Update Burn algorithm for picking elevated temp path to use SystemTemp.

26 files changed, 577 insertions, 87 deletions

diff --git a/src/api/burn/balutil/inc/balutil.h b/src/api/burn/balutil/inc/balutil.h
index 33f1a6de..3040cfe8 100644
--- a/src/api/burn/balutil/inc/balutil.h
+++ b/src/api/burn/balutil/inc/balutil.h
@@ -16,6 +16,7 @@ extern "C" {
 #define BalExitOnNullSource(d, p, x, e, f, ...) if (NULL == p) { x = e; BalLogError(x, f, __VA_ARGS__); ExitTraceSource(d, x, f, __VA_ARGS__); goto LExit; }
 #define BalExitOnNullWithLastErrorSource(d, p, x, f, ...) if (NULL == p) { DWORD Dutil_er = ::GetLastError(); x = HRESULT_FROM_WIN32(Dutil_er); if (!FAILED(x)) { x = E_FAIL; } BalLogError(x, f, __VA_ARGS__); ExitTraceSource(d, x, f, __VA_ARGS__); goto LExit; }
 #define BalExitWithLastErrorSource(d, x, f, ...) { DWORD Dutil_er = ::GetLastError(); x = HRESULT_FROM_WIN32(Dutil_er); if (!FAILED(x)) { x = E_FAIL; } BalLogError(x, f, __VA_ARGS__); ExitTraceSource(d, x, f, __VA_ARGS__); goto LExit; }
+#define BalExitOnWin32ErrorSource(d, e, x, f, ...) if (ERROR_SUCCESS != e) { x = HRESULT_FROM_WIN32(e); if (!FAILED(x)) { x = E_FAIL; } BalLogError(x, f, __VA_ARGS__); Dutil_RootFailure(__FILE__, __LINE__, x); ExitTraceSource(d, x, f, __VA_ARGS__); goto LExit; }
 #define BalExitOnOptionalXmlQueryFailureSource(d, x, b, f, ...) { { if (S_FALSE == x || E_NOTFOUND == x) { b = FALSE; x = S_OK; } else { b = SUCCEEDED(x); } }; BalExitOnRootFailureSource(d, x, f, __VA_ARGS__); }
 #define BalExitOnRequiredXmlQueryFailureSource(d, x, f, ...) { if (S_FALSE == x) { x = E_NOTFOUND; } BalExitOnRootFailureSource(d, x, f, __VA_ARGS__); }
 
@@ -26,6 +27,7 @@ extern "C" {
 #define BalExitOnNull(p, x, e, f, ...) BalExitOnNullSource(DUTIL_SOURCE_DEFAULT, p, x, e, f, __VA_ARGS__)
 #define BalExitOnNullWithLastError(p, x, f, ...) BalExitOnNullWithLastErrorSource(DUTIL_SOURCE_DEFAULT, p, x, f, __VA_ARGS__)
 #define BalExitWithLastError(x, f, ...) BalExitWithLastErrorSource(DUTIL_SOURCE_DEFAULT, x, f, __VA_ARGS__)
+#define BalExitOnWin32Error(e, x, f, ...) BalExitOnWin32ErrorSource(DUTIL_SOURCE_DEFAULT, e, x, f, __VA_ARGS__)
 #define BalExitOnOptionalXmlQueryFailure(x, b, f, ...) BalExitOnOptionalXmlQueryFailureSource(DUTIL_SOURCE_DEFAULT, x, b, f, __VA_ARGS__)
 #define BalExitOnRequiredXmlQueryFailure(x, f, ...) BalExitOnRequiredXmlQueryFailureSource(DUTIL_SOURCE_DEFAULT, x, f, __VA_ARGS__)
 
