Group Add/Remove working.

Local group membership Add/Remove working, however with
BUILTIN local system groups .NET doesn't appear to locate them as either
groups nor basic security Principals.  Still needs work to fix the test
for nested groups.  Ideally with some way to test for domain groups.


Signed-off-by: Bevan Weiss <bevan.weiss@gmail.com>

21 files changed, 736 insertions, 278 deletions

diff --git a/src/ext/Util/ca/scacost.h b/src/ext/Util/ca/scacost.h
index 978e40bc..d1086005 100644
--- a/src/ext/Util/ca/scacost.h
+++ b/src/ext/Util/ca/scacost.h
@@ -11,6 +11,8 @@ const UINT COST_USER_ADD = 10000;
 const UINT COST_USER_DELETE = 10000;
 const UINT COST_GROUP_ADD = 10000;
 const UINT COST_GROUP_DELETE = 10000;
+const UINT COST_GROUPMEMBERSHIP_ADD = 10000;
+const UINT COST_GROUPMEMBERSHIP_DELETE = 10000;
 
 const UINT COST_PERFMONMANIFEST_REGISTER = 1000;
 const UINT COST_PERFMONMANIFEST_UNREGISTER = 1000;
diff --git a/src/ext/Util/ca/scaexec.cpp b/src/ext/Util/ca/scaexec.cpp
index 5a750c6b..64f4c823 100644
--- a/src/ext/Util/ca/scaexec.cpp
+++ b/src/ext/Util/ca/scaexec.cpp
@@ -291,146 +291,6 @@ LExit:
     return hr;
 }
 
-static HRESULT AddGroupToGroup(
-    __in LPWSTR wzMember,
-    __in LPCWSTR wzMemberDomain,
-    __in LPCWSTR wzGroup,
-    __in LPCWSTR wzGroupDomain
-)
-{
-    Assert(wzMember && *wzMember && wzMemberDomain && wzGroup && *wzGroup && wzGroupDomain);
-
-    HRESULT hr = S_OK;
-    IADsGroup* pGroup = NULL;
-    BSTR bstrMember = NULL;
-    BSTR bstrGroup = NULL;
-    LPWSTR pwzMember = NULL;
-    LPWSTR pwzServerName = NULL;
-    LOCALGROUP_MEMBERS_INFO_3 lgmi {};
-
-    GetDomainServerName(wzGroupDomain, &pwzServerName);
-
-    // Try adding it to the local group
-    if (wzMemberDomain)
-    {
-        hr = StrAllocFormatted(&pwzMember, L"%s\\%s", wzMemberDomain, wzMember);
-        ExitOnFailure(hr, "failed to allocate group domain string");
-    }
-
-    lgmi.lgrmi3_domainandname = (NULL == pwzMember ? wzMember : pwzMember);
-    NET_API_STATUS ui = ::NetLocalGroupAddMembers(pwzServerName, wzGroup, 3, reinterpret_cast<LPBYTE>(&lgmi), 1);
-    hr = HRESULT_FROM_WIN32(ui);
-    if (HRESULT_FROM_WIN32(ERROR_MEMBER_IN_ALIAS) == hr) // if they're already a member of the group don't report an error
-    {
-        hr = S_OK;
-    }
-
-    //
-    // If we failed, try active directory
-    //
-    if (FAILED(hr))
-    {
-        WcaLog(LOGMSG_VERBOSE, "Failed to add group: %ls, domain %ls to group: %ls, domain: %ls with error 0x%x.  Attempting to use Active Directory", wzMember, wzMemberDomain, wzGroup, wzGroupDomain, hr);
-
-        hr = UserCreateADsPath(wzMemberDomain, wzMember, &bstrMember);
-        ExitOnFailure(hr, "failed to create group ADsPath for group: %ls domain: %ls", wzMember, wzMemberDomain);
-
-        hr = UserCreateADsPath(wzGroupDomain, wzGroup, &bstrGroup);
-        ExitOnFailure(hr, "failed to create group ADsPath for group: %ls domain: %ls", wzGroup, wzGroupDomain);
-
-        hr = ::ADsGetObject(bstrGroup, IID_IADsGroup, reinterpret_cast<void**>(&pGroup));
-        ExitOnFailure(hr, "Failed to get group '%ls'.", reinterpret_cast<WCHAR*>(bstrGroup));
-
-        hr = pGroup->Add(bstrMember);
-        if ((HRESULT_FROM_WIN32(ERROR_OBJECT_ALREADY_EXISTS) == hr) || (HRESULT_FROM_WIN32(ERROR_MEMBER_IN_ALIAS) == hr))
-            hr = S_OK;
-
-        ExitOnFailure(hr, "Failed to add group %ls to group '%ls'.", reinterpret_cast<WCHAR*>(bstrMember), reinterpret_cast<WCHAR*>(bstrGroup));
-    }
-
-LExit:
-    ReleaseStr(pwzServerName);
-    ReleaseStr(pwzMember);
-    ReleaseBSTR(bstrMember);
-    ReleaseBSTR(bstrGroup);
-    ReleaseObject(pGroup);
-
-    return hr;
-}
-
-static HRESULT RemoveGroupFromGroup(
-    __in LPWSTR wzMember,
-    __in LPCWSTR wzMemberDomain,
-    __in LPCWSTR wzGroup,
-    __in LPCWSTR wzGroupDomain
-)
-{
-    Assert(wzMember && *wzMember && wzMemberDomain && wzGroup && *wzGroup && wzGroupDomain);
-
-    HRESULT hr = S_OK;
-    IADsGroup* pGroup = NULL;
-    BSTR bstrMember = NULL;
-    BSTR bstrGroup = NULL;
-    LPWSTR pwzMember = NULL;
-    LPWSTR pwzServerName = NULL;
-    LOCALGROUP_MEMBERS_INFO_3 lgmi {};
-
-    GetDomainServerName(wzGroupDomain, &pwzServerName, DS_WRITABLE_REQUIRED);
-
-    // Try removing it from the local group
-    if (wzMemberDomain)
-    {
-        hr = StrAllocFormatted(&pwzMember, L"%s\\%s", wzMemberDomain, wzMember);
-        ExitOnFailure(hr, "failed to allocate group domain string");
-    }
-
-    lgmi.lgrmi3_domainandname = (NULL == pwzMember ? wzMember : pwzMember);
-    NET_API_STATUS ui = ::NetLocalGroupDelMembers(pwzServerName, wzGroup, 3, reinterpret_cast<LPBYTE>(&lgmi), 1);
-    hr = HRESULT_FROM_WIN32(ui);
-    if (HRESULT_FROM_WIN32(ERROR_MEMBER_NOT_IN_ALIAS) == hr
-        || HRESULT_FROM_WIN32(NERR_GroupNotFound) == hr
-        || HRESULT_FROM_WIN32(ERROR_NO_SUCH_MEMBER) == hr) // if they're already not a member of the group, or the group doesn't exist, don't report an error
-    {
-        hr = S_OK;
-    }
-
-    //
-    // If we failed, try active directory
-    //
-    if (FAILED(hr))
-    {
-        WcaLog(LOGMSG_VERBOSE, "Failed to remove group: %ls, domain %ls from group: %ls, domain: %ls with error 0x%x.  Attempting to use Active Directory", wzMember, wzMemberDomain, wzGroup, wzGroupDomain, hr);
-
-        hr = UserCreateADsPath(wzMemberDomain, wzMember, &bstrMember);
-        ExitOnFailure(hr, "failed to create group ADsPath in order to remove group: %ls domain: %ls from a group", wzMember, wzMemberDomain);
-
-        hr = UserCreateADsPath(wzGroupDomain, wzGroup, &bstrGroup);
-        ExitOnFailure(hr, "failed to create group ADsPath in order to remove group from group: %ls domain: %ls", wzGroup, wzGroupDomain);
-
-        hr = ::ADsGetObject(bstrGroup, IID_IADsGroup, reinterpret_cast<void**>(&pGroup));
-        if ((HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND) == hr)) // if parent group not found, no need to remove membership from group
-        {
-            hr = S_OK;
-            ExitFunction();
-        }
-        ExitOnFailure(hr, "Failed to get group '%ls'.", reinterpret_cast<WCHAR*>(bstrGroup));
-
-        hr = pGroup->Remove(bstrMember);
-        if ((HRESULT_FROM_WIN32(ERROR_MEMBER_NOT_IN_ALIAS) == hr)) // if already not a member, no need to worry about error
-            hr = S_OK;
-        ExitOnFailure(hr, "Failed to remove group %ls from group '%ls'.", reinterpret_cast<WCHAR*>(bstrMember), reinterpret_cast<WCHAR*>(bstrGroup));
-    }
-
-LExit:
-    ReleaseStr(pwzServerName);
-    ReleaseStr(pwzMember);
-    ReleaseBSTR(bstrMember);
-    ReleaseBSTR(bstrGroup);
-    ReleaseObject(pGroup);
-
-    return hr;
-}
-
 static HRESULT GetUserHasRight(
     __in LSA_HANDLE hPolicy,
     __in PSID pUserSid,
@@ -842,7 +702,6 @@ LExit:
 }
 
 static HRESULT RemoveGroupInternal(
-    LPWSTR wzGroupCaData,
     LPWSTR wzDomain,
     LPWSTR wzName,
     int iAttributes
@@ -850,9 +709,6 @@ static HRESULT RemoveGroupInternal(
 {
     HRESULT hr = S_OK;
 
-    LPWSTR pwz = NULL;
-    LPWSTR pwzGroup = NULL;
-    LPWSTR pwzGroupDomain = NULL;
     LPWSTR pwzServerName = NULL;
 
