Windows Installer (MSI) et le registre¶

# Count all MSI-installed products registered on this machine
$products = Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" |
    Where-Object { (Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue).WindowsInstaller -eq 1 }
Write-Host "MSI products installed: $($products.Count)"

# Retrieve the three GUIDs for a specific MSI product using WMI
$product = Get-CimInstance Win32_Product | Where-Object { $_.Name -like "*Visual C++ 2022*" } | Select-Object -First 1
if ($product) {
    Write-Host "ProductCode:  $($product.IdentifyingNumber)"
    Write-Host "PackageCode:  $($product.PackageCode)"
    # UpgradeCode requires querying the MSI database or the registry
    $compressed = ($product.IdentifyingNumber -replace '[{}]','')
    Write-Host "Name:         $($product.Name)"
}

# Convert a standard GUID to MSI compressed format
function ConvertTo-CompressedGuid {
    param([string]$Guid)
    $clean = $Guid -replace '[{}\-]', ''
    $groups = @(8, 4, 4, 2, 2, 2, 2, 2, 2, 2, 2)
    $result = ""
    $pos = 0
    foreach ($len in $groups) {
        $chunk = $clean.Substring($pos, $len)
        $reversed = -join ($chunk.ToCharArray() | Sort-Object { -([array]::IndexOf($chunk.ToCharArray(), $_)) })
        # Proper reversal
        $chars = $chunk.ToCharArray()
        [Array]::Reverse($chars)
        $result += -join $chars
        $pos += $len
    }
    return $result
}

# Convert an MSI compressed GUID back to standard format
function ConvertFrom-CompressedGuid {
    param([string]$Compressed)
    $groups = @(8, 4, 4, 2, 2, 2, 2, 2, 2, 2, 2)
    $parts = @()
    $pos = 0
    foreach ($len in $groups) {
        $chunk = $Compressed.Substring($pos, $len)
        $chars = $chunk.ToCharArray()
        [Array]::Reverse($chars)
        $parts += -join $chars
        $pos += $len
    }
    return "{$($parts[0])-$($parts[1])-$($parts[2])-$($parts[3])$($parts[4])-$($parts[5])$($parts[6])$($parts[7])$($parts[8])$($parts[9])$($parts[10])}"
}

# Example usage
$standard = "{AC76BA86-7AD7-1033-7B44-AC0F074E4100}"
$compressed = ConvertTo-CompressedGuid $standard
Write-Host "Standard:   $standard"
Write-Host "Compressed: $compressed"
Write-Host "Back:       $(ConvertFrom-CompressedGuid $compressed)"

# List all registered MSI products from the Products subtree
Get-ChildItem "HKLM:\SOFTWARE\Classes\Installer\Products" | ForEach-Object {
    $props = Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue
    if ($props.ProductName) {
        [PSCustomObject]@{
            CompressedGuid = $_.PSChildName
            ProductName    = $props.ProductName
            Language       = $props.Language
            Assignment     = if ($props.Assignment -eq 1) { "Per-machine" } else { "Per-user" }
        }
    }
} | Format-Table -AutoSize

# Decode an MSI product version from the registry
function ConvertFrom-MsiVersion {
    param([int]$EncodedVersion)
    $major = [math]::Floor($EncodedVersion / 16777216)   # bits 24-31
    $minor = [math]::Floor(($EncodedVersion % 16777216) / 65536)  # bits 16-23
    $build = $EncodedVersion % 65536                      # bits 0-15
    return "$major.$minor.$build"
}

# Example: version value 0x0E000000 = 14.0.0
$regVersion = (Get-ItemProperty "HKLM:\SOFTWARE\Classes\Installer\Products\68AB67CA7DA73301B744CAF070E41400" -ErrorAction SilentlyContinue).Version
if ($regVersion) {
    Write-Host "Encoded: $regVersion -> Decoded: $(ConvertFrom-MsiVersion $regVersion)"
}

