Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 2 down vote favorite
1

What is the best way to create MSI package to deploy a registry key over a network, rather than using GPO.

share|improve this question

3 Answers

up vote 1 down vote accepted

There are many tools for building MSIs. I prefer Advanced Installer, which is available as a freeware version. Advanced Installer allows you to manually input registry keys/values, or import them from a file or live registry. It is quite simple to use.

Alternatively, if you don't need an MSI, you can easily manipulate the registry from the command line using the Windows utility reg.exe. This can be done remotely using tools such as psexec.

share|improve this answer
when i import the reg key, does it require enduser interaction – Eddy Apr 14 '11 at 12:25
@Eddy No, you import the reg key as part of the MSI build process. When deploying the MSI, use something like msiexec /i your.msi /qn and the MSI will install without user interaction. – jscott Apr 14 '11 at 12:26
@Eddy you don't specify which registry hive you're manipulating, but beware of the differences between deploying reg keys under Local Machine and those under Current User. Your deployment tool may or may not give you the choice to run under the System or User contexts, and your user may or may not have permission to make changes to the Local System hive. – GAThrawn Apr 15 '11 at 16:16
up vote 6 down vote

I wouldn't use an MSI to deploy registry settings. An MSI pointed at system settings is a "loose cannon". The MSI thinks it "owns" the key and will be trigger happy removing or reverting it. Here are some details:

  • If you author the MSI badly the component writing the settings will not be marked permanent, and if the MSI is ever uninstalled it will rip the whole registry key/value out. Note that if you upgrade the MSI a major upgrade WILL perform a full uninstall before the new version is installed. If the reinstall then fails your registry key is missing.
  • Furthermore you get these MSI files showing up in the Add/Remove applet on the system where users can see them and potentially uninstall them. You can hide your MSI from this view by setting the ARPSYSTEMCOMPONENT property to 1. This will only prevent the display in add/remove though. The MSI can still be uninstalled from the command line though.
  • Even if your MSI is hidden in ARP, if you are using a deployment tool such as SCCM, Altiris, Unicenter or similar, a dilligent admin with a cleanup-fetish could decide to uninstall these "hack packages" and wreck havoc if the MSI wipes required settings. Remember that MSI files generally run elevated as well, so they are definitely armed and dangerous if up to no good in the first place.
  • Installing an MSI will trigger the creation of a restore point on the PC. This could be time consuming and seems excessive if you are just writing a couple of values.
  • If you are really unlucky and author an MSI that may self-repair at some time, you could overwrite/revert settings that have been changed by subsequent changes. This kind of scenario is often hard to debug.
  • Similarly to above, the fact that you see an MSI installed on the system is often seen as evidence that a system is "patched". What the presence of the MSI tells you is that the installer ran at one point, but you know nothing about the present registry state.
  • As others have mentioned, if the registry keys you are writing are under HKCU, they will only be written if the user in question happens to be logged on at the time the MSI is installed. Any other users will NOT have their registry updated. ActiveSetup can help here.

Those were just the few off the top of my head that I can provide.

share|improve this answer
this is really good info thanks, ok then what is your suggestion for such case ? – Eddy Jun 3 '11 at 9:44
The obvious choice for most values are GPO, but given you don't want to use that and I have one foot in development I would probably roll my own tool written in C# or similar to check the state of a single system or all systems for specific registry values. Other than that jscotts advice to use reg.exe could work ok I suppose. If the registry settings are per user I would recommend the use of "ActiveSetup" to ensure all users get the update, not just the ones logged on whilst installation is running. – Glytzhkof Jun 3 '11 at 17:19
If you do end up using an MSI file, always make sure that the components it installs are set permanent. But don't :-). If you want to update user profiles / HKCU, try activesetup as described here: stackoverflow.com/questions/1423687/… – Glytzhkof Jun 3 '11 at 17:27
up vote 1 down vote

You could always add it via a logon script, or whip up a script that uses psexec to deploy it via the command line remotely?

share|improve this answer
They did state "rather than using GPO", so I didn't know if local GP would be a consideration. Also, why your user icon isn't the cardboard box, I'll never know. – jscott Jun 3 '11 at 17:57
Actually, I was more thinking of inside the user logon scripts. It's dirty but it does work. And I also use psexec at times to silently perform tasks without other users having to be bothered from their work. – Alexander Miles Jun 3 '11 at 18:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.