     //
@@ -871,41 +727,9 @@ static HRESULT RemoveGroupInternal(
         }
         ExitOnFailure(hr, "failed to delete group: %ls", wzName);
     }
-    else
-    {
-        //
-        // Remove the group from other groups
-        //
-        pwz = wzGroupCaData;
-        while (S_OK == (hr = WcaReadStringFromCaData(&pwz, &pwzGroup)))
-        {
-            hr = WcaReadStringFromCaData(&pwz, &pwzGroupDomain);
 
-            if (FAILED(hr))
-            {
-                WcaLogError(hr, "failed to get domain for group: %ls, continuing anyway.", pwzGroup);
-            }
-            else
-            {
-                hr = RemoveGroupFromGroup(wzName, wzDomain, pwzGroup, pwzGroupDomain);
-                if (FAILED(hr))
-                {
-                    WcaLogError(hr, "failed to remove group: %ls from group %ls, continuing anyway.", wzName, pwzGroup);
-                }
-            }
-        }
-
-        if (E_NOMOREITEMS == hr) // if there are no more items, all is well
-        {
-            hr = S_OK;
-        }
-
-        ExitOnFailure(hr, "failed to get next group from which to remove group:%ls", wzName);
-    }
 LExit:
     ReleaseStr(pwzServerName);
-    ReleaseStr(pwzGroup);
-    ReleaseStr(pwzGroupDomain);
 
     return hr;
 }
@@ -1392,6 +1216,7 @@ LExit:
     return WcaFinalize(er);
 }
 
+
 /********************************************************************
  CreateGroup - CUSTOM ACTION ENTRY POINT for creating groups
 
@@ -1412,8 +1237,6 @@ extern "C" UINT __stdcall CreateGroup(
     LPWSTR pwzDomain = NULL;
     LPWSTR pwzComment = NULL;
     LPWSTR pwzScriptKey = NULL;
-    LPWSTR pwzGroup = NULL;
-    LPWSTR pwzGroupDomain = NULL;
     int iAttributes = 0;
     BOOL fInitializedCom = FALSE;
 
@@ -1553,24 +1376,6 @@ extern "C" UINT __stdcall CreateGroup(
             }
         }
         MessageExitOnFailure(hr, msierrGRPFailedGroupCreate, "failed to create group: %ls", pwzName);
-
-        //
-        // Add the groups to groups
-        //
-        while (S_OK == (hr = WcaReadStringFromCaData(&pwz, &pwzGroup)))
-        {
-            hr = WcaReadStringFromCaData(&pwz, &pwzGroupDomain);
-            ExitOnFailure(hr, "failed to get domain for group: %ls", pwzGroup);
-
-            WcaLog(LOGMSG_STANDARD, "Adding group %ls\\%ls to group %ls\\%ls", pwzDomain, pwzName, pwzGroupDomain, pwzGroup);
-            hr = AddGroupToGroup(pwzName, pwzDomain, pwzGroup, pwzGroupDomain);
-            MessageExitOnFailure(hr, msierrUSRFailedUserGroupAdd, "failed to add group: %ls to group %ls", pwzName, pwzGroup);
-        }
-        if (E_NOMOREITEMS == hr) // if there are no more items, all is well
-        {
-            hr = S_OK;
-        }
-        ExitOnFailure(hr, "failed to get next group in which to include group: %ls", pwzName);
     }
 
 LExit:
@@ -1586,8 +1391,6 @@ LExit:
     ReleaseStr(pwzDomain);
     ReleaseStr(pwzComment);
     ReleaseStr(pwzScriptKey);
-    ReleaseStr(pwzGroup);
-    ReleaseStr(pwzGroupDomain);
 
     if (fInitializedCom)
     {
@@ -1704,7 +1507,7 @@ extern "C" UINT __stdcall CreateGroupRollback(
         }
     }
 
-    hr = RemoveGroupInternal(pwz, pwzDomain, pwzName, iAttributes);
+    hr = RemoveGroupInternal(pwzDomain, pwzName, iAttributes);
 
 LExit:
     WcaCaScriptClose(hRollbackScript, WCA_CASCRIPT_CLOSE_DELETE);
@@ -1781,7 +1584,7 @@ extern "C" UINT __stdcall RemoveGroup(
     hr = WcaReadIntegerFromCaData(&pwz, &iAttributes);
     ExitOnFailure(hr, "failed to read attributes from custom action data");
 
-    hr = RemoveGroupInternal(pwz, pwzDomain, pwzName, iAttributes);
+    hr = RemoveGroupInternal(pwzDomain, pwzName, iAttributes);
 
 LExit:
     ReleaseStr(pwzData);
@@ -1801,3 +1604,254 @@ LExit:
 
