Richard's Weblog

Charting with PowerShell

2009-04-28T16:29:00Z

You may be aware that there are some 3-rd party add-ins for PowerShell that allow you to create charts and graphs from your PowerShell scripts. What you may not be aware of is that there is a free download from Microsoft that will allow you to do the same. The Microsoft Chart Controls for Microsoft .NET Framework 3.5 are a set of .NET classes that allow you to draw bar, line, pie, etc charts with relative ease. I’ve been using these for a C# project I’m working on, but I thought I’d write a short...(read more)

Protecting Removable Drives with Bitlocker

2008-10-06T12:36:46Z

In a recent post , I explained how easy it was to use Bitlocker to secure your drives in a dual-boot scenario with Windows Vista and Server 2008. Following this I had some discussions with colleagues about how to securely backup copies of the files from the encrypted drive. Specifically, how to create a portable copy to carry around with you. Engineers in my team are out on the road a lot and sometimes don't have good access to our corporate network, so having a second copy of important...(read more)

Programming Hyper-V with WMI and C# - Getting Started

2008-08-11T21:25:00Z

You may have seen from a recent post that I received a new laptop that was capable of running Hyper-V. Well, it's all fully installed and working, so I thought I might blog about it a bit. There are plenty of existing blogs on Hyper-V, so I thought I might take a slightly different tack and look at coding for Hyper-V in C#. This suits me fine as I like to get to know new software technologies via their API - I think it really helps to understand the features and what you can do with a technology...(read more)

(Virtually) Everything You Need to Know About Hyper-V

2008-07-21T12:00:00Z

Following on from my post last year on general virtualisation resources, here is a similar one just for Hyper-V. Enjoy! Note: Thanks to my colleague, Tushar, who sent some of these links around to our team recently. Official Hyper-V Web Sites Hyper-V Homepage Hyper-V TechCenter Getting Started with Hyper-V Top Ten Reasons to Adopt Hyper-V (.docx) Key Hyper-V Features Hyper-V FAQ Hyper-V Release Notes Hyper-V Step-by-Step Guide: Getting Started Hyper-V Documents and Articles Windows Server 2008 Hyper-V...(read more)

Vista, Server 2008 and the Case of the Bitlocker Dual Boot

2008-07-19T04:10:29Z

This week, I received my shiny new work laptop, which I'd been anticipating for some time. Normally, I'm not much of a hardware geek and don't get overly excited with new kit, but I was really looking forward to this as it is 64-bit and finally allows me to install Server 2008 and Hyper-V for customer demos, testing, etc. Although I wanted to use Server 2008, I still wanted Vista as my day-to-day desktop for email and the like, so I planned to dual boot with a shared data partition. However,...(read more)

Manipulating Performance Monitor Logs

2008-04-08T20:50:00Z

If you need to monitor or troubleshoot performance problems on a Windows system, chances are you'll simply fire up PerfMon, log some data to a file, which you later load in PerfMon for analysis. This is great and is often all that you need, but it's a bit of a passive use of the log and gives the impression that if you make a mistake in your selections at the start you're stuck with it. What if you didn't gather the data and the log you're given contains counters you don't need, or is too big to...(read more)

Viewing Your MSDN Product Keys Off-Line

2008-03-10T00:13:00Z

If you have an MSDN subscription, then you'll know that the subscription includes a set of product keys for use with the versions of Office, Windows, etc that your subscription gives you access to. The keys can be viewed on-line at the MSDN subscriber site, but this isn't great if you don't have any network access, and even then it's not all that convenient to have to log on each time to get a key. Now, there is an option to export your keys to an XML file, which means you can have them available...(read more)

Forcing Theme Settings in Windows Vista

2007-08-17T13:48:00Z

Recently I was working with a customer to find a way to automate forcing a specific Aero theme in Windows Vista. The idea was to have the Vista clients "colour-coded" according to their use; so whenever a user logs on the window border colour would indicate the type of system (which was actually based on security levels). So, for example, if a user logs onto a public terminal with more relaxed browsing settings, the window borders should be red as a reminder the system is less secure, a more secure...(read more)

Service Security in Windows Vista

2007-06-27T13:30:00Z

After a long break from blogging due to holidays and a heavy workload, I've finally got round to writing something new. To follow on from my last post on File and Registry Virtualisation , I thought I'd take a look at another Vista security-related topic: Service Security . Services generally run with elevated privileges and are therefore very attractive targets for hackers looking for ways to elevate their own privilege level. In Windows Vista several key changes help reduce the security risk when...(read more)