# Explore components for a specific product (by compressed GUID)
$productGuid = "68AB67CA7DA73301B744CAF070E41400"
Get-ChildItem "HKLM:\SOFTWARE\Classes\Installer\Components" | ForEach-Object {
    $val = (Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue).$productGuid
    if ($val) {
        [PSCustomObject]@{
            ComponentGuid = $_.PSChildName
            Keypath       = $val
        }
    }
} | Select-Object -First 10 | Format-Table -AutoSize

# List features of a product
$productGuid = "68AB67CA7DA73301B744CAF070E41400"
$path = "HKLM:\SOFTWARE\Classes\Installer\Features\$productGuid"
if (Test-Path $path) {
    $props = Get-ItemProperty $path
    $props.PSObject.Properties | Where-Object { $_.Name -notlike "PS*" } | ForEach-Object {
        [PSCustomObject]@{
            Feature = $_.Name
            Value   = if ($_.Value) { $_.Value.Substring(0, [Math]::Min(60, $_.Value.Length)) + "..." } else { "(empty)" }
        }
    } | Format-Table -AutoSize
}

# Explore UserData for a specific product installed per-machine
$sid = "S-1-5-18"
$basePath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\$sid\Products"
if (Test-Path $basePath) {
    Get-ChildItem $basePath | Select-Object -First 5 | ForEach-Object {
        $installProps = Get-ItemProperty "$($_.PSPath)\InstallProperties" -ErrorAction SilentlyContinue
        if ($installProps.DisplayName) {
            [PSCustomObject]@{
                CompressedGuid  = $_.PSChildName
                DisplayName     = $installProps.DisplayName
                InstallDate     = $installProps.InstallDate
                InstallLocation = $installProps.InstallLocation
                InstallSource   = $installProps.InstallSource
            }
        }
    } | Format-Table -AutoSize
}

# Enumerate all installed software from all three Uninstall registry locations
$uninstallPaths = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall",
    "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
)

$allSoftware = foreach ($path in $uninstallPaths) {
    if (Test-Path $path) {
        Get-ChildItem $path | ForEach-Object {
            $props = Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue
            if ($props.DisplayName -and $props.SystemComponent -ne 1) {
                [PSCustomObject]@{
                    Name         = $props.DisplayName
                    Version      = $props.DisplayVersion
                    Publisher    = $props.Publisher
                    InstallDate  = $props.InstallDate
                    Size_MB      = if ($props.EstimatedSize) { [math]::Round($props.EstimatedSize / 1024, 1) } else { $null }
                    Architecture = if ($path -match "WOW6432Node") { "x86" } else { "x64" }
                    Scope        = if ($path -match "HKCU") { "Per-user" } else { "Per-machine" }
                    IsMSI        = $props.WindowsInstaller -eq 1
                    ProductCode  = $_.PSChildName
                }
            }
        }
    }
}

$allSoftware | Sort-Object Name | Format-Table Name, Version, Publisher, Architecture, Scope, IsMSI -AutoSize
Write-Host "`nTotal: $($allSoftware.Count) applications"

# Find all products sharing the same UpgradeCode
$upgradeCodePath = "HKLM:\SOFTWARE\Classes\Installer\UpgradeCodes"
if (Test-Path $upgradeCodePath) {
    Get-ChildItem $upgradeCodePath | ForEach-Object {
        $products = (Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue).PSObject.Properties |
            Where-Object { $_.Name -notlike "PS*" }
        if ($products.Count -gt 1) {
            [PSCustomObject]@{
                UpgradeCode    = $_.PSChildName
                ProductCount   = $products.Count
                ProductGuids   = ($products.Name -join ", ")
            }
        }
    } | Select-Object -First 5 | Format-Table -AutoSize
}