     return WcaFinalize(er);
 }
+
+HRESULT AlterGroupMembership(bool remove, bool isRollback = false)
+{
+    HRESULT hr = S_OK;
+    NET_API_STATUS er = ERROR_SUCCESS;
+
+    LPWSTR pwzData = NULL;
+    LPWSTR pwz = NULL;
+    LPWSTR pwzParentName = NULL;
+    LPWSTR pwzParentDomain = NULL;
+    LPWSTR pwzChildName = NULL;
+    LPWSTR pwzChildDomain = NULL;
+    int iAttributes = 0;
+    LPWSTR pwzChildFullName = NULL;
+    LPWSTR pwzServerName = NULL;
+    LOCALGROUP_MEMBERS_INFO_3 memberInfo3 = {};
+    WCA_CASCRIPT_HANDLE phRollbackScript = NULL;
+
+    if (isRollback)
+    {
+        // Get a CaScript key
+        hr = WcaCaScriptOpen(WCA_ACTION_NONE, WCA_CASCRIPT_ROLLBACK, FALSE, remove ? L"AddGroupMembershipRollback" : L"RemoveGroupMembershipRollback", &phRollbackScript);
+        hr = WcaCaScriptReadAsCustomActionData(phRollbackScript, &pwzData);
+    }
+    else
+    {
+        hr = WcaCaScriptCreate(WCA_ACTION_NONE, WCA_CASCRIPT_ROLLBACK, FALSE, remove ? L"RemoveGroupMembershipRollback" : L"AddGroupMembershipRollback", TRUE, &phRollbackScript);
+        hr = WcaGetProperty(L"CustomActionData", &pwzData);
+    }
+    ExitOnFailure(hr, "failed to get CustomActionData");
+
+    WcaLog(LOGMSG_TRACEONLY, "CustomActionData: %ls", pwzData);
+
+    //
+    // Read in the CustomActionData
+    //
+    pwz = pwzData;
+    hr = WcaReadStringFromCaData(&pwz, &pwzParentName);
+    ExitOnFailure(hr, "failed to read group name from custom action data");
+
+    hr = WcaReadStringFromCaData(&pwz, &pwzParentDomain);
+    ExitOnFailure(hr, "failed to read domain from custom action data");
+
+    hr = WcaReadStringFromCaData(&pwz, &pwzChildName);
+    ExitOnFailure(hr, "failed to read group comment from custom action data");
+
+    hr = WcaReadStringFromCaData(&pwz, &pwzChildDomain);
+    ExitOnFailure(hr, "failed to read group comment from custom action data");
+
+    hr = WcaReadIntegerFromCaData(&pwz, &iAttributes);
+    ExitOnFailure(hr, "failed to read attributes from custom action data");
+
+    hr = GetDomainServerName(pwzParentDomain, &pwzServerName, DS_WRITABLE_REQUIRED);
+    ExitOnFailure(hr, "failed to contact domain server %ls", pwzParentDomain);
+
+    if (*pwzChildDomain)
+    {
+        StrAllocFormatted(&pwzChildFullName, L"%ls\\%ls", pwzChildDomain, pwzChildName);
+    }
+    else
+    {
+        StrAllocFormatted(&pwzChildFullName, L"%ls", pwzChildName);
+    }
+    memberInfo3.lgrmi3_domainandname = pwzChildFullName;
+
+    if (remove)
+    {
+        er = ::NetLocalGroupDelMembers(pwzServerName, pwzParentName, 3, (LPBYTE)&memberInfo3, 1);
+    }
+    else
+    {
+        er = ::NetLocalGroupAddMembers(pwzServerName, pwzParentName, 3, (LPBYTE)&memberInfo3, 1);
+    }
+    hr = HRESULT_FROM_WIN32(er);
+
+    if (S_OK == hr && !isRollback)
+    {
+        // we need to log rollback data, we can just use exactly the same data we used to do the initial action though
+        WcaCaScriptWriteString(phRollbackScript, pwzParentName);
+        WcaCaScriptWriteString(phRollbackScript, pwzParentDomain);
+        WcaCaScriptWriteString(phRollbackScript, pwzChildName);
+        WcaCaScriptWriteString(phRollbackScript, pwzChildDomain);
+        WcaCaScriptWriteNumber(phRollbackScript, iAttributes);
+        WcaCaScriptFlush(phRollbackScript);
+        WcaCaScriptClose(phRollbackScript, WCA_CASCRIPT_CLOSE_PRESERVE);
+    }
+
+    if (remove)
+    {
+        if (HRESULT_FROM_WIN32(NERR_GroupNotFound) == hr
+            || HRESULT_FROM_WIN32(ERROR_NO_SUCH_MEMBER) == hr
+            || HRESULT_FROM_WIN32(ERROR_MEMBER_NOT_IN_ALIAS) == hr)
+        {
+            hr = S_OK;
+        }
+    }
+    else
+    {
+        if (HRESULT_FROM_WIN32(ERROR_MEMBER_IN_ALIAS) == hr)
+        {
+            hr = S_OK;
+        }
+    }
+
+LExit:
+    ReleaseStr(pwzData);
+    ReleaseStr(pwzParentName);
+    ReleaseStr(pwzParentDomain);
+    ReleaseStr(pwzChildName);
+    ReleaseStr(pwzChildDomain);
+    ReleaseStr(pwzChildFullName);
+    ReleaseStr(pwzServerName);
+
+    if (SCAG_NON_VITAL & iAttributes)
+    {
+        return S_OK;
+    }
+    return hr;
+}
+
+/********************************************************************
+ AddGroupmembership - CUSTOM ACTION ENTRY POINT for creating groups
+
+  Input:  deferred CustomActionData -
+  ParentGroupName\tParentGroupDomain\tChildGroupName\tChildGroupDomain\tAttributes
+ * *****************************************************************/
+extern "C" UINT __stdcall AddGroupMembership(
+    __in MSIHANDLE hInstall
+)
+{
+    //AssertSz(0, "Debug AddGroupMembership");
+
+    HRESULT hr = S_OK;
+
+    BOOL fInitializedCom = FALSE;
+
+    hr = WcaInitialize(hInstall, "AddGroupMembership");
+    ExitOnFailure(hr, "failed to initialize");
+
+    hr = ::CoInitialize(NULL);
+    ExitOnFailure(hr, "failed to initialize COM");
+    fInitializedCom = TRUE;
+
+    hr = AlterGroupMembership(false, false);
+
+LExit:
+    if (fInitializedCom)
+    {
+        ::CoUninitialize();
+    }
+    return WcaFinalize(FAILED(hr) ? ERROR_INSTALL_FAILED : ERROR_SUCCESS);
+}
+
+/********************************************************************
+ AddGroupmembership - CUSTOM ACTION ENTRY POINT for creating groups
+
+  Input:  deferred CustomActionData -
+  ParentGroupName\tParentGroupDomain\tChildGroupName\tChildGroupDomain\tAttributes
+ * *****************************************************************/
+extern "C" UINT __stdcall AddGroupMembershipRollback(
+    __in MSIHANDLE hInstall
+)
+{
+    //AssertSz(0, "Debug AddGroupMembershipRollback");
+
+    HRESULT hr = S_OK;
+
+    BOOL fInitializedCom = FALSE;
+
+    hr = WcaInitialize(hInstall, "AddGroupMembershipRollback");
+    ExitOnFailure(hr, "failed to initialize");
+
+    hr = ::CoInitialize(NULL);
+    ExitOnFailure(hr, "failed to initialize COM");
+    fInitializedCom = TRUE;
+
+    hr = AlterGroupMembership(true, true);
+
+LExit:
+    if (fInitializedCom)
+    {
+        ::CoUninitialize();
+    }
+    return WcaFinalize(FAILED(hr) ? ERROR_INSTALL_FAILED : ERROR_SUCCESS);
+}
+
+/********************************************************************
+ RemoveGroupMembership - CUSTOM ACTION ENTRY POINT for creating groups
+
+  Input:  deferred CustomActionData -
+  ParentGroupName\tParentGroupDomain\tChildGroupName\tChildGroupDomain\tAttributes
+ * *****************************************************************/
+extern "C" UINT __stdcall RemoveGroupMembership(
+    __in MSIHANDLE hInstall
+)
+{
+    //AssertSz(0, "Debug RemoveGroupMembership");
+
+    HRESULT hr = S_OK;
+
+    BOOL fInitializedCom = FALSE;
+
+    hr = WcaInitialize(hInstall, "RemoveGroupMembership");
+    ExitOnFailure(hr, "failed to initialize");
+
+    hr = ::CoInitialize(NULL);
+    ExitOnFailure(hr, "failed to initialize COM");
+    fInitializedCom = TRUE;
+
+    hr = AlterGroupMembership(true, false);
+
+LExit:
+    if (fInitializedCom)
+    {
+        ::CoUninitialize();
+    }
+    return WcaFinalize(FAILED(hr) ? ERROR_INSTALL_FAILED : ERROR_SUCCESS);
+}
+
+/********************************************************************
+ RemoveGroupMembershipRollback - CUSTOM ACTION ENTRY POINT for creating groups
+
+  Input:  deferred CustomActionData -
+  ParentGroupName\tParentGroupDomain\tChildGroupName\tChildGroupDomain\tAttributes
+ * *****************************************************************/
+extern "C" UINT __stdcall RemoveGroupMembershipRollback(
+    __in MSIHANDLE hInstall
+)
+{
+    //AssertSz(0, "Debug RemoveGroupMembershipRollback");
+
+    HRESULT hr = S_OK;
+
+    BOOL fInitializedCom = FALSE;
+
+    hr = WcaInitialize(hInstall, "RemoveGroupMembershipRollback");
+    ExitOnFailure(hr, "failed to initialize");
+
+    hr = ::CoInitialize(NULL);
+    ExitOnFailure(hr, "failed to initialize COM");
+    fInitializedCom = TRUE;
+
+    hr = AlterGroupMembership(false, true);
+
+LExit:
+    if (fInitializedCom)
+    {
+        ::CoUninitialize();
+    }
+    return WcaFinalize(FAILED(hr) ? ERROR_INSTALL_FAILED : ERROR_SUCCESS);
+}
diff --git a/src/ext/Util/ca/scagroup.cpp b/src/ext/Util/ca/scagroup.cpp
index c484c1d2..3d2c3beb 100644
--- a/src/ext/Util/ca/scagroup.cpp
+++ b/src/ext/Util/ca/scagroup.cpp
@@ -6,8 +6,11 @@
 LPCWSTR vcsGroupQuery = L"SELECT `Group`, `Component_`, `Name`, `Domain` FROM `Wix4Group` WHERE `Group`=?";
 enum eGroupQuery { vgqGroup = 1, vgqComponent, vgqName, vgqDomain };
 
-LPCWSTR vcsGroupGroupQuery = L"SELECT `Parent_`, `Child_` FROM `Wix6GroupGroup` WHERE `Child_`=?";
-enum eGroupGroupQuery { vggqParent = 1, vggqChild };
+LPCWSTR vcsGroupParentsQuery = L"SELECT `Parent_`,`Component_`,`Name`,`Domain`,`Child_` FROM `Wix6GroupGroup`,`Wix4Group` WHERE `Wix6GroupGroup`.`Parent_`=`Wix4Group`.`Group` AND `Wix6GroupGroup`.`Child_`=?";
+enum eGroupParentsQuery { vgpqParent = 1, vgpqParentComponent, vgpqParentName, vgpqParentDomain, vgpqChild };
+
+LPCWSTR vcsGroupChildrenQuery = L"SELECT `Parent_`,`Child_`,`Component_`,`Name`,`Domain` FROM `Wix6GroupGroup`,`Wix4Group` WHERE `Wix6GroupGroup`.`Child_`=`Wix4Group`.`Group` AND `Wix6GroupGroup`.`Parent_`=?";
+enum eGroupChildrenQuery { vgcqParent = 1, vgcqChild, vgcqChildComponent, vgcqChildName, vgcqChildDomain };
 
 LPCWSTR vActionableGroupQuery = L"SELECT `Group`,`Component_`,`Name`,`Domain`,`Comment`,`Attributes` FROM `Wix4Group`,`Wix6Group` WHERE `Component_` IS NOT NULL AND `Group`=`Group_`";
 enum eActionableGroupQuery { vagqGroup = 1, vagqComponent, vagqName, vagqDomain, vagqComment, vagqAttributes };
@@ -16,7 +19,6 @@ static HRESULT AddGroupToList(
     __inout SCA_GROUP** ppsgList
     );
 
-
 HRESULT __stdcall ScaGetGroup(
     __in LPCWSTR wzGroup,
     __out SCA_GROUP* pscag
@@ -160,11 +162,149 @@ void ScaGroupFreeList(
     {
         psgDelete = psgList;
         psgList = psgList->psgNext;
+        ScaGroupFreeList(psgDelete->psgParents);
+        ScaGroupFreeList(psgDelete->psgChildren);
 
         MemFree(psgDelete);
     }
 }
 
+HRESULT ScaGroupGetParents(
+    __inout SCA_GROUP* psg
+)
+{
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+    SCA_GROUP* psgParent = NULL;
+    PMSIHANDLE hView, hParamRec, hRec;
+    LPWSTR pwzTempStr = NULL;
+
+    if (S_OK != WcaTableExists(L"Wix6GroupGroup"))
+    {
+        WcaLog(LOGMSG_VERBOSE, "Wix6GroupGroup Table does not exist, exiting");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    // setup the query parameter record
+    hParamRec = ::MsiCreateRecord(1);
+    hr = WcaSetRecordString(hParamRec, 1, psg->wzKey);
+
+    //
+    // loop through all the groups
+    //
+    hr = WcaOpenView(vcsGroupParentsQuery, &hView);
+    ExitOnFailure(hr, "failed to open view on Wix6GroupGroup,Wix4Group table(s)");
+    hr = WcaExecuteView(hView, hParamRec);
+    ExitOnFailure(hr, "failed to open view on Wix4Group,Wix6Group table(s)");
+    while (S_OK == (hr = WcaFetchRecord(hView, &hRec)))
+    {
+        hr = AddGroupToList(&psg->psgParents);
+        ExitOnFailure(hr, "failed to add group to list");
+
+        psgParent = psg->psgParents;
+
+        if (::MsiRecordIsNull(hRec, vgcqChildComponent))
+        {
+            psgParent->isInstalled = INSTALLSTATE_NOTUSED;
+            psgParent->isAction = INSTALLSTATE_NOTUSED;
+        }
+        else
+        {
+            hr = WcaGetRecordString(hRec, vgpqParentComponent, &pwzTempStr);
+            ExitOnFailure(hr, "failed to get Wix4Group.Component");
+            wcsncpy_s(psgParent->wzComponent, pwzTempStr, MAX_DARWIN_KEY);
+            ReleaseNullStr(pwzTempStr);
+
+            er = ::MsiGetComponentStateW(WcaGetInstallHandle(), psgParent->wzComponent, &psgParent->isInstalled, &psgParent->isAction);
+            hr = HRESULT_FROM_WIN32(er);
+            ExitOnFailure(hr, "failed to get Component state for Wix4Group");
+        }
+
+        hr = WcaGetRecordString(hRec, vgpqParentName, &pwzTempStr);
+        ExitOnFailure(hr, "failed to get Wix4Group.Name");
+        wcsncpy_s(psgParent->wzName, pwzTempStr, MAX_DARWIN_COLUMN);
+        ReleaseNullStr(pwzTempStr);
+
+
+        hr = WcaGetRecordString(hRec, vgpqParentDomain, &pwzTempStr);
+        ExitOnFailure(hr, "failed to get Wix4Group.Domain");
+        wcsncpy_s(psgParent->wzDomain, pwzTempStr, MAX_DARWIN_COLUMN);
+        ReleaseNullStr(pwzTempStr);
+    }
+
+LExit:
+    ReleaseNullStr(pwzTempStr);
+    return hr;
+}
+
+HRESULT ScaGroupGetChildren(
+    __inout SCA_GROUP* psg
+)
+{
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+    SCA_GROUP* psgChild = NULL;
+    PMSIHANDLE hView, hParamRec, hRec;
+    LPWSTR pwzTempStr = NULL;
+
+    if (S_OK != WcaTableExists(L"Wix6GroupGroup"))
+    {
+        WcaLog(LOGMSG_VERBOSE, "Wix6GroupGroup Table does not exist, exiting");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    // setup the query parameter record
+    hParamRec = ::MsiCreateRecord(1);
+    hr = WcaSetRecordString(hParamRec, 1, psg->wzKey);
+
+    //
+    // loop through all the groups
+    //
+    hr = WcaOpenView(vcsGroupChildrenQuery, &hView);
+    ExitOnFailure(hr, "failed to open view on Wix6GroupGroup,Wix4Group table(s)");
+    hr = WcaExecuteView(hView, hParamRec);
+    ExitOnFailure(hr, "failed to open view on Wix4Group,Wix6Group table(s)");
+    while (S_OK == (hr = WcaFetchRecord(hView, &hRec)))
+    {
+        hr = AddGroupToList(&psg->psgChildren);
+        ExitOnFailure(hr, "failed to add group to list");
+
+        psgChild = psg->psgChildren;
+
+        if (::MsiRecordIsNull(hRec, vgcqChildComponent))
+        {
+            psgChild->isInstalled = INSTALLSTATE_NOTUSED;
+            psgChild->isAction = INSTALLSTATE_NOTUSED;
+        }
+        else
+        {
+            hr = WcaGetRecordString(hRec, vgcqChildComponent, &pwzTempStr);
+            ExitOnFailure(hr, "failed to get Wix4Group.Component");
+            wcsncpy_s(psgChild->wzComponent, pwzTempStr, MAX_DARWIN_KEY);
+            ReleaseNullStr(pwzTempStr);
+
+            er = ::MsiGetComponentStateW(WcaGetInstallHandle(), psgChild->wzComponent, &psgChild->isInstalled, &psgChild->isAction);
+            hr = HRESULT_FROM_WIN32(er);
+            ExitOnFailure(hr, "failed to get Component state for Wix4Group");
+        }
+
+        hr = WcaGetRecordString(hRec, vgcqChildName, &pwzTempStr);
+        ExitOnFailure(hr, "failed to get Wix4Group.Name");
+        wcsncpy_s(psgChild->wzName, pwzTempStr, MAX_DARWIN_COLUMN);
+        ReleaseNullStr(pwzTempStr);
+
+
+        hr = WcaGetRecordString(hRec, vgcqChildDomain, &pwzTempStr);
+        ExitOnFailure(hr, "failed to get Wix4Group.Domain");
+        wcsncpy_s(psgChild->wzDomain, pwzTempStr, MAX_DARWIN_COLUMN);
+        ReleaseNullStr(pwzTempStr);
+    }
+
+LExit:
+    ReleaseNullStr(pwzTempStr);
+    return hr;
+}
+
 
 HRESULT ScaGroupRead(
     __out SCA_GROUP** ppsgList
@@ -179,7 +319,7 @@ HRESULT ScaGroupRead(
 
     LPWSTR pwzData = NULL;
 
-    BOOL fGroupGroupExists = FALSE;
+    //BOOL fGroupGroupExists = FALSE;
 
     SCA_GROUP *psg = NULL;
 
@@ -196,11 +336,6 @@ HRESULT ScaGroupRead(
         ExitFunction1(hr = S_FALSE);
     }
 
-    if (S_OK == WcaTableExists(L"Wix6GroupGroup"))
-    {
-        fGroupGroupExists = TRUE;
-    }
-
     //
     // loop through all the groups
     //
@@ -230,21 +365,26 @@ HRESULT ScaGroupRead(
             psg->isAction = isAction;
             hr = ::StringCchCopyW(psg->wzComponent, countof(psg->wzComponent), pwzData);
             ExitOnFailure(hr, "failed to copy component name: %ls", pwzData);
+            ReleaseNullStr(pwzData);
 
             hr = WcaGetRecordString(hRec, vagqGroup, &pwzData);
             ExitOnFailure(hr, "failed to get Wix4Group.Group");
             hr = ::StringCchCopyW(psg->wzKey, countof(psg->wzKey), pwzData);
             ExitOnFailure(hr, "failed to copy group key: %ls", pwzData);
+            ReleaseNullStr(pwzData);
 
             hr = WcaGetRecordFormattedString(hRec, vagqName, &pwzData);
             ExitOnFailure(hr, "failed to get Wix4Group.Name");
             hr = ::StringCchCopyW(psg->wzName, countof(psg->wzName), pwzData);
             ExitOnFailure(hr, "failed to copy group name: %ls", pwzData);
+            ReleaseNullStr(pwzData);
 
             hr = WcaGetRecordFormattedString(hRec, vagqDomain, &pwzData);
             ExitOnFailure(hr, "failed to get Wix4Group.Domain");
             hr = ::StringCchCopyW(psg->wzDomain, countof(psg->wzDomain), pwzData);
             ExitOnFailure(hr, "failed to copy group domain: %ls", pwzData);
+            ReleaseNullStr(pwzData);
+
             hr = WcaGetRecordFormattedString(hRec, vagqComment, &pwzData);
             ExitOnFailure(hr, "failed to get Wix6Group.Comment");
             hr = ::StringCchCopyW(psg->wzComment, countof(psg->wzComment), pwzData);
@@ -253,36 +393,9 @@ HRESULT ScaGroupRead(
             hr = WcaGetRecordInteger(hRec, vagqAttributes, &psg->iAttributes);
             ExitOnFailure(hr, "failed to get Wix6Group.Attributes");
 
-            // Check if this group is to be added to any other groups
-            if (fGroupGroupExists)
-            {
-                hGroupRec = ::MsiCreateRecord(1);
-                hr = WcaSetRecordString(hGroupRec, 1, psg->wzKey);
-                ExitOnFailure(hr, "Failed to create group record for querying Wix6GroupGroup table");
-
-                hr = WcaOpenExecuteView(vcsGroupGroupQuery, &hGroupGroupView);
-                ExitOnFailure(hr, "Failed to open view on Wix6GroupGroup table for group %ls", psg->wzKey);/*
-                hr = WcaExecuteView(hGroupGroupView, hGroupRec);
-                ExitOnFailure(hr, "Failed to execute view on Wix6GroupGroup table for group: %ls", psg->wzKey);*/
+            ScaGroupGetParents(psg);
 
-                while (S_OK == (hr = WcaFetchRecord(hGroupGroupView, &hRec)))
-                {
-                    hr = WcaGetRecordString(hRec, vggqParent, &pwzData);
-                    ExitOnFailure(hr, "failed to get Wix6GroupGroup.Parent");
-
-                    hr = AddGroupToList(&(psg->psgGroups));
-                    ExitOnFailure(hr, "failed to add group to list");
-
-                    hr = ScaGetGroup(pwzData, psg->psgGroups);
-                    ExitOnFailure(hr, "failed to get information for group: %ls", pwzData);
-                }
-
-                if (E_NOMOREITEMS == hr)
-                {
-                    hr = S_OK;
-                }
-                ExitOnFailure(hr, "failed to enumerate selected rows from Wix4UserGroup table");
-            }
+            ScaGroupGetChildren(psg);
         }
     }
 
@@ -301,7 +414,6 @@ LExit:
 /* ****************************************************************
 ScaGroupExecute - Schedules group account creation or removal based on
 component state.
-
 ******************************************************************/
 HRESULT ScaGroupExecute(
     __in SCA_GROUP *psgList
@@ -428,7 +540,7 @@ HRESULT ScaGroupExecute(
                 hr = WcaWriteIntegerToCaData(iRollbackUserAttributes, &pwzRollbackData);
                 ExitOnFailure(hr, "failed to add group attributes to rollback custom action data for group: %ls", psg->wzKey);
 
-                hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"CreateGroupRollback"), pwzRollbackData, COST_GROUP_DELETE);
+                hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION6(L"CreateGroupRollback"), pwzRollbackData, COST_GROUP_DELETE);
                 ExitOnFailure(hr, "failed to schedule CreateGroupRollback");
             }
             else
@@ -441,7 +553,7 @@ HRESULT ScaGroupExecute(
             //
             // Schedule the creation now.
             //
-            hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"CreateGroup"), pwzActionData, COST_GROUP_ADD);
+            hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION6(L"CreateGroup"), pwzActionData, COST_GROUP_ADD);
             ExitOnFailure(hr, "failed to schedule CreateGroup");
         }
         else if (((GROUP_EXISTS_YES == geGroupExists)
@@ -457,7 +569,7 @@ HRESULT ScaGroupExecute(
             //
             // Note: We can't rollback the removal of a group which is why RemoveGroup is a commit
             // CustomAction.
-            hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"RemoveGroup"), pwzActionData, COST_GROUP_DELETE);
+            hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION6(L"RemoveGroup"), pwzActionData, COST_GROUP_DELETE);
             ExitOnFailure(hr, "failed to schedule RemoveGroup");
         }
 
