How do I determine what the Windows Installer (msiexec) is doing?

Question

After rolling out a new software package, I'm seeing high CPU usage on machines. One process that seems to be really active is msiexec, which really shouldn't be running. I'm watching it in process explorer and every now and then I can see it launching new processes that I can tell are related to the new software...but the processes end rather quickly.

Is there any way to get some specifics on what the Windows Installer is currently up to?

Answer 1

I'd add to the Process Explorer/Process Monitor suggestion - run FileMon and RegMon from Sysinternals too. You can filter/save a log of the msiexec and related processes, export to a csv and have a complete list of actions to the file system and registry. Compare/contrast with what has been written to the Windows Installer log, too.

You can also have a look at what Scott Willeke's Less Msiérables (LessMSI) can do for you ...

http://blog.scott.willeke.com/2008/03/less-msirables-lessmsi-is-available.html

Use it to extract and change guids and/or contents of MSI, repackage, check out all of the items in the MSI package, etc.

Answer 2

Get Process Monitor from Sysyinternals (MS now). Setup the filter to only watch msiexec.exe. It will tell you all that the process is doing.

Answer 3

If you have control on the installation package, you can activeate the logging of the msiexec. Look at "The Command-Line Options for the Microsoft Windows Installer Tool Msiexec.exe"

Answer 4

Windows installer may spawn multiple instances of msiexec.exe for several reasons.

First of all Windows Installer features a user interface sequence (which can be skipped by running the install silently), and an installation sequence. The two tables for these sequences are called InstallUISequence and InstallExecuteSequence respectively. Due to the way Windows Installer allows "elevated rights" during installation, the InstallExecuteSequence will run as the System account. In other words if you launch the setup in GUI mode and kick of installation that way, you'll normally see two msiexec.exe processes.

Furthermore MSI files can launch custom actions - some of which can spawn new processes (EXE files). I believe these actions may trigger further msiexec.exe processes to show up in the task manager.

Aaron Stebner has a better explanation here: http://blogs.msdn.com/astebner/archive/2005/03/02/384088.aspx