policy as described in Start the Group Policy snap-in. In the console tree, click the Windows Installer node.

Where?

  • applicable policy name
  • User Configuration
  • Administrative Templates
  • Windows Installer
Policy Details
Always install with elevated privileges Directs Windows Installer to use system permissions when it installs any program on the system.

This policy extends to all programs the elevated privileges usually reserved for programs that have been assigned to the user (offered on the desktop) or the computer (installed automatically), or made available in Add or Remove Programs in Control Panel. This policy lets users install programs that require access to directories that the user might not have permission to view or change, including directories on highly restricted computers.

If you disable this policy, or do not configure it, the system applies the current user's permissions when it installs programs that are not distributed or offered by an administrator.

Note

  • This policy appears both in the Computer Configuration and User Configuration folders. To make this policy effective, you must enable the policy in both folders.
Search order

Enter one or more of the following search order options:
[n][m][u]

 Specifies the order in which Windows Installer searches for installation files.

By default, the Windows Installer searches the network first, then removable media (floppy drive, CD-ROM, or DVD), and finally, the Internet (URL).

To change the search order, enable the policy and then enter the letters representing each file source in the order that you want Windows Installer to search:

Option | Media type
n | This option adds the network in the source file search.
m | This option adds the removable media in the source file search.
u | This option adds the Internet in the source file search.

Note

  • To exclude a file source, omit or delete the letter representing that source type.
Disable rollback Prohibits Windows Installer from generating and saving the files it needs to reverse an interrupted or unsuccessful installation.

This policy prevents Windows Installer from recording the original state of the system and sequence of changes it makes during installation. It also prevents Windows Installer from retaining files it intends to delete later. As a result, Windows Installer cannot restore the computer to its original state if the installation does not complete.

This policy is designed to reduce the amount of temporary disk space required to install applications. It also prevents malicious users from interrupting an installation to gather data about internal state of the computer or to search secure system files. However, because an incomplete installation can render the system or an application inoperable, this policy should not be used unless it is essential.

Note

  • This policy appears in both the Computer Configuration and User Configuration folders. To make this policy effective, you must enable the policy in both folders..
Disable media source for any install This policy prevents users from installing programs from removable media.

If a user tries to install a program from removable media, such as CD-ROMs, floppy disks, or DVDs, a message informs the user that the feature cannot be found.

This policy applies even when the installation is running in the user's security context.

If you disable or do not configure this policy, users can install from removable media when the installation is running in their own security context, but only system administrators can use removable media when an installation is running with elevated system privileges, such as installations offered on the desktop or in Add or Remove Programs.


Resources

  • Updated technical information
  • Windows Resource Kit
  • Microsoft MSDN Web site (http://www.microsoft.com/)


Troubleshooting Windows Installer

What problem are you having?

The installation package will not install correctly.

Cause: This can be caused when the installation package has become corrupted.

Solution: Repair the installation package by using the Windows Installer repair option. For more information on repairing installation packages, see To repair a package using the command line.

The installation process stops before completing the installation.

Cause: Windows Installer was not able read the installation package, or conditions on your computer prevented the package from successfully installing.

Solution: Windows Installer creates entries in the Windows event log. Open Event Viewer and review the application log for Windows Installer entries. Windows Installer can be configured to create a custom installation log file. For more information on the Windows Installer log file options, see To create an installation log file using the command line.

Note

  • To open Event Viewer, click Start, point to Settings, and then click Control Panel. Double-click Administrative Tools, and then double-click Event Viewer.


Troubleshooting

This section covers:

  • Troubleshooting Windows Installer