@@ -501,3 +613,219 @@ static HRESULT AddGroupToList(
 LExit:
     return hr;
 }
+
+/* ****************************************************************
+ScaGroupMembershipRemoveParentsExecute - Schedules group membership removal
+based on parent/child component state
+******************************************************************/
+HRESULT ScaGroupMembershipRemoveParentsExecute(
+    __in SCA_GROUP* psg
+)
+{
+    HRESULT hr = S_OK;
+    LPWSTR pwzActionData = NULL;
+
+    for (SCA_GROUP* psgp = psg->psgParents; psgp; psgp = psgp->psgNext)
+    {
+        Assert(psgp->wzName);
+        if (WcaIsUninstalling(psg->isInstalled, psg->isAction)
+            || WcaIsUninstalling(psgp->isInstalled, psgp->isAction))
+        {
+            hr = WcaWriteStringToCaData(psgp->wzName, &pwzActionData);
+            ExitOnFailure(hr, "Failed to add parent group name to custom action data: %ls", psgp->wzName);
+            hr = WcaWriteStringToCaData(psgp->wzDomain, &pwzActionData);
+            ExitOnFailure(hr, "Failed to add parent group domain to custom action data: %ls", psgp->wzDomain);
+            hr = WcaWriteStringToCaData(psg->wzName, &pwzActionData);
+            ExitOnFailure(hr, "Failed to add child group name to custom action data: %ls", psg->wzName);
+            hr = WcaWriteStringToCaData(psg->wzDomain, &pwzActionData);
+            ExitOnFailure(hr, "Failed to add child group domain to custom action data: %ls", psg->wzDomain);
+            hr = WcaWriteIntegerToCaData(psg->iAttributes, &pwzActionData);
+            ExitOnFailure(hr, "Failed to add group attributes to custom action data: %i", psg->iAttributes);
+            hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION6(L"RemoveGroupMembership"), pwzActionData, COST_GROUPMEMBERSHIP_DELETE);
+
+        LExit:
+            ReleaseNullStr(pwzActionData);
+            if (hr != S_OK && !(psg->iAttributes & SCAG_NON_VITAL))
+            {
+                return hr;
+            }
+        }
+    }
+    return S_OK;
+}
+
+/* ****************************************************************
+ScaGroupMembershipRemoveChildrenExecute - 
+******************************************************************/
+HRESULT ScaGroupMembershipRemoveChildrenExecute(
+    __in SCA_GROUP* psg
+)
+{
+    HRESULT hr = S_OK;
+    LPWSTR pwzActionData = NULL;
+
+    for (SCA_GROUP* psgc = psg->psgChildren; psgc; psgc = psgc->psgNext)
+    {
+        Assert(psgc->wzName);
+        if (WcaIsUninstalling(psg->isInstalled, psg->isAction)
+            || WcaIsUninstalling(psgc->isInstalled, psgc->isAction))
+        {
+            hr = WcaWriteStringToCaData(psg->wzName, &pwzActionData);
+            ExitOnFailure(hr, "Failed to add parent group name to custom action data: %ls", psg->wzName);
+            hr = WcaWriteStringToCaData(psg->wzDomain, &pwzActionData);
+            ExitOnFailure(hr, "Failed to add parent group domain to custom action data: %ls", psg->wzDomain);
+            hr = WcaWriteStringToCaData(psgc->wzName, &pwzActionData);
+            ExitOnFailure(hr, "Failed to add child group name to custom action data: %ls", psgc->wzName);
+            hr = WcaWriteStringToCaData(psgc->wzDomain, &pwzActionData);
+            ExitOnFailure(hr, "Failed to add child group domain to custom action data: %ls", psgc->wzDomain);
+            hr = WcaWriteIntegerToCaData(psg->iAttributes, &pwzActionData);
+            ExitOnFailure(hr, "Failed to add group attributes to custom action data: %i", psg->iAttributes);
+            hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION6(L"RemoveGroupMembership"), pwzActionData, COST_GROUPMEMBERSHIP_DELETE);
+
+        LExit:
+            ReleaseNullStr(pwzActionData);
+
+            if (hr != S_OK && !(psg->iAttributes & SCAG_NON_VITAL))
+            {
+                return hr;
+            }
+        }
+    }
+    return S_OK;
+}
+
+/* ****************************************************************
+ScaGroupMembershipRemoveExecute - Schedules group membership removal
+based on parent/child component state
+******************************************************************/
+HRESULT ScaGroupMembershipRemoveExecute(
+    __in SCA_GROUP* psgList
+)
+{
+    HRESULT hr = S_OK;
+
+    // Loop through all the users to be configured.
+    for (SCA_GROUP* psg = psgList; psg; psg = psg->psgNext)
+    {
+        Assert(psg->wzName);
+        // first we loop through the Parents
+        hr = ScaGroupMembershipRemoveParentsExecute(psg);
+        ExitOnFailure(hr, "Failed to remove parent membership for vital group: %ls", psg->wzKey);
+
+        // then through the Children
+        hr = ScaGroupMembershipRemoveChildrenExecute(psg);
+        ExitOnFailure(hr, "Failed to remove child membership for vital group: %ls", psg->wzKey);
+    }
+
+LExit:
+    return hr;
+}
+
+/* ****************************************************************
+ScaGroupMembershipAddParentsExecute - Schedules group membership removal
+based on parent/child component state
+******************************************************************/
+HRESULT ScaGroupMembershipAddParentsExecute(
+    __in SCA_GROUP* psg
+)
+{
+    HRESULT hr = S_OK;
+    LPWSTR pwzActionData = NULL;
+
+    for (SCA_GROUP* psgp = psg->psgParents; psgp; psgp = psgp->psgNext)
+    {
+        Assert(psgp->wzName);
+        if (WcaIsInstalling(psg->isInstalled, psg->isAction)
+            || WcaIsInstalling(psgp->isInstalled, psgp->isAction))
+        {
+            hr = WcaWriteStringToCaData(psgp->wzName, &pwzActionData);
+            ExitOnFailure(hr, "Failed to add parent group domain to custom action data: %ls", psgp->wzName);
+            hr = WcaWriteStringToCaData(psgp->wzDomain, &pwzActionData);
+            ExitOnFailure(hr, "Failed to add parent group domain to custom action data: %ls", psgp->wzDomain);
+            hr = WcaWriteStringToCaData(psg->wzName, &pwzActionData);
+            ExitOnFailure(hr, "Failed to add child group name to custom action data: %ls", psg->wzName);
+            hr = WcaWriteStringToCaData(psg->wzDomain, &pwzActionData);
+            ExitOnFailure(hr, "Failed to add child group domain to custom action data: %ls", psg->wzDomain);
+            hr = WcaWriteIntegerToCaData(psg->iAttributes, &pwzActionData);
+            ExitOnFailure(hr, "Failed to add group attributes to custom action data: %i", psg->iAttributes);
+            hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION6(L"AddGroupMembership"), pwzActionData, COST_GROUPMEMBERSHIP_ADD);
+
+        LExit:
+            ReleaseNullStr(pwzActionData);
+
+            if (hr != S_OK && !(psg->iAttributes & SCAG_NON_VITAL))
+            {
+                return hr;
+            }
+        }
+    }
+    return S_OK;
+}
+
+/* ****************************************************************
+ScaGroupMembershipAddChildrenExecute - Schedules group membership removal
+based on parent/child component state
+******************************************************************/
+HRESULT ScaGroupMembershipAddChildrenExecute(
+    __in SCA_GROUP* psg
+)
+{
+    HRESULT hr = S_OK;
+    LPWSTR pwzActionData = NULL;
+
+    // then through the Children
+    for (SCA_GROUP* psgc = psg->psgChildren; psgc; psgc = psgc->psgNext)
+    {
+        Assert(psgc->wzName);
+        if (WcaIsInstalling(psg->isInstalled, psg->isAction)
+            || WcaIsInstalling(psgc->isInstalled, psgc->isAction))
+        {
+            hr = WcaWriteStringToCaData(psg->wzName, &pwzActionData);
+            ExitOnFailure(hr, "Failed to add child group name to custom action data: %ls", psg->wzName);
+            hr = WcaWriteStringToCaData(psg->wzDomain, &pwzActionData);
+            ExitOnFailure(hr, "Failed to add child group domain to custom action data: %ls", psg->wzDomain);
+            hr = WcaWriteStringToCaData(psgc->wzName, &pwzActionData);
+            ExitOnFailure(hr, "Failed to add parent group domain to custom action data: %ls", psgc->wzName);
+            hr = WcaWriteStringToCaData(psgc->wzDomain, &pwzActionData);
+            ExitOnFailure(hr, "Failed to add parent group domain to custom action data: %ls", psgc->wzDomain);
+            hr = WcaWriteIntegerToCaData(psg->iAttributes, &pwzActionData);
+            ExitOnFailure(hr, "Failed to add group attributes to custom action data: %i", psg->iAttributes);
+            hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION6(L"AddGroupMembership"), pwzActionData, COST_GROUPMEMBERSHIP_ADD);
+
+        LExit:
+            ReleaseNullStr(pwzActionData);
+            if (hr != S_OK && !(psg->iAttributes & SCAG_NON_VITAL))
+            {
+                return hr;
+            }
+        }
+    }
+    return S_OK;
+}
+
+/* ****************************************************************
+ScaGroupMembershipAddExecute - Schedules group membership addition
+based on parent/child component state
+******************************************************************/
+HRESULT ScaGroupMembershipAddExecute(
+    __in SCA_GROUP* psgList
+)
+{
+    HRESULT hr = S_OK;
+
+    // Loop through all the users to be configured.
+    for (SCA_GROUP* psg = psgList; psg; psg = psg->psgNext)
+    {
+        Assert(psg->wzName);
+        // first we loop through the Parents
+        hr = ScaGroupMembershipAddParentsExecute(psg);
+        ExitOnFailure(hr, "Failed to add parent membership for vital group: %ls", psg->wzKey);
+
+        // then through the Children
+        hr = ScaGroupMembershipAddChildrenExecute(psg);
+        ExitOnFailure(hr, "Failed to add child membership for vital group: %ls", psg->wzKey);
+    }
+
+LExit:
+    return hr;
+}
diff --git a/src/ext/Util/ca/scagroup.h b/src/ext/Util/ca/scagroup.h
index 8666d852..e16d7a95 100644
--- a/src/ext/Util/ca/scagroup.h
+++ b/src/ext/Util/ca/scagroup.h
@@ -21,11 +21,13 @@ struct SCA_GROUP
     WCHAR wzComment[MAX_DARWIN_COLUMN + 1];
     INT iAttributes;
 
