Find out which MSI created registry key

1

How can I find out which MSI created given registry key?

Konstantin Spirin

Posted 2013-02-05T09:58:54.210

Reputation: 121

Answers

2

The registry does not store information about it's creator. Thus, unless entry is associated with some of MSI's GUIDs there is not way to backtrack it.

All (well, most) MSI installation data is cached in Windows\Installer folder under random names, this is the place there all information required by uninstall stored. If your registry key name value is pretty unique, you can do a raw Unicode (UTF-16LE) string search in MSI files located in that folder, resulting in a MSI. You can further use Orca tool to read information in that MSI.

Petr Abdulin

Posted 2013-02-05T09:58:54.210

Reputation: 1 706

Is there a database of all activities carried out by installed MSIs? Windows allows to uninstall apps so it must somehow know what exactly needs to be done during uninstallation. – Konstantin Spirin – 2013-02-06T01:23:22.960

1See updated answer. – Petr Abdulin – 2013-02-06T03:05:57.150