Windows Installer Service Registry Key Settings

The Windows Installer service (MSIServer) manages the installation, maintenance, and removal of software on Windows operating systems. This article outlines the primary Windows Registry keys used to manage the behavior, startup properties, policies, and operational restrictions of the Windows Installer service.

1. Service Configuration Key

The core service configuration for the Windows Installer is located at:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msiserver

This key controls the core service parameters: * Start: Controls the startup type of the service. * 2 = Automatic * 3 = Manual (Default) * 4 = Disabled * ImagePath: Contains the path to the installer executable (%systemroot%\system32\msiexec.exe /V). * ObjectName: Specifies the account under which the service runs (LocalSystem).

2. Group Policy and Behavioral Control Keys

System-wide and user-specific behaviors are controlled via Windows Installer policy keys located at:

• System-wide policies: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer
• Per-user policies: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Installer

Key DWORD values configured under these paths include:

• DisableMSI: Restricts or completely disables the use of Windows Installer.
  • 0 = Windows Installer is fully enabled.
  • 1 = Standard users cannot install applications; only administrators can.
  • 2 = Windows Installer is disabled entirely.
• AlwaysInstallElevated: When set to 1 in both HKLM and HKCU, allows standard users to run installations with elevated (System) privileges.
• DisablePatch: Set to 1 to prevent users from applying software patches or updates to installed applications.
• Logging: Enables verbose logging for troubleshooting installations. Setting this string value to voicewarmupx enables all available logging flags.
• SafeForScripting: Restricts the execution of installer scripts from untrusted web pages.

3. Safe Mode Execution Keys

By default, the Windows Installer service does not run in Safe Mode. Its execution in Safe Mode is controlled by adding the MSIServer subkey with the string value set to Service under:

• Safe Mode: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer
• Safe Mode with Networking: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MSIServer