diff --git a/src/api/burn/bextutil/inc/bextutil.h b/src/api/burn/bextutil/inc/bextutil.h
index e3edff01..356ccc47 100644
--- a/src/api/burn/bextutil/inc/bextutil.h
+++ b/src/api/burn/bextutil/inc/bextutil.h
@@ -16,6 +16,7 @@ extern "C" {
 #define BextExitOnNullSource(d, p, x, e, f, ...) if (NULL == p) { x = e; BextLogError(x, f, __VA_ARGS__); ExitTraceSource(d, x, f, __VA_ARGS__); goto LExit; }
 #define BextExitOnNullWithLastErrorSource(d, p, x, f, ...) if (NULL == p) { DWORD Dutil_er = ::GetLastError(); x = HRESULT_FROM_WIN32(Dutil_er); if (!FAILED(x)) { x = E_FAIL; } BextLogError(x, f, __VA_ARGS__); ExitTraceSource(d, x, f, __VA_ARGS__); goto LExit; }
 #define BextExitWithLastErrorSource(d, x, f, ...) { DWORD Dutil_er = ::GetLastError(); x = HRESULT_FROM_WIN32(Dutil_er); if (!FAILED(x)) { x = E_FAIL; } BextLogError(x, f, __VA_ARGS__); ExitTraceSource(d, x, f, __VA_ARGS__); goto LExit; }
+#define BextExitOnWin32ErrorSource(d, e, x, f, ...) if (ERROR_SUCCESS != e) { x = HRESULT_FROM_WIN32(e); if (!FAILED(x)) { x = E_FAIL; } BextLogError(x, f, __VA_ARGS__); Dutil_RootFailure(__FILE__, __LINE__, x); ExitTraceSource(d, x, f, __VA_ARGS__); goto LExit; }
 #define BextExitOnOptionalXmlQueryFailureSource(d, x, b, f, ...) { { if (S_FALSE == x || E_NOTFOUND == x) { b = FALSE; x = S_OK; } else { b = SUCCEEDED(x); } }; BextExitOnRootFailureSource(d, x, f, __VA_ARGS__); }
 #define BextExitOnRequiredXmlQueryFailureSource(d, x, f, ...) { if (S_FALSE == x) { x = E_NOTFOUND; } BextExitOnRootFailureSource(d, x, f, __VA_ARGS__); }
 
@@ -26,6 +27,7 @@ extern "C" {
 #define BextExitOnNull(p, x, e, f, ...) BextExitOnNullSource(DUTIL_SOURCE_DEFAULT, p, x, e, f, __VA_ARGS__)
 #define BextExitOnNullWithLastError(p, x, f, ...) BextExitOnNullWithLastErrorSource(DUTIL_SOURCE_DEFAULT, p, x, f, __VA_ARGS__)
 #define BextExitWithLastError(x, f, ...) BextExitWithLastErrorSource(DUTIL_SOURCE_DEFAULT, x, f, __VA_ARGS__)
+#define BextExitOnWin32Error(e, x, f, ...) BextExitOnWin32ErrorSource(DUTIL_SOURCE_DEFAULT, e, x, f, __VA_ARGS__)
 #define BextExitOnOptionalXmlQueryFailure(x, b, f, ...) BextExitOnOptionalXmlQueryFailureSource(DUTIL_SOURCE_DEFAULT, x, b, f, __VA_ARGS__)
 #define BextExitOnRequiredXmlQueryFailure(x, f, ...) BextExitOnRequiredXmlQueryFailureSource(DUTIL_SOURCE_DEFAULT, x, f, __VA_ARGS__)
 
diff --git a/src/burn/engine/cache.cpp b/src/burn/engine/cache.cpp
index 7fca8cc7..5eacb20d 100644
--- a/src/burn/engine/cache.cpp
+++ b/src/burn/engine/cache.cpp
@@ -1389,6 +1389,8 @@ static HRESULT CalculatePotentialBaseWorkingFolders(
     Assert(!pCache->rgsczPotentialBaseWorkingFolders && !pCache->cPotentialBaseWorkingFolders);
     HRESULT hr = S_OK;
     LPWSTR sczTemp = NULL;
+    LPWSTR sczPolicy = NULL;
+    BOOL fNeedsExpansion = FALSE;
 
