What happens underneath the hood, Windows Installer, msiexec.exe

To debug what is really going on with process msiexec.exe I use this special setting cartridge:
reg delete "HKCU\Software\Sysinternals\Process Monitor" /f
reg add "HKCU\Software\Sysinternals\Process Monitor" /v "FilterRules" /t REG_BINARY /d 0102000000759c00000000000001180000006d007300690065007800650063002e0065007800650000000000000000000000829c000000000000004600000043003a005c00570069006e0064006f00770073005c00730079007300740065006d00330032005c006d007300690065007800650063002e0065007800650020002f00560000000000000000000000 /f
reg add "HKCU\Software\Sysinternals\Process Monitor" /v "ColumnCount" /t REG_DWORD /d 3 /f
reg add "HKCU\Software\Sysinternals\Process Monitor" /v "ColumnMap" /t REG_BINARY /d 749c0000779c0000829c0000829c0000829c0000829c0000829c0000829c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 /f
reg add "HKCU\Software\Sysinternals\Process Monitor" /v "Columns" /t REG_BINARY /d 82009600d7019001d70164006400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 /f
reg add "HKCU\Software\Sysinternals\Process Monitor" /v "EulaAccepted" /t REG_DWORD /d 1 /f
reg add result via command line window
Now I open Procmon.exe

I have already installed custom settings for msiexec detection:
Process Monitor Filter settings and custom columns
If the msiexec.exe is running I need to wait 10 seconds or something..
Now I can see what is going on:
Full Command Line Column of Process Monitor

No comments: