Windows Installer 5.0 is shipping in Windows 7 as part of the operating system. To address the issue where the User Account Control consent dialog is displayed with an “Unidentified Publisher”, the .msi package is cached in its entirety.

Prior to Windows Installer 5.0, installation packages, or .msi files, were stripped of their embedded cabinets – if any – when cached on the system to save space. When repairing the product, if installed files were missing then Windows Installer would attempt to use the last used source location, an application-defined location, or prompt for the installation source. While these prompts can be annoying or even difficult to resolve sometimes, they do reduce the disk space required after an installation is complete.

When Vista added UAC, elevation even for administrators by default was required. Elevation was always required for per-machine installations, but administrator accounts already ran with full privileged tokens so elevation was implicit. To add validation to this elevation prompt – aka the consent dialog – the publisher for signed packages was displayed, and “Unidentified Publisher” was displayed for unsigned packages. But during uninstall, packages would display “Unidentified Publisher” even if they were signed because their embedded cabinets were stripped thus invalidating the digital signature and so Windows Installer wouldn’t verify the cached package as shown below using Windows Installer 4.5 on Vista.

MSI (s) (DC:0C) [16:46:44:058]: MSI_LUA: Elevation required to install product, will prompt for credentials
MSI (s) (DC:0C) [16:46:44:059]: MSI_LUA: Entering Credential Request. hwnd = 1120166, MsiAction = 2, productname = Microsoft Visual Studio Team System 2008 Team Suite - ENU, version = 9.0.30729, language = 1033, manufacturer = Microsoft Corporation
MSI (s) (DC:0C) [16:46:44:059]: MSI_LUA:  (continued)... packagepath = , packagesource = , dwUpdates = 0

To resolve this issue, Windows Installer 5.0 in Windows 7 will cache the installation packages without stripping their embedded cabinets and verify the cached package as shown below using Windows Installer 5.0 on Windows 7.

MSI (s) (20:98) [16:51:25:386]: MSI_LUA: Elevation required to install product, will prompt for credentials
MSI (s) (20:98) [16:51:25:386]: MSI_LUA: Entering Credential Request. hwnd = 1116208, MsiAction = 2, productname = Microsoft Visual Studio Team System 2008 Team Suite - ENU, version = 9.0.30729, language = 1033, manufacturer = Microsoft Corporation
MSI (s) (20:98) [16:51:25:386]: MSI_LUA:  (continued)... packagepath = C:WindowsInstaller33e5a8b.msi, packagesource = C:WindowsInstaller33e5a8b.msi, dwUpdates = 0

But this won’t prevent prompts for source even if all files are compressed into embedded cabinets. Windows Installer 5.0 does not consider the Installer-cached .msi files to be valid source and will still resolve possible source locations or prompt as it has in the past.

Installation developers should take this into account since Windows Installer already may require so much disk space and compress files if necessary in external cabinets. Consider your servicing scenarios carefully and determine if you should cache the installation source yourself using the Source List APIs like MsiSourceListAddSource provided by Windows Installer, or just let Windows Installer use its default source resiliency behavior.