     hr = MemEnsureArraySize(reinterpret_cast<LPVOID*>(&pCache->rgsczPotentialBaseWorkingFolders), 6, sizeof(LPWSTR), 6);
     ExitOnFailure(hr, "Failed to initialize array.");
@@ -1408,12 +1410,22 @@ static HRESULT CalculatePotentialBaseWorkingFolders(
     // but only use it if elevated because it should be secured against non-admin users.
     if (pInternalCommand->fInitiallyElevated)
     {
-        hr = PolcReadString(POLICY_BURN_REGISTRY_PATH, L"EngineWorkingDirectory", NULL, &sczTemp);
+        hr = PolcReadUnexpandedString(POLICY_BURN_REGISTRY_PATH, L"EngineWorkingDirectory", NULL, &fNeedsExpansion, &sczPolicy);
         ExitOnFailure(hr, "Failed to read EngineWorkingDirectory policy directory.");
 
-        if (sczTemp)
+        if (S_FALSE != hr)
         {
-            // PolcReadString is supposed to automatically expand REG_EXPAND_SZ values.
+            if (fNeedsExpansion)
+            {
+                hr = EnvExpandEnvironmentStringsForUser(NULL, sczPolicy, &sczTemp, NULL);
+                ExitOnFailure(hr, "Failed to expand EngineWorkingDirectory policy directory.");
+            }
+            else
+            {
+                sczTemp = sczPolicy;
+                sczPolicy = NULL;
+            }
+
             pCache->rgsczPotentialBaseWorkingFolders[pCache->cPotentialBaseWorkingFolders] = sczTemp;
             sczTemp = NULL;
             ++pCache->cPotentialBaseWorkingFolders;
@@ -1438,6 +1450,7 @@ static HRESULT CalculatePotentialBaseWorkingFolders(
 
 LExit:
     ReleaseStr(sczTemp);
+    ReleaseStr(sczPolicy);
 
     return hr;
 }
diff --git a/src/burn/engine/precomp.h b/src/burn/engine/precomp.h
index 19a6d48b..bc7046f6 100644
--- a/src/burn/engine/precomp.h
+++ b/src/burn/engine/precomp.h
@@ -31,6 +31,7 @@
 #include <certutil.h>
 #include <cryputil.h>
 #include <dirutil.h>
+#include <envutil.h>
 #include <fileutil.h>
 #include <guidutil.h>
 #include <logutil.h>
diff --git a/src/burn/stub/stub.vcxproj b/src/burn/stub/stub.vcxproj
index d73b9f49..0a2e1cae 100644
--- a/src/burn/stub/stub.vcxproj
+++ b/src/burn/stub/stub.vcxproj
@@ -55,14 +55,14 @@
 
   <PropertyGroup>
     <ProjectAdditionalIncludeDirectories>$(ProjectDir)..\engine\inc</ProjectAdditionalIncludeDirectories>
-    <ProjectAdditionalLinkLibraries>cabinet.lib;crypt32.lib;msi.lib;rpcrt4.lib;shlwapi.lib;wininet.lib;wintrust.lib;wuguid.lib;engine.res</ProjectAdditionalLinkLibraries>
+    <ProjectAdditionalLinkLibraries>cabinet.lib;crypt32.lib;msi.lib;rpcrt4.lib;shlwapi.lib;userenv.lib;wininet.lib;wintrust.lib;wuguid.lib;engine.res</ProjectAdditionalLinkLibraries>
   </PropertyGroup>
 
   <ItemDefinitionGroup>
     <Link>
       <SwapRunFromCD>true</SwapRunFromCD>
       <SwapRunFromNET>true</SwapRunFromNET>
-      <DelayLoadDLLs>cabinet.dll;crypt32.dll;msi.dll;shlwapi.dll;version.dll;wininet.dll;wintrust.dll</DelayLoadDLLs>
+      <DelayLoadDLLs>cabinet.dll;crypt32.dll;msi.dll;shlwapi.dll;userenv.dll;version.dll;wininet.dll;wintrust.dll</DelayLoadDLLs>
     </Link>
   </ItemDefinitionGroup>
 
diff --git a/src/burn/test/BurnUnitTest/BurnUnitTest.vcxproj b/src/burn/test/BurnUnitTest/BurnUnitTest.vcxproj
index b05666b2..e1a28712 100644
--- a/src/burn/test/BurnUnitTest/BurnUnitTest.vcxproj
+++ b/src/burn/test/BurnUnitTest/BurnUnitTest.vcxproj
@@ -40,7 +40,7 @@
 