-    SCA_GROUP* psgGroups;
+    SCA_GROUP* psgParents;
+    SCA_GROUP* psgChildren;
 
     SCA_GROUP *psgNext;
 };
 
+
 // prototypes
 HRESULT __stdcall ScaGetGroup(
     __in LPCWSTR wzGroup,
@@ -42,6 +44,12 @@ void ScaGroupFreeList(
 HRESULT ScaGroupRead(
     __inout SCA_GROUP** ppsgList
     );
+HRESULT ScaGroupMembershipRemoveExecute(
+        __in SCA_GROUP* psgList
+    );
+HRESULT ScaGroupMembershipAddExecute(
+    __in SCA_GROUP* psgList
+);
 HRESULT ScaGroupExecute(
     __in SCA_GROUP*psgList
     );
diff --git a/src/ext/Util/ca/scanet.cpp b/src/ext/Util/ca/scanet.cpp
index 11ee487d..a8ad0316 100644
--- a/src/ext/Util/ca/scanet.cpp
+++ b/src/ext/Util/ca/scanet.cpp
@@ -1,7 +1,6 @@
 // Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
 
 #include "precomp.h"
-#include "scanet.h"
 
 
 HRESULT GetDomainServerName(LPCWSTR pwzDomain, LPWSTR* ppwzServerName, ULONG flags)
@@ -25,16 +24,16 @@ HRESULT GetDomainServerName(LPCWSTR pwzDomain, LPWSTR* ppwzServerName, ULONG fla
             if ('\\' == *pDomainControllerInfo->DomainControllerName && '\\' == *pDomainControllerInfo->DomainControllerName + 1)
             {
                 hr = StrAllocString(ppwzServerName, pDomainControllerInfo->DomainControllerName + 2, 0);
-                ExitOnFailure(hr, "failed to allocate memory for string");
             }
             else
             {
                 hr = StrAllocString(ppwzServerName, pDomainControllerInfo->DomainControllerName, 0);
-                ExitOnFailure(hr, "failed to allocate memory for string");
             }
+            ExitOnFailure(hr, "failed to allocate memory for string");
         }
         else
         {
+            // we won't report any potential string allocation failure, the domain failure is more interesting
             StrAllocString(ppwzServerName, pwzDomain, 0);
             hr = HRESULT_FROM_WIN32(er);
             ExitOnFailure(hr, "failed to contact domain %ls", pwzDomain);
diff --git a/src/ext/Util/ca/scasched.cpp b/src/ext/Util/ca/scasched.cpp
index 1351fbfd..cef7fecb 100644
--- a/src/ext/Util/ca/scasched.cpp
+++ b/src/ext/Util/ca/scasched.cpp
@@ -153,9 +153,15 @@ extern "C" UINT __stdcall ConfigureGroups(
     hr = ScaGroupRead(&psgList);
     ExitOnFailure(hr, "failed to read Wix4Group,Wix6Group table(s)");
 
+    hr = ScaGroupMembershipRemoveExecute(psgList);
+    ExitOnFailure(hr, "failed to remove Group Memberships")
+
     hr = ScaGroupExecute(psgList);
     ExitOnFailure(hr, "failed to add/remove Group actions");
 
+    hr = ScaGroupMembershipAddExecute(psgList);
+    ExitOnFailure(hr, "failed to add Group Memberships")
+
 LExit:
     if (psgList)
     {
diff --git a/src/ext/Util/ca/utilca.def b/src/ext/Util/ca/utilca.def
index 18a19d12..2aeb54f4 100644
--- a/src/ext/Util/ca/utilca.def
+++ b/src/ext/Util/ca/utilca.def
@@ -46,6 +46,10 @@ EXPORTS
     CreateGroup
     CreateGroupRollback
     RemoveGroup
+    AddGroupMembership
+    AddGroupMembershipRollback
+    RemoveGroupMembership
+    RemoveGroupMembershipRollback
     CreateUser
     CreateUserRollback
     RemoveUser
diff --git a/src/ext/Util/test/WixToolsetTest.Util/UtilExtensionFixture.cs b/src/ext/Util/test/WixToolsetTest.Util/UtilExtensionFixture.cs
index d71dd824..c9a184ab 100644
--- a/src/ext/Util/test/WixToolsetTest.Util/UtilExtensionFixture.cs
+++ b/src/ext/Util/test/WixToolsetTest.Util/UtilExtensionFixture.cs
@@ -404,10 +404,10 @@ namespace WixToolsetTest.Util
             WixAssert.CompareLineByLine(new[]
             {
                 "Binary:Wix4UtilCA_X64\t[Binary data]",
-                "CustomAction:Wix4ConfigureGroups_X64\t1\tWix4UtilCA_X64\tConfigureGroups\t",
-                "CustomAction:Wix4CreateGroup_X64\t11265\tWix4UtilCA_X64\tCreateGroup\t",
-                "CustomAction:Wix4CreateGroupRollback_X64\t11521\tWix4UtilCA_X64\tCreateGroupRollback\t",
-                "CustomAction:Wix4RemoveGroup_X64\t11841\tWix4UtilCA_X64\tRemoveGroup\t",
+                "CustomAction:Wix6ConfigureGroups_X64\t1\tWix4UtilCA_X64\tConfigureGroups\t",
+                "CustomAction:Wix6CreateGroup_X64\t3073\tWix4UtilCA_X64\tCreateGroup\t",
+                "CustomAction:Wix6CreateGroupRollback_X64\t3329\tWix4UtilCA_X64\tCreateGroupRollback\t",
+                "CustomAction:Wix6RemoveGroup_X64\t3649\tWix4UtilCA_X64\tRemoveGroup\t",
                 "Wix4Group:TEST_GROUP00\tComponent1\ttestName00\t",
                 "Wix4Group:TEST_GROUP01\tComponent1\ttestName01\t",
                 "Wix4Group:TEST_GROUP02\tComponent1\ttestName02\t",
diff --git a/src/ext/Util/wixext/UtilCompiler.cs b/src/ext/Util/wixext/UtilCompiler.cs
index aff7dd0d..4b1e43b5 100644
--- a/src/ext/Util/wixext/UtilCompiler.cs
+++ b/src/ext/Util/wixext/UtilCompiler.cs
@@ -1475,7 +1475,7 @@ namespace WixToolset.Util
 
             if (null != componentId)
             {
-                this.ParseHelper.CreateCustomActionReference(sourceLineNumbers, section, "Wix4ConfigureGroups", this.Context.Platform, CustomActionPlatforms.X86 | CustomActionPlatforms.X64 | CustomActionPlatforms.ARM64);
+                this.ParseHelper.CreateCustomActionReference(sourceLineNumbers, section, "Wix6ConfigureGroups", this.Context.Platform, CustomActionPlatforms.X86 | CustomActionPlatforms.X64 | CustomActionPlatforms.ARM64);
             }
 
