How do I determine what the Windows Installer (msiexec) is doing?

I'd add to the Process Explorer/Process Monitor suggestion - run FileMon and RegMon from Sysinternals too. You can filter/save a log of the msiexec and related processes, export to a csv and have a complete list of actions to the file system and registry. Compare/contrast with what has been written to the Windows Installer log, too.

You can also have a look at what Scott Willeke's Less Msiérables (LessMSI) can do for you ...

http://lessmsi.activescott.com/

Use it to extract and change guids and/or contents of MSI, repackage, check out all of the items in the MSI package, etc.


Get Process Monitor from Sysyinternals (MS now). Setup the filter to only watch msiexec.exe. It will tell you all that the process is doing.


Windows installer may spawn multiple instances of msiexec.exe for several reasons.

First of all Windows Installer features a user interface sequence (which can be skipped by running the install silently), and an installation sequence. The two tables for these sequences are called InstallUISequence and InstallExecuteSequence respectively. Due to the way Windows Installer allows "elevated rights" during installation, the InstallExecuteSequence will run as the System account. In other words if you launch the setup in GUI mode and kick of installation that way, you'll normally see two msiexec.exe processes.

Furthermore MSI files can launch custom actions - some of which can spawn new processes (EXE files). These actions may trigger further msiexec.exe processes to show up in the task manager.

Aaron Stebner has a better explanation here: http://blogs.msdn.com/astebner/archive/2005/03/02/384088.aspx

One more link: https://www.symantec.com/connect/blogs/multiple-msiexec-processes-running-during-installation