Windows Vista File and Registry Virtualisation

2007-05-18T15:50:00Z

Windows Vista is designed to be more secure than previous versions of Windows. Part of the improvements are related to User Account Control (UAC), which encourages the good practice of not logging on with an Administrator account (and even if you do, it limits your available rights by default). While this is good for security, it can be problematic when dealing with legacy application, many of which were developed with the expectation that the user can make changes to locations such as the Windows...(read more)

Clustering Best Practices: Checking Hotfix Compliance

2007-05-04T01:30:00Z

Do you use Microsoft Clustering? Are your clusters configured according to the current Microsoft recommended practices? How can you be sure of the configuration? Questions, questions. The first is easy, the second you might be unsure of and the third is somewhat more difficult. If you search around Microsoft.com you will find recommendations on how best to configure your cluster, but the thing is that there is no easy way to double-check everything is as it should be, except by making a tedious manual...(read more)

Professional Microsoft Virtual Server 2005

2007-04-18T00:59:00Z

The eagle-eyed among you may have noticed a reference to an unpublished Virtual Server book buried in the middle of my recent list of virtualisation resources . At the time I compiled the list, the book wasn't actually available, but it is now, so I thought I'd give it a bit of promotion: If you’re into virtualisation, then this new book from Ben Armstrong, virtualisation Program Manager, is a must read: Professional Microsoft Virtual Server 2005 [Note: the book is available now in the US, but won't...(read more)

(Re-)Start Me Up ...

2007-04-13T04:30:00Z

As I mentioned in a recent post , I'm currently working on a Windows Vista workshop. As part of that, I've created a simple application that demonstrates the basic interaction of the Windows Installer with Vista's new Restart Manager (RM). I thought I'd post some information on how easy this was to do, which you might find useful for your own applications and packages. My sample application is a basic text editor that uses a multi-line edit control to allow the user to write short notes: Screenshot...(read more)

Windows Vista Resource Kit Released

2007-04-05T02:58:00Z

If you're a long-time Windows Admin, then you'll know how invaluable the Windows Resource Kit has been for the various Windows versions over the years. Now the Windows Vista version has been released and with 1,500 pages of in-depth technical information and over 150 scripts and tools I'm sure it will prove just as much of a "must-have" item for your bookshelf. Get more details on the Windows Vista Team Blog . The only downside seems to be that the competition to win a free copy is closed ......(read more)

How to Interpret Windows Installer Logs

2007-04-02T22:43:00Z

[Updated: 4 April 2007]

If you have a problem with the Windows Installer or an MSI package you're installing, it's a sure bet that you will be told by some smart person to "enable logging".

That's great advice, except ... what do you do with the log once you get it? A common technique is to open it in Notepad and scroll up and down aimlessly, hoping to spot the "cause of your problem" section. While this is a very popular approach, it rarely yields good results. In this post, I'll walk you through the contents of a typical log so that next time you have an Installer problem you'll be in a better position to troubleshoot it yourself.

"Enable Logging"
First things first. If you are to take your smart friend's advice, you need to know how to generate a log. There are a number of ways to do this:

Command-Line
If you can install the MSI package from the command-line, even if only for troubleshooting, then this is a very easy way to generate a log. Simply use the "/l" switch during install:

msiexec /i SomeApp.msi /l*vx %temp%\SomeApp.log

Using the "*vx" modifier gives the most detail possible - you should always use this when troubleshooting.

Registry or Group Policy
If you cannot run the package from the command-line, then enable logging directly in the registry or via Group Policy, as described in KB223300: How to enable Windows Installer logging.

MsiLogging and MsiLogFileLocation properties
With MSI 4.0 these two properties can be set in the Property table of a package to enable logging and specify the log location. See MsiLogging Property for more details.

Installer API
If you are developing an Installer-aware application, you can use the MsiEnableLog API to enable logging for the lifetime of the calling process.

With so many ways to do this, it should be obvious that the Installer team take logging very seriously, and as you'll see the Installer logs a lot of information. Also, with all those methods available to you, you've really got no excuse for not using logging.

Log Contents
Once you have a log, here's what to expect it to contain:

General Contents
By default logs will contain things such as:

Most errors that occurred during the install including all Windows Installer errors that generate a user dialog.
Which custom actions were run.
Whether a reboot was requested and completed.
Values of Installer Properties, including details of any changes.
The source location.
Whether the user cancelled the install.
Where an install stopped.
Whether an install rolled back.
Client and Server information

The Windows Installer runs an installation in two distinct processes: Client and Server. These terms are intended to be used in the COM sense where the client and server are just different processes and not in the sense of distinct client and server computers on the network. The same log file will show information from both processes.