# Watch MSI registry writes in real-time with Process Monitor filters
# (requires Sysinternals Process Monitor)
# Recommended filters:
#   Process Name = msiexec.exe
#   Operation begins with "Reg"
#   Result = SUCCESS
# Export the results to analyze the exact sequence of registry operations

# Repair only registry entries for a product (per-user and per-machine)
$productCode = "{AC76BA86-7AD7-1033-7B44-AC0F074E4100}"
Start-Process "msiexec.exe" -ArgumentList "/fum $productCode /qn" -Wait -NoNewWindow
Write-Host "Registry repair completed for $productCode"

# Disable MSI auto-repair globally (not recommended in production)
# This setting prevents the repair check on advertised shortcuts
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer" `
    -Name "DisableAutoPatch" -Value 1 -Type DWord

# Alternatively, convert advertised shortcuts to standard shortcuts
# This removes the repair trigger for a specific product
$shortcutPath = "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\MyApp.lnk"
if (Test-Path $shortcutPath) {
    $shell = New-Object -ComObject WScript.Shell
    $shortcut = $shell.CreateShortcut($shortcutPath)
    # Re-save the shortcut as a standard (non-advertised) shortcut
    $shortcut.TargetPath = "C:\Program Files\MyApp\MyApp.exe"
    $shortcut.Save()
    Write-Host "Converted advertised shortcut to standard shortcut"
}

# Check if AlwaysInstallElevated is enabled (security audit)
$hklmValue = Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer" `
    -Name "AlwaysInstallElevated" -ErrorAction SilentlyContinue
$hkcuValue = Get-ItemProperty "HKCU:\SOFTWARE\Policies\Microsoft\Windows\Installer" `
    -Name "AlwaysInstallElevated" -ErrorAction SilentlyContinue

$hklmEnabled = $hklmValue.AlwaysInstallElevated -eq 1
$hkcuEnabled = $hkcuValue.AlwaysInstallElevated -eq 1

if ($hklmEnabled -and $hkcuEnabled) {
    Write-Host "[CRITICAL] AlwaysInstallElevated is enabled in BOTH HKLM and HKCU!" -ForegroundColor Red
    Write-Host "           Any user can install MSI packages with SYSTEM privileges." -ForegroundColor Red
} elseif ($hklmEnabled -or $hkcuEnabled) {
    Write-Host "[WARNING] AlwaysInstallElevated is partially enabled." -ForegroundColor Yellow
    Write-Host "          HKLM: $hklmEnabled | HKCU: $hkcuEnabled" -ForegroundColor Yellow
} else {
    Write-Host "[OK] AlwaysInstallElevated is not enabled." -ForegroundColor Green
}

# Enable global MSI logging via registry
# Value contains the logging flags to use
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer" `
    -Name "Logging" -Value "voicewarmupx" -PropertyType String -Force

# Logs will be created in %TEMP% as MSI*.LOG
Write-Host "MSI global logging enabled. Logs will appear in: $env:TEMP"

# Detect orphaned MSI products (registered but install location missing)
$uninstallPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
Get-ChildItem $uninstallPath | ForEach-Object {
    $props = Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue
    if ($props.WindowsInstaller -eq 1 -and $props.InstallLocation) {
        $location = $props.InstallLocation.TrimEnd('\')
        if ($location -and -not (Test-Path $location)) {
            [PSCustomObject]@{
                ProductCode     = $_.PSChildName
                DisplayName     = $props.DisplayName
                InstallLocation = $location
                Status          = "ORPHANED"
            }
        }
    }
} | Format-Table -AutoSize

# Detect orphaned components (pointing to non-existent products)
$productsPath = "HKLM:\SOFTWARE\Classes\Installer\Products"
$existingProducts = @{}
if (Test-Path $productsPath) {
    Get-ChildItem $productsPath | ForEach-Object { $existingProducts[$_.PSChildName] = $true }
}