   <PropertyGroup>
     <ProjectAdditionalIncludeDirectories>$(ProjectAdditionalIncludeDirectories);$(BurnGeneratedHeaderDirectory);..\..\engine;..\..\..\api\burn\WixToolset.BootstrapperCore.Native\inc;..\..\..\libs\dutil\WixToolset.Dutil\inc</ProjectAdditionalIncludeDirectories>
-    <ProjectAdditionalLinkLibraries>cabinet.lib;crypt32.lib;msi.lib;rpcrt4.lib;shlwapi.lib;wininet.lib;wintrust.lib;$(RootBuildFolder)libs\$(Configuration)\$(WixNativeSdkLibraryToolset)\$(PlatformTarget)\dutil.lib;engine.res</ProjectAdditionalLinkLibraries>
+    <ProjectAdditionalLinkLibraries>cabinet.lib;crypt32.lib;msi.lib;rpcrt4.lib;shlwapi.lib;userenv.lib;wininet.lib;wintrust.lib;$(RootBuildFolder)libs\$(Configuration)\$(WixNativeSdkLibraryToolset)\$(PlatformTarget)\dutil.lib;engine.res</ProjectAdditionalLinkLibraries>
   </PropertyGroup>
 
   <ItemGroup>
diff --git a/src/burn/test/BurnUnitTest/CacheTest.cpp b/src/burn/test/BurnUnitTest/CacheTest.cpp
index eb0b31ab..2bec05fe 100644
--- a/src/burn/test/BurnUnitTest/CacheTest.cpp
+++ b/src/burn/test/BurnUnitTest/CacheTest.cpp
@@ -92,6 +92,8 @@ namespace Bootstrapper
                 VerifyBaseWorkingFolder(L"B:\\TEST\\TMP\\", cache.rgsczPotentialBaseWorkingFolders[0]);
                 CacheUninitialize(&cache);
 
+                // First fallback is impractical to mock out - %windir%\SystemTemp on Win11 when running as SYSTEM.
+
                 hr = RegCreate(HKEY_LOCAL_MACHINE, L"SOFTWARE\\Policies\\WiX\\Burn", GENERIC_WRITE, &hkBurnPolicy);
                 NativeAssert::Succeeded(hr, "Failed to create Burn policy key.");
 
