Video Screencast Help

How to Setup a Package Containing HKCU (Current User) Registry to Install for Each Profile User on a Windows XP or Later PC

Created: 18 Mar 2009 • Updated: 03 Nov 2011 | 16 comments
Language Translations
Pascal KOTTE's picture
+17 17 Votes
Login to vote

My sample: Settings for a Proxy server to IE, using MSI Editor from Wise Express (current DS 6.9).

This article is mainly for beginners in customization & repackaging, or for those do not want to be "packager" but need to do a little. This is taking a sample for IE setup a proxy, but you can apply for any configuration where you must change the "current user" registry.

E.g. to configure the Proxy settings for Internet Explorer, and use the server Easy to find:, this seems very simple: just change the registry (HKCU = HKEY_CURRENT_USER). It is:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

Well, but now the problem is: the HKCU is volatile & must repeat for each user logged in… Did you already live this nightmare? (leave me a feedback)

Did you think you must create & setup a GPO to configure the proxy settings for IE?  That’s not necessary, we can use “Active Setup”, that I will not explain: you can go those articles to see:

Not so easy to find in MSDN or TechNet, stop loosing your time searching…

To be honest, it is not more simple than creating a GPO... But if you want to keep a track what's happen on PCs, with a clear reporting all the well/bad installations, that is not easy with GPO. Also GPO's "Adm" file already exist for IE, but not for all, & perhaps must create one. Regarding IE, the best practice should be to use a PAC file (auto detect). Most often, for changing HKCU hive registry your are using login script ! But how to include those update in your standard MSI deployment process? It is the subject of this article:

How we can build user custom profile data without GPO, using "Active Setup" registry:

Requirement: Having Symantec Altiris

  • Client Management Suite
  • or Deployment Solution
  • or Wise Package Studio.

 1st Create a package with this HKCU registry data:

  • Open Wise MSI editor
    (From DS console in the toolbar icon, or go the DS exPress share <DS>\eXpress\Wise Packager\WFWI.EXE)
  • Create a new Package, save it as WSI file on your prefered working well backuped folder.
  • Configure the package
    • Name, Manufacturer (yourself), Your package version,
    • don't miss the directory, all the same nothing to copy
      (use [change] button)
  • General information: yes you should makes some comment !
  • Add/Remove:
    • Do not display, is the best choice most of the time.
  • Registry: here we are!
    • Create a text file with the previous HKCU registry (save as ".reg" file)
    • on HKEY_CURRENT_USER, "Import from .REG file..."
  • Important: under "Administrator Options"
    • select "Per-Machine" + check "Reinstall all Per-user based registry keys"

2nd: Save, test & copy the package GUID to create Active setup registry part into the same package.

  • save, compile & test (click "Run" on the lower right, a well hidden button)
    • verify your current registry is well modify & IE setting operationnal
      (only for the current user, must be local admin)
    • Notice: you can uninstall running cmd below:
msiexec /x {<replace with GUID below>}
  • click on "Project Summary" and select the Product Code GUID: "Copy" in the clipboard.
  • open NOTEPAD, paste your product code
  • copy/paste entries below (yes, with comma in the version...)
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{DA81F89B-B341-43ED-8ACB-A086A1196AB1}]
@="Configure the Proxy Server for IE"
StubPath=C:\windows\system32\msiexec.exe /fu {DA81F89B-B341-43ED-8ACB-A086A1196AB1} /q

replace the bold GUID and data with your own

  • save as a ".REG" file (it is the "active setup" part of the registry)
  • Go back to the Registry part your Wise package
  • Import this .REG under HKLM
    • Notice: Wise substitute nicely "C:\windows\system32\" with the [SystemFolder] variable
  • Compile => take the MSI & put in your distribution folder
  • Deploy the package (manually, DS, NS, script, others... no care: except must be run under local admin rights, of course :)
msiexec /i "MyPackageToSetupProxyForIE.msi" /quiet 

3rd: On clients:

  • Restart? Should not be necessary, but logoff/logon must be done!
    • You can also run a repair to force without logoff (see at the end this article)
  • When login each user the 1st time on the computer: there is a quick display
    ("configure user settings": with your own @ text display)

4th: Additionnal Tricks

  • You can report or create "Dynamic computers collection" based the Add/Remove program inventory
    (from Hardware Inventory in NS)
  • Same for DS "Get Inventory" (connect the "eXpress" base using ODBC):
  • You can activate manual "repair" or "uninstall", by providing following deployment task commands (best use package GUID, not MSI):
    • Uninstall: /passive (use for a manual run) or /quiet (for silent, use system account)
 msiexec /x {<replace with GUID>} /passive
    • Repair: This command permit to force apply settings the current user without needing to reboot (program option: "logged in user", and use a Sequential delivery task :)
 msiexec /fup {<replace with GUID>} /passive
  • Do not:
    • Do not use %systemdrive% or such in the Active setup registry,
    • Do not large deploy without testing it on 30 clients 1 week!
    • ...
  • I must also say I still got a problem, the removal is not working very well:
    • The "Active setup" registry is not removed for all and other users keep HKCU registry settings as it was :-(
    • Any update & feedback are welcomes ;-)

Below I attach a PDF version for those having problem with my google screen shots

Enjoy & goog luck ;-)
Mars 2009 - Pascal KOTTÉ

Comments 16 CommentsJump to latest comment

Pascal KOTTE's picture

If your Computers are using SVS, and your next CMS level 1 licence maintenance update will include SVS (rename SWV), because of the change in 2009. It will be possible to create a "CURRENT_:USER" registry data layer. You can agregate all "Current user" customizations in a single data layer. More easy to build & maintain & test...