$orphanedComponents = 0
$componentsPath = "HKLM:\SOFTWARE\Classes\Installer\Components"
if (Test-Path $componentsPath) {
    Get-ChildItem $componentsPath | ForEach-Object {
        $componentGuid = $_.PSChildName
        $refs = Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue
        $refs.PSObject.Properties | Where-Object { $_.Name -notlike "PS*" } | ForEach-Object {
            if (-not $existingProducts.ContainsKey($_.Name)) {
                $orphanedComponents++
            }
        }
    }
}

Write-Host "Orphaned component references found: $orphanedComponents"

# Manual MSI product cleanup procedure
# WARNING: Only use this after all other methods have failed

param(
    [Parameter(Mandatory)]
    [string]$ProductCode  # Format: {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}
)

# Step 1: Compute the compressed GUID
$clean = $ProductCode -replace '[{}\-]', ''
$groups = @(8, 4, 4, 2, 2, 2, 2, 2, 2, 2, 2)
$compressed = ""
$pos = 0
foreach ($len in $groups) {
    $chars = $clean.Substring($pos, $len).ToCharArray()
    [Array]::Reverse($chars)
    $compressed += -join $chars
    $pos += $len
}

Write-Host "ProductCode:    $ProductCode"
Write-Host "Compressed GUID: $compressed"

# Step 2: List all registry locations to clean (DO NOT delete without confirmation)
$locations = @(
    "HKLM:\SOFTWARE\Classes\Installer\Products\$compressed",
    "HKLM:\SOFTWARE\Classes\Installer\Features\$compressed",
    "HKLM:\SOFTWARE\Classes\Installer\UpgradeCodes",
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\$compressed",
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$ProductCode",
    "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\$ProductCode"
)

foreach ($loc in $locations) {
    if (Test-Path $loc) {
        Write-Host "[EXISTS]  $loc" -ForegroundColor Yellow
    } else {
        Write-Host "[ABSENT] $loc" -ForegroundColor Gray
    }
}

Write-Host "`nReview the [EXISTS] entries above. Remove them only if you are certain."

# Fast software inventory without triggering MSI repair checks
function Get-InstalledSoftware {
    $paths = @(
        "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
        "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*",
        "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*"
    )

    foreach ($path in $paths) {
        Get-ItemProperty $path -ErrorAction SilentlyContinue |
            Where-Object { $_.DisplayName -and $_.SystemComponent -ne 1 } |
            Select-Object DisplayName, DisplayVersion, Publisher, InstallDate,
                @{N='Size_MB'; E={ if($_.EstimatedSize) { [math]::Round($_.EstimatedSize/1024,1) } }},
                @{N='IsMSI'; E={ $_.WindowsInstaller -eq 1 }},
                @{N='ProductCode'; E={ $_.PSChildName }}
    }
}

# Usage: fast query, no side effects
Get-InstalledSoftware | Sort-Object DisplayName | Format-Table -AutoSize

# Check if MSIX Packaging Tool is available
$msixTool = Get-AppxPackage -Name "Microsoft.MSIXPackagingTool" -ErrorAction SilentlyContinue
if ($msixTool) {
    Write-Host "MSIX Packaging Tool v$($msixTool.Version) is installed."
} else {
    Write-Host "MSIX Packaging Tool is not installed."
    Write-Host "Install it from the Microsoft Store or via:"
    Write-Host "  winget install Microsoft.MSIXPackagingTool"
}

# Examine the virtual registry of an MSIX package
$package = Get-AppxPackage -Name "Microsoft.WindowsTerminal" -ErrorAction SilentlyContinue
if ($package) {
    $registryDat = Join-Path $package.InstallLocation "registry.dat"
    if (Test-Path $registryDat) {
        Write-Host "Virtual registry found: $registryDat"
        Write-Host "Size: $([math]::Round((Get-Item $registryDat).Length / 1024, 1)) KB"
    } else {
        Write-Host "No registry.dat found (app may not use virtual registry)"
    }
}