diff --git a/src/libs/dutil/WixToolset.DUtil/dutil.vcxproj b/src/libs/dutil/WixToolset.DUtil/dutil.vcxproj
index 9d057461..3100768d 100644
--- a/src/libs/dutil/WixToolset.DUtil/dutil.vcxproj
+++ b/src/libs/dutil/WixToolset.DUtil/dutil.vcxproj
@@ -65,6 +65,7 @@
       <PrecompiledHeader>Create</PrecompiledHeader>
       <DisableSpecificWarnings>4091;4458</DisableSpecificWarnings>
     </ClCompile>
+    <ClCompile Include="env2util.cpp" />
     <ClCompile Include="envutil.cpp" />
     <ClCompile Include="eseutil.cpp" />
     <ClCompile Include="file2utl.cpp" />
@@ -82,6 +83,7 @@
     <ClCompile Include="monutil.cpp" />
     <ClCompile Include="osutil.cpp" />
     <ClCompile Include="path2utl.cpp" />
+    <ClCompile Include="path3utl.cpp" />
     <ClCompile Include="pathutil.cpp" />
     <ClCompile Include="perfutil.cpp" />
     <ClCompile Include="polcutil.cpp" />
diff --git a/src/libs/dutil/WixToolset.DUtil/dutil.vcxproj.filters b/src/libs/dutil/WixToolset.DUtil/dutil.vcxproj.filters
index 556468b7..c966c965 100644
--- a/src/libs/dutil/WixToolset.DUtil/dutil.vcxproj.filters
+++ b/src/libs/dutil/WixToolset.DUtil/dutil.vcxproj.filters
@@ -66,6 +66,9 @@
     <ClCompile Include="dutil.cpp">
       <Filter>Source Files</Filter>
     </ClCompile>
+    <ClCompile Include="env2util.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
     <ClCompile Include="envutil.cpp">
       <Filter>Source Files</Filter>
     </ClCompile>
@@ -111,6 +114,9 @@
     <ClCompile Include="osutil.cpp">
       <Filter>Source Files</Filter>
     </ClCompile>
+    <ClCompile Include="path3utl.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
     <ClCompile Include="path2utl.cpp">
       <Filter>Source Files</Filter>
     </ClCompile>
diff --git a/src/libs/dutil/WixToolset.DUtil/env2util.cpp b/src/libs/dutil/WixToolset.DUtil/env2util.cpp
new file mode 100644
index 00000000..21bbd101
--- /dev/null
+++ b/src/libs/dutil/WixToolset.DUtil/env2util.cpp
@@ -0,0 +1,80 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+
+// Exit macros
+#define EnvExitOnLastError(x, s, ...) ExitOnLastErrorSource(DUTIL_SOURCE_ENVUTIL, x, s, __VA_ARGS__)
+#define EnvExitOnLastErrorDebugTrace(x, s, ...) ExitOnLastErrorDebugTraceSource(DUTIL_SOURCE_ENVUTIL, x, s, __VA_ARGS__)
+#define EnvExitWithLastError(x, s, ...) ExitWithLastErrorSource(DUTIL_SOURCE_ENVUTIL, x, s, __VA_ARGS__)
+#define EnvExitOnFailure(x, s, ...) ExitOnFailureSource(DUTIL_SOURCE_ENVUTIL, x, s, __VA_ARGS__)
+#define EnvExitOnRootFailure(x, s, ...) ExitOnRootFailureSource(DUTIL_SOURCE_ENVUTIL, x, s, __VA_ARGS__)
+#define EnvExitWithRootFailure(x, e, s, ...) ExitWithRootFailureSource(DUTIL_SOURCE_ENVUTIL, x, e, s, __VA_ARGS__)
+#define EnvExitOnFailureDebugTrace(x, s, ...) ExitOnFailureDebugTraceSource(DUTIL_SOURCE_ENVUTIL, x, s, __VA_ARGS__)
+#define EnvExitOnNull(p, x, e, s, ...) ExitOnNullSource(DUTIL_SOURCE_ENVUTIL, p, x, e, s, __VA_ARGS__)
+#define EnvExitOnNullWithLastError(p, x, s, ...) ExitOnNullWithLastErrorSource(DUTIL_SOURCE_ENVUTIL, p, x, s, __VA_ARGS__)
+#define EnvExitOnNullDebugTrace(p, x, e, s, ...)  ExitOnNullDebugTraceSource(DUTIL_SOURCE_ENVUTIL, p, x, e, s, __VA_ARGS__)
+#define EnvExitOnInvalidHandleWithLastError(p, x, s, ...) ExitOnInvalidHandleWithLastErrorSource(DUTIL_SOURCE_ENVUTIL, p, x, s, __VA_ARGS__)
+#define EnvExitOnWin32Error(e, x, s, ...) ExitOnWin32ErrorSource(DUTIL_SOURCE_ENVUTIL, e, x, s, __VA_ARGS__)
+#define EnvExitOnGdipFailure(g, x, s, ...) ExitOnGdipFailureSource(DUTIL_SOURCE_ENVUTIL, g, x, s, __VA_ARGS__)
+
+#define ENV2_GOOD_ENOUGH 64
+
+DAPI_(HRESULT) EnvExpandEnvironmentStringsForUser(
+    __in_opt HANDLE hToken,
+    __in LPCWSTR wzSource,
+    __out LPWSTR* psczExpanded,
+    __out_opt SIZE_T* pcchExpanded
+    )
+{
+    HRESULT hr = S_OK;
+    DWORD cchExpanded = 0;
+    SIZE_T cchMax = 0;
+    const DWORD dwMaxAttempts = 20;
+
+    if (*psczExpanded)
+    {
+        hr = StrMaxLength(*psczExpanded, &cchMax);
+        EnvExitOnFailure(hr, "Failed to get max length of input buffer.");
+
+        cchExpanded = (DWORD)min(DWORD_MAX, cchMax);
+    }
+    else
+    {
+        cchExpanded = ENV2_GOOD_ENOUGH;
+
+        hr = StrAlloc(psczExpanded, cchExpanded);
+        EnvExitOnFailure(hr, "Failed to allocate space for expanded path.");
+    }
+
+    for (DWORD i = 0; i < dwMaxAttempts; ++i)
+    {
+        if (::ExpandEnvironmentStringsForUserW(hToken, wzSource, *psczExpanded, cchExpanded))
+        {
+            break;
+        }
+
+        hr = HRESULT_FROM_WIN32(::GetLastError());
+        if (E_INSUFFICIENT_BUFFER != hr || (dwMaxAttempts - 1) == i)
+        {
+            EnvExitWithRootFailure(hr, hr, "Failed to expand environment variables in string: %ls", wzSource);
+        }
+
+        cchExpanded *= 2;
+
+        hr = StrAlloc(psczExpanded, cchExpanded);
+        EnvExitOnFailure(hr, "Failed to re-allocate more space for expanded path.");
+    }
+
+    if (pcchExpanded)
+    {
+        hr = ::StringCchLengthW(*psczExpanded, STRSAFE_MAX_LENGTH, reinterpret_cast<size_t*>(pcchExpanded));
+        EnvExitOnFailure(hr, "Failed to get max length of written input buffer.");
+
+        // Add 1 for null terminator.
+        *pcchExpanded += 1;
+    }
+
+LExit:
+    return hr;
+}
diff --git a/src/libs/dutil/WixToolset.DUtil/inc/envutil.h b/src/libs/dutil/WixToolset.DUtil/inc/envutil.h
index 8491b27b..4e4f6197 100644
--- a/src/libs/dutil/WixToolset.DUtil/inc/envutil.h
+++ b/src/libs/dutil/WixToolset.DUtil/inc/envutil.h
@@ -16,6 +16,17 @@ HRESULT DAPI EnvExpandEnvironmentStrings(
     __out_opt SIZE_T* pcchExpanded
     );
 
