Software Deployment

Filemon from Sysinternals...now Microsoft http://www.microsoft.com/technet/sysinternals/default.mspx

Monitor the installation, then search for .msi. You will have collected a ton of information but if an MSI is extracted you should be able to see it.

Enable the DisableMSI policy and if the setup.exe is trying to execute any MSI it will be prevented and an error message will be displayed.
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer

DisableMSI (REG_DWORD) =
0 or a missing Value Name, enables the installer.
A 1 disables the installer for non-managed applications.
A 2 disables the installer for all applications.

You should use:
DisableMSI (REG_DWORD) = 2

watch the running processes for msiexec.exe

If you do look for running msiexec.exe processes, have in mind if the Windows Installer (MSIServer) service has already started due to previous MSI installation the msiexec.exe process will be visible.

You could of course enable MSI logging and look for any newly created MSIxxxx.log file in the %temp% folder during or after you've installed the application.

Or.. Run filemon when logged on with an admin account.. In filemon highlight *CREATE*.. :P

In filemon highlight *CREATE*..
There would be a lot of CREATE API queries during an install don't you think [;)]

ORIGINAL: AngelD

Enable the DisableMSI policy and if the setup.exe is trying to execute any MSI it will be prevented and an error message will be displayed.
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer

DisableMSI (REG_DWORD) =
0 or a missing Value Name, enables the installer.
A 1 disables the installer for non-managed applications.
A 2 disables the installer for all applications.

You should use:
DisableMSI (REG_DWORD) = 2


Similar to the above, I would use the policies in the following way to enable full verbose logging

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer]
"Debug"=dword:00000007
"Logging"="voicewarmup"

Then all you do is check the local temp folder (%temp%) for the creation of an MSI log file if there has been any MSI activity. This log file will also contain the commandline that was executed, thus revealing the full path to where the MSI was extracted to/called from as well as any properties that are being passed to it.

Alan