~Pascal @ Do you speak French? Et utilisez Altiris: venez nous rejoindre sur le GUASF

Login to vote
Eshwar's picture

Good article. But I can hardly see some of the embaded pictures. 

I'm waiting for the article on how to do this using SVS....

Good job 



Login to vote
Eshwar's picture

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"="<local>"                                                                                  ------------------------------------------------------------------------ 

If i had to add the above entries to the machine, i make use of active setup registry entries and a simple vbscript: 

1. Compile the above registry entries to a Registry File [Proxy.reg]

2. Write a vbscript to copy the Registry File [Proxy.reg] to a standard location onto the machine.

Note: We always copy "Active Setup" related files to a standard location on the machine before executing them [c:\Program Files\<ORGANIZATION>\ActiveSetup\].

3. Write an Active Setup registry entry to the registry using vbscript like 

'--------------------------------------------------------------------------------------------Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_
strComputer & "\root\default:StdRegProv")

strKeyPath = "SOFTWARE\Microsoft\Active Setup\Installed Components\IE_Proxy"

oReg.CreateKey HKEY_LOCAL_MACHINE,strKeyPath

strValueName = "StubPath"
strValue = "regedit /s c:\Progra~1\<ORGANIZATION>\ActiveSetup\Proxy.reg"
oReg.SetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue
strValueName1 = "Version"
dwValue1 = 1
oReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName1,dwValue1

4. Now your vbscript is ready. Create an Altiris software delivery task to execute the vbscript.

Note: Make sure REG file in the source directory

Once altiris executes the vbscipt, the script will copy the REG file to the specified location and add ACTIVE SETUP registry entries. When ever the user/users logs in after reboot, Active Setup registry entry will be executed and HKCU registry entries will be added.

Good luck.





Login to vote
Brandon's picture

Anytime your are considering self-healing or activesetup then you must want to make a machine change. So the first thing that should come to mind is "Can this be done with HKLM keys?" The answer for the settings above is yes. There is no need to make a package or use activesetup when a coulple "REG ADD" commands can be used to accomplish this with HKLM. HKLM can't always be used, but the majority of the time it can as in this IE proxy example.

Regardless, nice article on the use of Activesetup.

Login to vote
Eshwar's picture

What you said is true.

Before optiong for Active Setup, we have to look if there are HKLM entries to do the trick.

I just borrowed the registry entries from Pascal's article.

The process that i described above is used when ever we have requirements like suppressing EULA OR registration OR runonce etc.... [sometimes by adding HKCU entires you can suppress the these screens]. 

Ex: I followed the above process for MapPoint 2009 as i have to add the following registry entries:






Login to vote
rbrucelee1978's picture

If the application contains Advertised Entry Points (ie. Shortcuts or File Extensions), then why don't you just move any component containing HKCU entries (ie. CurrentUser component) into the top level parent feature? Since self healing checks move up to each parent feature up until it reaches the top level parent feature, if the HKCU entries are missing for whichever user tries to use the application, then a self heal is initiated.

But then again, if there are no entry points then by all means, use Active Setup.

Login to vote
Pascal KOTTE's picture

Hello, you can access also this web doc link:

~Pascal @ Do you speak French? Et utilisez Altiris: venez nous rejoindre sur le GUASF

Login to vote
EdT's picture

The biggest limitation of using Active Setup for IE registry keys is that Active Setup only runs when the active setup keys in HKCU do not exist, and HKLM does, OR, if the version information in HKCU is less than the version information in HKLM.
In most cases that means that Active Setup will run once for each user, unless the user's profile is flushed or the version number in HKLM is incremented.
This can allow the IT literate user to make later changes to the IE setup and not have them overwritten, as they would be if the settings are implemented by group policy or any other mechanism that refreshes the settings regularly.

If your issue has been solved, please use the "Mark as Solution" link on the most relevant thread.

Login to vote
sypkensj's picture

This problem can be addressed much more simply, assuming the user profiles haven't been created on the machine yet. If any new user logs into the machine, the HKCU hive will be created from HKEY_USERS\.Default. If you simply put the registry keys in this location, those keys will be available automatically.

The only con is that it wouldn't work for existing profiles on the machine, but I believe you have the same problem with active setup.

Login to vote
Pascal KOTTE's picture

Hi sypkensj, this is not the case, if you are using active setup, all the existing user profiles will update on next logon. As you said EDT it is only running "once". But, it is the target & the use for "active setup", for running each time a user logon, it is other registry (I think HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run...)

~Pascal @ Do you speak French? Et utilisez Altiris: venez nous rejoindre sur le GUASF

Login to vote
Pascal KOTTE's picture

thanks to point this Eshwar ;-)

~Pascal @ Do you speak French? Et utilisez Altiris: venez nous rejoindre sur le GUASF

Login to vote
nanya's picture

nice post..i proceed the same for packaging an application. after installion proces ,my application has not opening.. wats the cause for this? does the problem is due to registry setting?

Login to vote
SUZY1401's picture

We have a requirement to uncheck two checkboxes of Certification Revocation Check from IE and i did follow the same steps that Eswar mentioned ( As we do not have Wise currently) and created the scripts accordingly.I noticed that the Active setup stub path gets created correctly under the required path of HKLM but it just creates the folder under Installed Components under HKCU but the stubpath does not show up and niether the registry .reg file runs for any logged on user.

Please enlighten me as I am kind of started with packaging and trying the Active setup method for the first time.

Thanks in Advance....

Login to vote
Brandon's picture


This sounds like it would be better solved with the IEAK (new installs) and Group Policy Preferences (existing installs/enforcement). I wouldn't use activesetup for this at this point.

Login to vote