17 May 2018

Explaining the %WINDIR%\Installer Folder

While recently writing an MSI uninstaller script, I needed to be able to associate the GUID with the applications name. In the process, I was finally able to associate the MSI files inside the Installer folder with the application.

You may wonder why you want to know this. Most of this is probably just for general knowledge, but there are a couple of instances I can think of on why you might want to know. For one, I used it as described above. You may also want to know this if you are checking to see if the MSI is available to do an uninstall or a repair.

The MSI and MSP files inside the %WINDIR%\Installer folder are associated with the installed application or update in the following registry location:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\<Unique Identitier>\InstallProperties

The screenshot below shows an example of the unique MSI filename in the %Windir%\Installer directory associated with the installed application. The association is made under the LocalPackage.


  1. One of the things to remember about the localpackage is that it is not just the a copy of the msi that ran on install. It's actually the merge of the msi and the applied transform (s) logic. This is how on repair your installation remembers the application language and other properties supplied by your administrator or ESD solution. Examining size of the locally cached msi will show you they are substantially smaller then the original msi. The files are referenced when needed for repair or reconfiguration from the full msi referenced in the installsource regvalue. Lost the source connection? Just find the original msi, update the regkey and you are back in business for repair.

  2. O and another tip, on the %windir%\installer folder add the column "Subject" to "Name", "Date Modified", "Type" and "Size" that are already shown by default. The Subject column will tell you what each weird msi name actually is without going through registry manually.

  3. This is not true that it is a merge, at least with Win 7 and later. I know this because Win7 started caching the original full MSI without stripping out the *.cab files so it could preserve the signature on the package and during maintenance operations show a valid publisher signature. IIRC before then, transforms were also cached and the log would show the transforms loading from the cached location.