An action by the client process is denoted in the log by "(c)":

MSI (c) (C0:6C) [22:17:24:911]: SHELL32::SHGetFolderPath returned: C:\Users\Admin\AppData\Roaming

An action by the server process is denoted in the log by "(s)":

MSI (s) (38:90) [22:18:04:544]: Doing action: LaunchConditions

The "(30:90)" notation represent the "(processID:threadID)" that generated the entry. Only the last 2 (hexadecimal) digits of the process and thread IDs are given. For example, (30:90) could be generated by process ID 130 and thread ID 290. The time of the log entry is shown next in square brackets.

The log file will first show the client process as dialogs collect user information. After the user information is collected, it is time to do the setup work and the installation switches to the server process. For installations run with no visible UI, the client process is skipped:

MSI (c) (E4:F0) [22:52:31:105]: Client-side and UI is none or basic: Running entire install on the server.

The beginning of the server process looks very similar to the beginning of the client process. The service must re-evaluate all of the settings, to prevent a user from performing insecure operations. All of the private properties, policies, and other installation state settings must be re-evaluated.

Error Codes
The Installer logs a lot of useful information in the form of 'error' codes. Sometimes these are genuine errors, but often they are simply for information purposes and do not indicate a real problem. Full details of all codes can be found in the MSDN Library or the Windows Installer SDK.

As an example, take the following entry from the annotated log below:

MSI (c) (C0:6C) [22:17:24:953]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2

The SDK defines the code 1402 as:

Could not open key: [2]. System error [3].

Thus we would read the log entry as:

Could not open key: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info. System error 2.

System error codes can be found in the Platform SDK file Winerror.h or using the Net HelpMsg command:

In this case error code '2' resolves to "The system cannot find the file specified."

C:\>net helpmsg 2

The system cannot find the file specified.

Return Values
After each action the Installer will record the 'return value' in the log. This is an indicator of the success or otherwise of the action. Possible values are:

Value	Meaning
0	Action was invoked, but did not run (not necessarily a bad thing, maybe there was nothing for it to do)
1	Action was a success
2	Action was cancelled by user
3	An unrecoverable error has occurred
4	The installation was suspended awaiting a reboot

Simply searching for the phrase "Return Value 3" can be a quick way of pinpointing the errors in a log. This isn't guaranteed to lead to the source of a problem as some problems are quite subtle, but it's good first step. It may also break down in localised setup scenarios.

Annotated Verbose Installer Log
Here is an annotated Installer log to use as a reference during your own troubleshooting:

Annotated Windows Installer Log (.docx)

Annotated Windows Installer Log (.pdf)

This log was generated by installing the Debugging Tools for Windows on Windows Vista Ultimate (so MSI 4.0).

Installer logs tend to contain a lot of repeated entries. For example, all file copy operations look alike. So to make understanding the log easier most of the repetition is omitted and only useful examples of each entry type are shown; the original log contained over 5900 entries, but this reduced log contains around 1000. This is a lot less, but is still too much for a simple blog post, hence the downloadable file.

Wilogutl.exe
If you've used Installer logging before, then you probably read to this point thinking "why not just use Wilogutl?". It's a good question and the reason I think you should work with the logs directly is encapsulated in number 1 rule of using the Windows Installer:

Rule 1: Learn the Windows Installer Technology
The importance of this rule cannot be overstated. If you only follow one rule, this is the one to choose.

Microsoft Product Support often speak to Installer users who are installing packages which they created with a sophisticated high-level re-packaging tool, without any understanding of how the Installer actually works. While these tools are excellent at what they do and they abstract the user from the details on a day-to-day basis, the lack of Installer knowledge becomes a real problem when the package does not work as expected. Setup authoring is not simply about copying files. The Installer offers extensive functionality and complexity; understand it before you start authoring packages.

Reading through a lot of logs and using them to troubleshoot real problems is a great way to learn about how the Installer works. Obviously, once you're confident with the underlying technology you can return to using helpful tools to do the work for you.

If you are wondering what on Earth "Wilogutl" is, then have a look here:

Wilogutl.exe
Wilogutl.exe assists the analysis of log files from a Windows Installer installation, and it displays suggested solutions to errors that are found in a log file.

I won't discuss how to use Wilogutl here, but may do so in a future post.