             foreach (var child in element.Elements())
@@ -1488,7 +1488,7 @@ namespace WixToolset.Util
                             this.ParseGroupRefElement(intermediate, section, child,  id.Id, groupType:true);
                             break;
                         default:
-                            //this.ParseHelper.UnexpectedElement(element, child);
+                            this.ParseHelper.UnexpectedElement(element, child);
                             break;
                     }
                 }
@@ -1561,6 +1561,9 @@ namespace WixToolset.Util
                 }
                 else
                 {
+                    // Add reference to bring in fragment
+                    this.ParseHelper.CreateCustomActionReference(sourceLineNumbers, section, "Wix6AddGroupMembership", this.Context.Platform, CustomActionPlatforms.X86 | CustomActionPlatforms.X64 | CustomActionPlatforms.ARM64);
+
                     section.AddSymbol(new GroupGroupSymbol(sourceLineNumbers)
                     {
                         ChildGroupRef = childId,
diff --git a/src/ext/Util/wixext/UtilDecompiler.cs b/src/ext/Util/wixext/UtilDecompiler.cs
index 53b75b8d..a236ece9 100644
--- a/src/ext/Util/wixext/UtilDecompiler.cs
+++ b/src/ext/Util/wixext/UtilDecompiler.cs
@@ -478,14 +478,26 @@ namespace WixToolset.Util
         {
             foreach (var row in table.Rows)
             {
+                var parentId = row.FieldAsString(0);
+                var parentExists = this.DecompilerHelper.TryGetIndexedElement("Group", parentId, out var parentGroup);
+
                 var childId = row.FieldAsString(1);
-                if (this.DecompilerHelper.TryGetIndexedElement("Group", childId, out var group))
+                var childExists = this.DecompilerHelper.TryGetIndexedElement("Group", childId, out var childGroup);
+
+                if (parentExists && childExists)
                 {
-                    group.Add(new XElement(UtilConstants.GroupRefName, new XAttribute("Id", row.FieldAsString(0))));
+                    childGroup.Add(new XElement(UtilConstants.GroupRefName, new XAttribute("Id", parentId)));
                 }
                 else
                 {
-                    this.Messaging.Write(WarningMessages.ExpectedForeignRow(row.SourceLineNumbers, table.Name, row.GetPrimaryKey(), "Parent_", childId, "Group"));
+                    if(!parentExists)
+                    {
+                        this.Messaging.Write(WarningMessages.ExpectedForeignRow(row.SourceLineNumbers, table.Name, row.GetPrimaryKey(), "Parent_", parentId, "Group"));
+                    }
+                    if (!childExists)
+                    {
+                        this.Messaging.Write(WarningMessages.ExpectedForeignRow(row.SourceLineNumbers, table.Name, row.GetPrimaryKey(), "Child_", childId, "Group"));
+                    }
                 }
             }
         }
diff --git a/src/ext/Util/wixlib/UtilExtension.wxs b/src/ext/Util/wixlib/UtilExtension.wxs
index bc0f651d..aa262eca 100644
--- a/src/ext/Util/wixlib/UtilExtension.wxs
+++ b/src/ext/Util/wixlib/UtilExtension.wxs
@@ -17,12 +17,17 @@
     <Fragment>
         <UI Id="ConfigureGroupsErrorText">
             <Error Id="$(var.msierrGRPFailedGroupCreate)" Message="!(loc.msierrGRPFailedGroupCreate)" />
-            <Error Id="$(var.msierrGRPFailedGroupGroupAdd)" Message="!(loc.msierrGRPFailedGroupGroupAdd)" />
             <Error Id="$(var.msierrGRPFailedGroupCreateExists)" Message="!(loc.msierrGRPFailedGroupCreateExists)" />
         </UI>
     </Fragment>
 
     <Fragment>
+        <UI Id="ConfigureGroupGroupsErrorText">
+            <Error Id="$(var.msierrGRPFailedGroupGroupAdd)" Message="!(loc.msierrGRPFailedGroupGroupAdd)" />
+        </UI>
+    </Fragment>
+
+    <Fragment>
         <UI Id="ConfigureSmbErrorsText">
             <Error Id="$(var.msierrSMBFailedCreate)" Message="!(loc.msierrSMBFailedCreate)" />
             <Error Id="$(var.msierrSMBFailedDrop)" Message="!(loc.msierrSMBFailedDrop)" />
diff --git a/src/ext/Util/wixlib/UtilExtension_Platform.wxi b/src/ext/Util/wixlib/UtilExtension_Platform.wxi
index df53c7d4..71166d4f 100644
--- a/src/ext/Util/wixlib/UtilExtension_Platform.wxi
+++ b/src/ext/Util/wixlib/UtilExtension_Platform.wxi
@@ -134,19 +134,25 @@
 
     <Fragment>
         <UIRef Id="ConfigureGroupsErrorText" />
-
-        <CustomAction Id="$(var.Prefix)ConfigureGroups$(var.Suffix)" DllEntry="ConfigureGroups" Execute="immediate" Return="check" SuppressModularization="yes" BinaryRef="$(var.Prefix)UtilCA$(var.Suffix)" />
-        <CustomAction Id="$(var.Prefix)CreateGroup$(var.Suffix)" DllEntry="CreateGroup" Impersonate="no" Execute="deferred" Return="check" HideTarget="yes" SuppressModularization="yes" BinaryRef="$(var.Prefix)UtilCA$(var.Suffix)" />
-        <CustomAction Id="$(var.Prefix)CreateGroupRollback$(var.Suffix)" DllEntry="CreateGroupRollback" Impersonate="no" Execute="rollback" Return="check" HideTarget="yes" SuppressModularization="yes" BinaryRef="$(var.Prefix)UtilCA$(var.Suffix)" />
+        <CustomAction Id="$(var.Prefix6)ConfigureGroups$(var.Suffix)" DllEntry="ConfigureGroups" Execute="immediate" Return="check" SuppressModularization="yes" BinaryRef="$(var.Prefix)UtilCA$(var.Suffix)" />
+        <CustomAction Id="$(var.Prefix6)CreateGroup$(var.Suffix)" DllEntry="CreateGroup" Impersonate="no" Execute="deferred" Return="check" SuppressModularization="yes" BinaryRef="$(var.Prefix)UtilCA$(var.Suffix)" />
+        <CustomAction Id="$(var.Prefix6)CreateGroupRollback$(var.Suffix)" DllEntry="CreateGroupRollback" Impersonate="no" Execute="rollback" Return="check" SuppressModularization="yes" BinaryRef="$(var.Prefix)UtilCA$(var.Suffix)" />
         <!-- RemoveGroup is a type commit action because it is not possible to rollback the removal of a group -->
-        <CustomAction Id="$(var.Prefix)RemoveGroup$(var.Suffix)" DllEntry="RemoveGroup" Impersonate="no" Execute="commit" Return="ignore" HideTarget="yes" SuppressModularization="yes" BinaryRef="$(var.Prefix)UtilCA$(var.Suffix)" />
-
+        <CustomAction Id="$(var.Prefix6)RemoveGroup$(var.Suffix)" DllEntry="RemoveGroup" Impersonate="no" Execute="commit" Return="ignore" SuppressModularization="yes" BinaryRef="$(var.Prefix)UtilCA$(var.Suffix)" />
         <InstallExecuteSequence>
-            <Custom Action="virtual $(var.Prefix)ConfigureGroups$(var.Suffix)" Before="InstallFiles" Condition="VersionNT &gt; 400" />
+            <Custom Action="virtual $(var.Prefix6)ConfigureGroups$(var.Suffix)" Before="InstallFiles" Condition="VersionNT &gt; 400" />
         </InstallExecuteSequence>
     </Fragment>
 
     <Fragment>
+        <UIRef Id="ConfigureGroupGroupsErrorText" />
+        <CustomAction Id="$(var.Prefix6)AddGroupMembership$(var.Suffix)" DllEntry="AddGroupMembership" Impersonate="no" Execute="deferred" Return="check" SuppressModularization="yes" BinaryRef="$(var.Prefix)UtilCA$(var.Suffix)" />
+        <CustomAction Id="$(var.Prefix6)AddGroupMembershipRollback$(var.Suffix)" DllEntry="AddGroupMembershipRollback" Impersonate="no" Execute="rollback" Return="check" SuppressModularization="yes" BinaryRef="$(var.Prefix)UtilCA$(var.Suffix)" />
+        <CustomAction Id="$(var.Prefix6)RemoveGroupMembership$(var.Suffix)" DllEntry="RemoveGroupMembership" Impersonate="no" Execute="deferred" Return="check" SuppressModularization="yes" BinaryRef="$(var.Prefix)UtilCA$(var.Suffix)" />
+        <CustomAction Id="$(var.Prefix6)RemoveGroupMembershipRollback$(var.Suffix)" DllEntry="RemoveGroupMembershipRollback" Impersonate="no" Execute="rollback" Return="check" SuppressModularization="yes" BinaryRef="$(var.Prefix)UtilCA$(var.Suffix)" />
+    </Fragment>
+
+    <Fragment>
         <UIRef Id="ConfigureUsersErrorText" />
 
         <CustomAction Id="$(var.Prefix)ConfigureUsers$(var.Suffix)" DllEntry="ConfigureUsers" Execute="immediate" Return="check" SuppressModularization="yes" BinaryRef="$(var.Prefix)UtilCA$(var.Suffix)" />
diff --git a/src/ext/Util/wixlib/es-es.wxl b/src/ext/Util/wixlib/es-es.wxl
index 3756027a..e5a85ab0 100644
--- a/src/ext/Util/wixlib/es-es.wxl
+++ b/src/ext/Util/wixlib/es-es.wxl
@@ -8,7 +8,7 @@
   <String Id="msierrUSRFailedUserCreateExists" Overridable="yes" Value="La creación del usuario ha fracasado porque ya existe. ([2] [3] [4] [5])" />
 
   <String Id="msierrGRPFailedGroupCreate" Overridable="yes" Value="La creación del grupo ha fracasado. ([2]   [3]   [4]   [5])" />
-    <String Id="msierrGRPFailedGroupGroupAdd" Overridable="yes" Value="El aditamento del grupo al grupo ha fracasado. ([2]   [3]   [4]   [5])" />
+  <String Id="msierrGRPFailedGroupGroupAdd" Overridable="yes" Value="El aditamento del grupo al grupo ha fracasado. ([2]   [3]   [4]   [5])" />
   <String Id="msierrGRPFailedGroupCreateExists" Overridable="yes" Value="La creación del grupo ha fracasado porque ya existe. ([2]   [3]   [4]   [5])" />
 
   <String Id="msierrSMBFailedCreate" Overridable="yes" Value="La creación de la red compartida ha fracasado. ([2] [3] [4] [5])" />
diff --git a/src/ext/Util/wixlib/fr-fr.wxl b/src/ext/Util/wixlib/fr-fr.wxl
index 4b9aa9ad..407292ac 100644
--- a/src/ext/Util/wixlib/fr-fr.wxl
+++ b/src/ext/Util/wixlib/fr-fr.wxl
@@ -8,7 +8,7 @@
   <String Id="msierrUSRFailedUserCreateExists" Overridable="yes" Value="La création de l'utilisateur a échoué car il existe dejà.  ([2]   [3]   [4]   [5])" />
 
