Back in the good old days of Windows 95, when your installer needed to replace a file that was "locked" in use by Windows, it would write an entry to the file WININIT.INI with the replacement instructions. So if you installed a program and the program said "Would you like to reboot your computer now?" you could open WININIT.INI and see what it was going to change on the next reboot.

Windows NT and later has an updated mechanism for doing the same thing which doesn't use WININIT.INI. When I write an installer in InstallShield, this aspect of it is handled automatically by the InstallShield engine, but I never knew what it was doing under the hood. Does anyone know how this is being done? Is it writing a registry entry? If so, what's the key?

Not sure, but it probably uses the RunOnce key. See here.


Edit:

Actually, this is more relevant.

"Windows 95 puts all of its rename operations into the file Wininit.ini. Windows NT puts the rename operations into a Registry value named “PendingFileRenameOperations”. "

Sorry, forgot to clarify...

I'm not talking about programs that get run after Windows starts. I know all the places where a program can get run. I'm talking about the built-in windows mechanism for replacing files before Windows starts, before it hits the Run keys, before the Load= and Run= sections of Win.ini, before the StartUp group. Before even the Windows GUI loads.

In Windows 95/98, this is the place where you sometimes see the text "Finished updating files, continuing to load Windows" appear. Of course, in that case, it's using WININIT.INI, because that message never appears in NT-based operating systems.

They replaced the functionality of WININIT.INI when they did NT 4.0 and later, there's something it's doing that's pretty much the same thing, and it doesn't have to run a third-party program to get the job done, it's built in to Windows. I just don't know where it is exactly.

Yeah. I read it a little too fast the first time and didn't catch everything you were saying. I quickly edited though.

Windows NT puts the rename operations into a Registry value named “PendingFileRenameOperations”.

AH! That's what I was looking for. THANKS!!!

(any idea which subkey it's located in?) <-Never mind, they have example code at that link.

For posterity, it's HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager with a key name of PendingFileRenameOperations .

If you're planning on adding files to that list, you should use MoveFileEx, rather than hacking on it directly. If it's just for diagnosis, then fair enough.

If you're planning on adding files to that list, you should use MoveFileEx, rather than hacking on it directly. If it's just for diagnosis, then fair enough.

Agreed completely. I only wanted to know for diagnosis purposes.

See, sometimes I install a program which asks me to reboot, and the truth is that it really didn't need me to reboot. The authors of the installer just added the Reboot box at the end of their installer to make sure that their users were running their program the first time on a freshly rebooted system... to reduce support calls. Either that, or they just didn't understand how the reboot feature works in the installer, and they checked the "reboot" box in their creation wizard. In those cases, I can check and see it really didn't anything, so that way I don't have to disconnect from all the network-related stuff I'm doing and reboot, I can just run the program.

And if there's something that really does need to get replaced, I usually like to know what it was. I have other tools that let me see every single change a given installer made to the system, but they are overkill when all I want to do is satisfy my occasional curiosity.