.msi common application data local machine registry

Question

I note that there are many subfolders in the common appdata folder and many entries under hkey_local_machine for software on my windows 7 system. I'd like to know how there entries were created presumably when the software was installed and what enables the programs to get at them.

Are there facilities in the .msi files to make these folders and registry entries and establish proper rights to them?

Answer 1

Regarding Registry entries, the "Registry" table in the MSI file creates the Registry entries.

Regarding the common AppData folder, this property: "CommonAppDataFolder" is what MSI files use to refer to it.

Regarding permissions, the "Lock Permissions" table is responsible for setting permissions.

Theoretically, the owner/creator of the files/Registry settings is obvious, and you can look inside the corresponding MSI file with Orca to see how it was created. Otherwise, you might have to enable auditing, or use a tool like RegMon/FileMon from Sysinternals to see who is creating the entries.