.msi
Windows Installer Package
A database of instructions the Windows Installer service reads to place software on a machine. Not a program that runs, a package that is executed on your behalf.
at a glance
- container
- OLE
- executes
- a service runs it
- elevation
- usually
- install scope
- machine
- inventory
- appears in Add/Remove Programs
Knowing it is really that
The extension is a property of the directory entry, not of the file. What identifies the format is what is in the bytes.
| offset | bytes |
|---|---|
| 0 | D0 CF 11 E0 A1 B1 1A E1 |
OLE compound file. Shared with .doc, .xls and .msg, so it identifies the container, not the type.
What is actually inside
An OLE compound file holding a relational database. Tables rather than a script: Property carries the product metadata, File and Component describe what lands on disk, Directory the layout, Feature the optional parts, and the InstallExecuteSequence table is the ordering that actually drives the install. Payload sits in cabinet streams inside the file or in cabinets beside it.
What reading it tells you
- the declared product name, manufacturer and version, from the Property table
- ProductCode and UpgradeCode, GUIDs that identify the product across versions more reliably than its name
- the complete list of files to be written, with target directories, before anything is written
- whether the package runs custom actions rather than only copying files
- whether the install is per-machine or per-user, from the Property table before it runs
What it does not tell you
The useful half, and the half a file-type reference usually leaves out.
- what a custom action does. The table holds a reference to a DLL export, an executable or a script; the behaviour is in the thing referenced, which may not be in the package at all
- whether the Manufacturer string is true. It is typed by whoever authored the package and validated by nobody
- what the machine looks like afterwards. Custom actions can create services, scheduled tasks and registry state that no table in the package describes
- what a transform will change. A .mst applied at install time can rewrite almost any table, so the package you inspected is not necessarily the package that installs
Why it turns up on an endpoint
It is the format enterprise deployment expects. Intune, Configuration Manager and Group Policy all take an MSI directly, because the database is queryable, the install is transactional and the uninstall is derived rather than written by hand. Anything shipped for managed environments arrives this way or wraps something that does.