   <String Id="msierrGRPFailedGroupCreate" Overridable="yes" Value="La création du groupe a échoué.  ([2]   [3]   [4]   [5])" />
-    <String Id="msierrGRPFailedGroupGroupAdd" Overridable="yes" Value="L'ajout du groupe au groupe a échoué.  ([2]   [3]   [4]   [5])" />
+  <String Id="msierrGRPFailedGroupGroupAdd" Overridable="yes" Value="L'ajout du groupe au groupe a échoué.  ([2]   [3]   [4]   [5])" />
   <String Id="msierrGRPFailedGroupCreateExists" Overridable="yes" Value="La création du groupe a échoué car il existe dejà.  ([2]   [3]   [4]   [5])" />
 
   <String Id="msierrSMBFailedCreate" Overridable="yes" Value="La création du partage reseau a échoué.  ([2]   [3]   [4]   [5])" />
diff --git a/src/ext/caDecor.h b/src/ext/caDecor.h
index 060032cf..4a09e075 100644
--- a/src/ext/caDecor.h
+++ b/src/ext/caDecor.h
@@ -21,3 +21,13 @@
 #else
 #define CUSTOM_ACTION_DECORATION5(f) L"Wix5" f L"_X86"
 #endif
+
+#if defined(_M_ARM64)
+#define CUSTOM_ACTION_DECORATION6(f) L"Wix6" f L"_A64"
+#elif defined(_M_AMD64)
+#define CUSTOM_ACTION_DECORATION6(f) L"Wix6" f L"_X64"
+#elif defined(_M_ARM)
+#define CUSTOM_ACTION_DECORATION6(f) L"Wix6" f L"_ARM"
+#else
+#define CUSTOM_ACTION_DECORATION6(f) L"Wix6" f L"_X86"
+#endif
diff --git a/src/ext/caDecor.wxi b/src/ext/caDecor.wxi
index 256d7586..236b2154 100644
--- a/src/ext/caDecor.wxi
+++ b/src/ext/caDecor.wxi
@@ -14,6 +14,11 @@
 
     <?define Prefix5="Wix5" ?>
 
+    <?ifdef Prefix6 ?>
+    <?undef Prefix6 ?>
+    <?endif?>
+    <?define Prefix6="Wix6" ?>
+
     <?ifndef platform ?>
         <?define platform="x86" ?>
     <?endif?>
diff --git a/src/test/burn/WixTestTools/UserGroupVerifier.cs b/src/test/burn/WixTestTools/UserGroupVerifier.cs
index 2f874057..52a1a6bf 100644
--- a/src/test/burn/WixTestTools/UserGroupVerifier.cs
+++ b/src/test/burn/WixTestTools/UserGroupVerifier.cs
@@ -151,7 +151,7 @@ namespace WixTestTools
         /// <param name="groupNames">list of groups to check for membership</param>
         private static void IsMemberOf(string domainName, string memberName, bool shouldBeMember, params string[] groupNames)
         {
-            GroupPrincipal group = GetGroup(domainName, memberName);
+            Principal group = GetPrincipal(domainName, memberName);
             Assert.False(null == group, String.Format("Group '{0}' was not found under domain '{1}'.", memberName, domainName));
 
             bool missedAGroup = false;
@@ -186,11 +186,29 @@ namespace WixTestTools
         {
             if (String.IsNullOrEmpty(domainName))
             {
-                return GroupPrincipal.FindByIdentity(new PrincipalContext(ContextType.Machine), IdentityType.Name, groupName);
+                return GroupPrincipal.FindByIdentity(new PrincipalContext(ContextType.Machine), groupName);
             }
             else
             {
-                return GroupPrincipal.FindByIdentity(new PrincipalContext(ContextType.Domain,domainName), IdentityType.Name, groupName);
+                return GroupPrincipal.FindByIdentity(new PrincipalContext(ContextType.Domain,domainName), groupName);
+            }
+        }
+
+        /// <summary>
+        /// Returns the Principal object for a given name
+        /// </summary>
+        /// <param name="domainName">Domain name to look under, if Empty the LocalMachine is assumed as the domain</param>
+        /// <param name="name"></param>
+        /// <returns>Principal Object if found, or null other wise</returns>
+        private static Principal GetPrincipal(string domainName, string name)
+        {
+            if (String.IsNullOrEmpty(domainName))
+            {
+                return Principal.FindByIdentity(new PrincipalContext(ContextType.Machine), name);
+            }
+            else
+            {
+                return Principal.FindByIdentity(new PrincipalContext(ContextType.Domain, domainName), name);
             }
         }
     }
diff --git a/src/test/msi/TestData/UtilExtensionGroupTests/ProductCommentFail/product_fail.wxs b/src/test/msi/TestData/UtilExtensionGroupTests/ProductCommentFail/product_fail.wxs
index 29b908da..4e70717f 100644
--- a/src/test/msi/TestData/UtilExtensionGroupTests/ProductCommentFail/product_fail.wxs
+++ b/src/test/msi/TestData/UtilExtensionGroupTests/ProductCommentFail/product_fail.wxs
@@ -8,7 +8,7 @@
         </ComponentGroup>
 
         <InstallExecuteSequence>
-            <Custom Action="CaFail" After="Wix4ConfigureGroups_X86" />
+            <Custom Action="CaFail" After="Wix6ConfigureGroups_X86" />
         </InstallExecuteSequence>
     </Fragment>
 
diff --git a/src/test/msi/TestData/UtilExtensionGroupTests/ProductFail/product_fail.wxs b/src/test/msi/TestData/UtilExtensionGroupTests/ProductFail/product_fail.wxs
index fb35bc1e..3013e5a0 100644
--- a/src/test/msi/TestData/UtilExtensionGroupTests/ProductFail/product_fail.wxs
+++ b/src/test/msi/TestData/UtilExtensionGroupTests/ProductFail/product_fail.wxs
@@ -11,7 +11,7 @@
         <Property Id="TEMPUSERNAME" Secure="yes" />
 
         <InstallExecuteSequence>
-            <Custom Action="CaFail" After="Wix4ConfigureGroups_X86" />
+            <Custom Action="CaFail" After="Wix6ConfigureGroups_X86" />
         </InstallExecuteSequence>
     </Fragment>
 
diff --git a/src/test/msi/TestData/UtilExtensionGroupTests/ProductNestedGroups/product.wxs b/src/test/msi/TestData/UtilExtensionGroupTests/ProductNestedGroups/product.wxs
index 191d605c..15328cb3 100644
--- a/src/test/msi/TestData/UtilExtensionGroupTests/ProductNestedGroups/product.wxs
+++ b/src/test/msi/TestData/UtilExtensionGroupTests/ProductNestedGroups/product.wxs
@@ -12,11 +12,11 @@
     </Fragment>
 
     <Fragment>
-        <util:Group Id="ADMIN" Name="Administrators" >
+        <util:Group Id="AUTH_USERS" Name="Authenticated Users" >
             <util:GroupRef Id="TEST_GROUP1" />
             <util:GroupRef Id="TEST_GROUP2" />
         </util:Group>
-        <util:Group Id="POWER_USERS" Name="Power Users" >
+        <util:Group Id="EVERYONE" Name="Everyone" >
             <util:GroupRef Id="TEST_GROUP1" />
         </util:Group>
 
@@ -26,8 +26,6 @@
             <util:Group Id="TEST_GROUP1" Name="testName1" Comment="Group1" CreateGroup="yes" RemoveOnUninstall="yes" />
 
             <util:Group Id="TEST_GROUP2" Name="testName2" Comment="Group2" RemoveOnUninstall="no" UpdateIfExists="yes" />
-
-            <util:Group Id="TEST_GROUP3" Name="testName3" Comment="Group3" />
         </Component>
     </Fragment>
 </Wix>
diff --git a/src/test/msi/WixToolsetTest.MsiE2E/UtilExtensionGroupTests.cs b/src/test/msi/WixToolsetTest.MsiE2E/UtilExtensionGroupTests.cs
index 796c4ecd..d7cf3168 100644
--- a/src/test/msi/WixToolsetTest.MsiE2E/UtilExtensionGroupTests.cs
+++ b/src/test/msi/WixToolsetTest.MsiE2E/UtilExtensionGroupTests.cs
@@ -256,11 +256,11 @@ namespace WixToolsetTest.MsiE2E
             productNestedGroups.InstallProduct(MSIExec.MSIExecReturnCode.SUCCESS);
 
             // Verify group nested membership
-            UserGroupVerifier.VerifyIsMemberOf(String.Empty, "Administrators", new string[] { "testName1", "testName2" });
-            UserGroupVerifier.VerifyIsMemberOf(String.Empty, "Power Users", new string[] { "testName1" });
+            UserGroupVerifier.VerifyIsMemberOf(String.Empty, "Authenticated Users", new string[] { "testName1", "testName2" });
+            UserGroupVerifier.VerifyIsMemberOf(String.Empty, "Everyone", new string[] { "testName1" });
 
-            UserGroupVerifier.VerifyIsNotMemberOf(String.Empty, "Administrators", new string[] { "testName3" });
-            UserGroupVerifier.VerifyIsNotMemberOf(String.Empty, "Power Users", new string[] { "testName2", "testName3" });
+            UserGroupVerifier.VerifyIsNotMemberOf(String.Empty, "Authenticated Users", new string[] { "testName3" });
+            UserGroupVerifier.VerifyIsNotMemberOf(String.Empty, "Everyone", new string[] { "testName2", "testName3" });
 
             // clean up
             UserGroupVerifier.DeleteLocalGroup("testName1");