I ran into a very strange problem last night. Somehow a portion of the Windows Installer service got corrupted on my Vista laptop in a way I couldn't find any information on while searching the Google.

Whenever I tried to run any MSI file, I would get an error about how the installer service could not be contacted. In the event log, I saw a warning, event ID 1015, which said Failed to connect to server. Error: 0x80070005 at the exact same time.

Although I couldn't find much information on my specific error, the Google did bestow me with the knowledge that "80070005" usually indicates "Access Denied."

So I fired up SysInternal's ProcMon, the de facto standard tool for debugging permissions problems.

The trace revealed the following entry (click to zoom)...

As you can see, access is indeed denied for "Network Service" on the installer service's entry in HKCR\AppID.

But why? I honestly have no idea why it changed. I suspect some misbaving application I installed, but I don't know for certain.

I fired up RegEdit on my corrupted machine and on an innocent uncorrupted machine and navigated to the key...

Upon investigating the uncorrupted Vista box, I noticed that this particular registry entry should not be inheriting from its parent as it was on my corrupted machine. Ah ha! So I took ownership of the key on my corrupted machine, cleared the ACL and added the following entries...

All entries (including Administrators and System) should be given "read" except TrustedInstaller, which is set to Full Control. If you are having trouble adding the TrustedInstaller user account, remember that it is a new built-in principle, not a normal user. First, you must set the "location" to your local machine (if you are on a domain, that is), then type in NT SERVICE\TrustedInstaller. After you are finished with the changes, be sure to change the owner of the key BACK to TrustedInstaller (this is important).

That did it! MSIs were installing again!

Mystery solved.