What are the Pros and Cons of using VBScript in MSI packaging?

Written by Alex Marin · December 8th, 2022 · 6min read

22 years after its introduction, MSI is still the most widely used method of managing program installation. Microsoft released Windows Installer with Office 2000 to enable the application's administration to follow a set of common guidelines (installing, repairing, uninstalling).

NoteDid you know that we launched the MSI Packaging Essentials Training and Certification program to help you learn the essentials of MSI technology? It’s free and 100% online.
Take me to the MSI Packaging Essentials Training and Certification program.

MSI gives you a lot of control over your installation by allowing you to define the installation execution sequence and add your own custom actions to the preferred execution stage.

MSI offers native support for JScript and VBScript custom actions, which are automatically added to the Binary table. Also, MSI knows how to connect to the Windows Script Host (WScript) service to run the custom actions at a specific stage.

If you are familiar with Advanced Installer, you will know that it has enhanced its support for scripting languages over time.

Today, you are able to use multiple scripting languages, such as PowerShell custom actions, C# built DLLs, among others.

NoteIf you are new to Advanced Installer, you can give it a try through its 30-day full featured trial.

You can use VBScript to execute more than just Custom Actions, such as developing complete installation and uninstallation wrapper scripts to perform on your system.

In this article, we'll go through the Pros and Cons of using VBScript when it comes to MSI packaging – both from the point of view of a developer and an IT professional.

What are the Pros of using VBScript?

There are many aspects to VBScript that some may consider a benefit but in a subjective manner. So, let's keep that in mind as we dive into them.

1. VBScript’s Maturity and Stability

Veteran IT Pros have adopted the VBScript technology because that was the best option available at that time. (PowerShell was in the early stages of its life and could have been used, but MSI didn’t know how to execute PowerShell scripts unless workarounds were applied.)

The software packaging industry is a niche branch of which not many IT Pros are aware or even invested in learning its depths.

When it came to training, most companies hired newbies and had very fast crash courses on software packaging, which were held by senior IT Pros.

However, experienced IT Pros worked in a certain manner, which resulted in these practices being passed down to the next generations of IT Pros.

Even though tools like Advanced Installer have made it simple and quick to add PowerShell scripts as custom actions, the IT Pros audience has been slow to embrace the technology, meaning it will still take some time to be completely adopted.

As a result of its simplicity and ease of use, VBScript's longevity is a plus. Furthermore, there are plenty of topics on forums, guides, and helpful materials on how to execute various tasks using VBScript, resulting in a great volume of useful scripts for the IT Pro industry.

2. VBScript as a Native Technology

Another pro would be that VBScript is a native technology; thus, it’s easy to read from the package regardless of the packaging tool you are using.

NotePowerShell scripts can indeed be added to the package, but these are not native, and it depends on the packaging tool that you are using.
A more in-depth article regarding this topic can be found here.

3. VBScript accessibility: easy to integrate with the MSI internal structure

One more pro is that the internal structure of MSI is easy to integrateand change with VBScript.

For example, if you want to create a dynamic custom action by passing properties, all you have to add within your script is the following:

Session.Property("CustomActionData")

And if you want to pass two properties into the script, add the following code:

strArgs = Session.Property("CustomActionData")
arrArgs = Split(strArgs, ";", -1, 1)
path1 = arrArgs(0)
path2 = arrArgs(1)

To set a property in an MSI with VBScript, insert this code:

Set WShell = CreateObject("WScript.Shell")
DISKID = WShell.RegRead("HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum\0")
Session.Property("DISKID") = DISKID

With the above code, you are setting the DISKID property with the value received from the registry.

However, you can achieve the same behavior with PowerShell scripts, but you may realize that each packaging tool has a distinct take on the topic, which means that each custom action is defined differently.

Let’s take a look at how Advanced Installer manages the custom actions via PowerShell scripts.

To get and set your property using Advanced Installer, use the following commands:

$propValue = AI_GetMsiProperty YOUR_PROP
AI_SetMsiProperty YOUR_PROP <VALUE>

These actions have the AI_ prefix, meaning that these are Advanced Installer custom actions.

But when you are using VBScript, you will see the same structure no matter what packaging tool you are using, making it more accessible for you to use.

4. Logging

The last pro we are going to discuss is the logging ability that VBScript offers.

When you place a custom action, and perform verbose logging, if the script runs into any errors you will receive the exact line where the script has failed.

For example, we intentionally added an incorrect line to our VBScript, and the verbose logging showed us exactly where everything went wrong:

Verbose Logging

What are the Cons of using VBScript?

1. Security threat in VBScript

The major con that we can see at the moment when it comes to VBScript is security. We are constantly asked on our support channel why a particular installer worked on one machine but failed on another.

We discovered that different antivirus programs are blocking VBScript files for various reasons. Since VBScript is an old scripting language, it is not validated in the same way that PowerShell is, which can lead to different security breaches.

2. Easily readable code

Depending on the circumstances, having the code easy to read might be both a pro and a con.

For example, if you want to add a registration method directly to your package, it makes no sense to have the code readable by the user since it could mean that your registration algorithm will be easily bypassed.

3. Not Developer Friendly

While useful for IT Pros, from a developer perspective VBScript just doesn’t make sense. MSI can run native C++ DLLs as well as .NET C# custom actions. These can be easily developed and added to the installer. Not to mention that .NET provides a broader set of functions for manipulating the system to the developer's liking.

Conclusion

As we can see, each technology has its advantages and disadvantages. And VBScript is here to stay since it can be used for a wide range of tasks other than just executing custom actions.

However, there are a few aspects that might make you take a step back if you are looking at the security side as well as the developer friendliness.

What are some other topics you would like us to cover? Leave your comments below!

Subscribe to Our Newsletter

Sign up for free and be the first to receive the latest news, videos, exclusive How-Tos, and guides from Advanced Installer.

Comments: