AppDeploy: Articles: ActiveSetup

Active setup provides a solution when the aim is to deliver user based components when no advertised entry points exist in an MSI package.

Most packages will contain some kind on entry point; commonly an advertised shortcut. When launching this kind of shortcut Windows Installer will check the keypath of the component the shortcut belongs to and verifies that the component is installed. If it is found to be missing Windows Install will kick off a repair.

This provides a great solution for installing current user data when the package is not installed in the user context. It is also a very good reason why you should never mix machine and user data in the same feature.

So what do you do if there are no shortcuts to advertise? Active Setup will solve the problem.

An MSI package has been created to install an Outlook plug-in. This package installs both user and machine data. User preferences are stored as a combination of HKCU registry and a XML file written to %USERPROFILE%. As this application is a plug-in it does not contain any shortcuts. There are no other advertised entry points that might trigger a repair.

Further, this package is installed by the privileged account NTAUTHORITY\system. In this situation the user registry and XML file will be delivered to the Administrators profile and will never be installed for the user. This is when using active setup is appropriate.

On logon the following registry keys are compared:
HKLM\Software\Microsoft\Active Setup\Installed Components\<UID>
HKCU\Software\Microsoft\Active Setup\Installed Components\<UID>

<UID> has to unique; it is good practise to use a GUID.

If the HKCU key is not found the contents of the string value StubPath is executed. The HKLM key is then copied to HKCU.

The executable in StubPath can be anything (a VBS script, a regsvr32.exe call, etc), but our aim, in this example, is to deliver missing current user data from a previously installed MSI. To do this we need to force the package to repair so Msiexec.exe will be used:

Msiexec.exe /fpu/qn

/f - Repair
/p - only if file is missing
/u - all required user-specific registry entries

If you choose to, the entire installation can be repaired:

Msiexec.exe /fauvs/qn

Example HKLM installed components key
HKLM should look as follows:
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{44CCA842-CC51-11CF-AAFA-00AA00B6015B}]
"StubPath"="Msiexec.exe /fpu {44CCA842-CC51-11CF-AAFA-00AA00B6015B}"

Where a version is included; StubPath will only execute if the version of HKCU is less than the version of HKLM.

When a new user logs on Windows will find the HKCU active setup key missing, run Msiexec.exe with the repair arguments from StubPath and copy the HKLM key to HKCU. Next time this user logs in the repair won't run as the key already exists in HKCU.

Charlotte Gonella
June 2007


  • Version numbers require commas instead of dots. e.g. 2,0,4 - elft 11 years ago
    • Why comma's in activesetup version why not dots.. - santhya 5 years ago
  • This was very useful, thank you! Now i can stop writing to all the profile hives directly. Why is this not documented anywhere else?! - koman90 10 years ago
    • Probably because it is a workaround that packagers have been using since windows installer lacks the ability to "stuff profiles" natively. It was first introduced with Internet Explorer 4, to be able to install updates prior to the shell loading. - lascelk 10 years ago
  • I believe x64 needs to also be considered - mchaudoir 10 years ago
  • We need to restrict the use of high number of active setup containing packages as it would really slow down the login. Also the switches we pass along with /f should be considered. Only use what is needed along with /f parameter. - apptopack 8 years ago
  • Active Setup only needs to be used by any MSI which does not have an Advertised Shortcut or any app which is not usually launched by the shortcut but by double-clicking on a file (Adobe Reader for example). Most environments won't have more than 5 or 6 apps that fall into this category. As for slowing down the login process, most A.S. packages will take less than a second to run the repair command and rarely will a user see the MSI modal box. - vjaneczko 8 years ago
  • I try to avoid using MSI files in active setup, as I have seen situations where an MSI can be running an install triggered by the user logon, and this results in the active setup failing. Because the user registry is updated regardless of whether the active setup works or not, it will never run again. Better to use a script that does not rely on MSI technology - it is also generally faster. - EdT 7 years ago
This post is locked
This website uses cookies. By continuing to use this site and/or clicking the "Accept" button you are providing consent Quest Software and its affiliates do NOT sell the Personal Data you provide to us either when you register on our websites or when you do business with us. For more information about our Privacy Policy and our data protection efforts, please visit GDPR-HQ