Self-healing HKCU Keys for each user

Used incorrectly, MSI’s self-healing capability can be troublesome, popping up dialogs saying, “Windows Installer is checking components…” and failing to install if the users does not have administrator-level rights. On the other hand, you can use MSI’s self-healing to your advantage, and one particular situation where you might do this is for adding registry keys or files to the any user’s profile as needed.

If your target application writes to the HKEY_CURRENT_USER hive of the registry and you repackage it with this included, those user-specific entries are only written to the profile of the administrator or tech who’s installing the program-not very useful. But if you set it up correctly, you can have the Windows Installer service add those values the first time any user runs the program.

Ed Tippelt, a repackaging expert and prolific poster on the Wise newsgroups, has the best advice summary for this situation (currently available here or in a number of newsgroup posts):

How to install HKCU registry keys for each user using the auto-repair feature of Windows Installer:

I would suggest moving the component(s) containing HKCU registry keys into a new feature. I would propose the following new feature structure. Create a new feature named CurrentUser and move all of your components containing HKCU registry keys. You will probably want to check these components to ensure they have ONLY HKCU registry keys as this will allow Windows Installer (Version 2.0) to repair without needing the source
MSI and without needing permissions to install files.

Make this CurrentUser feature the parent feature of all other features in your feature structure. The reasoning for this is how Windows Installer performs the existence checks on keypaths of components. This is always triggered by accessing an advertised entry point. Most commonly this is an advertised
shortcut, but can also be a file association or file registration information.

When an advertised access point is triggered, say an advertised shortcut is launched, Windows Installer will then check the keypaths of all components within the feature which contains that particular shortcut and all parent features of that feature. If no broken components are found no repair occurs. If a broken component is found in any feature then Windows Installer will check the keypaths of all components
within ALL features of the MSI and then perform the repair.

By making the CurrentUser feature the parent of all other features this will ensure that whenever any advertised access point within the MSI is triggered the HKCU registry keys will be checked and if they do not exist will be repaired.

Additionally, when Windows Installer is checking the keypaths of components it does not verify registry key values, it merely checks that these keys exist, regardless of value. Therefore, it is safe to set any HKCU key as the key path of your component. The same is true with file key paths. There is no type of CRC check performed it merely checks to see if the file exists, even if it is corrupt the check will succeed if
the file is at that location.

This technique can also be used to install files to the user’s profile Use the standard file install process to place a copy of the file on the local hard disk. Then add the file to the duplicate file table with the destination folder being the user’s profile folder (can be done from installation expert), and ensure this duplicate file is in a component of the CurrentUser feature. Thus when the CurrentUser feature is
repaired the duplicate file is installed also.

©2002 Ed Tippelt, with thanks to Wise support for some ideas documented here. (Reprinted here under “fair use”.)

Another, more detailed explanation of this process by jmcfadyen can be downloaded from

Please note that packaging applications destined for the Windows 2000/2003 Terminal Server Edition (TSE) differs in this regard. On TSE, regular users cannot initiate the MSIEXEC process, so self-healing HKCU keys will fail. However, TSE is built to allow you (the administrator) to pre-populate the default HKCU hive, which is used to generate the TSE users’ temporary hives each time they logon. Unlike the NT/2k/XP Default
User’s NTUSER.DAT hive, TSE uses the values in its default user hive for every logon, not just the first time a profile is created for the account. As it relates to packaging, you thus only want to write your user-specific registry keys to this default user hive and they will take effect for all users upon next logon. Search the newsgroups and Microsoft’s TSE documentation for more information.

Self-heal vs. ActiveSetup

Having Windows Installer’s auto-repair set user-specific registry keys and files may not be enough for all situations. More complex apps may require more complicated user configuration, which can be done with an executable or script launched by Microsoft’s ActiveSetup capability.

Again, Ed Tippelt’s summary is the most concise and helpful explanation:

Active Setup and how to implement it:

Active setup is a process that runs automatically when a user logs in. Registry keys at “HKLM\Software\Microsoft\Active Setup\Installed Components\%APPNAME%” and “HKCU\Software\Microsoft\Active Setup\Installed Components\%APPNAME%” are compared, and if the HKCU registry entries don’t exist, or the version number of HKCU is less than HKLM, then the specified application is executed for the current user.

If your application requires installation of components such as files or registry keys on a per-user basis, but your application has no advertised entry points or other triggers to initiate the installation process, then Active Setup is the solution.

©2002 Ed Tippelt. (Reprinted here under “fair use”.)

A fellow named Evan J.Housh has created a VBS script which can easily be added to your MSI as a custom action to automagically create the Active Setup configuration you want. By default, it runs the msiexec /fu {GUID} action to self-heal only the CurrentUser-related components, but with a single property you can configure it to run whatever executable you want. I’ve made it available for download on my website here.