+/********************************************************************
+ EnvExpandEnvironmentStringsForUser - Wrapper for ::ExpandEnvironmentStringsForUser.
+
+ *******************************************************************/
+HRESULT DAPI EnvExpandEnvironmentStringsForUser(
+    __in_opt HANDLE hToken,
+    __in LPCWSTR wzSource,
+    __out LPWSTR* psczExpanded,
+    __out_opt SIZE_T* pcchExpanded
+    );
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/src/libs/dutil/WixToolset.DUtil/inc/pathutil.h b/src/libs/dutil/WixToolset.DUtil/inc/pathutil.h
index 875cfafb..f36e6ebc 100644
--- a/src/libs/dutil/WixToolset.DUtil/inc/pathutil.h
+++ b/src/libs/dutil/WixToolset.DUtil/inc/pathutil.h
@@ -205,6 +205,15 @@ DAPI_(HRESULT) PathGetTempPath(
     );
 
 /*******************************************************************
+ PathSystemWindowsSubdirectory - returns the path to the Windows folder
+    or a subdirectory of that folder that is backslash terminated.
+*******************************************************************/
+DAPI_(HRESULT) PathSystemWindowsSubdirectory(
+    __in_z_opt LPCWSTR wzSubdirectory,
+    __out_z LPWSTR* psczFullPath
+    );
+
+/*******************************************************************
  PathGetSystemTempPaths - returns the paths to system temp folders
     that are backslash terminated with higher preference first.
 *******************************************************************/
diff --git a/src/libs/dutil/WixToolset.DUtil/inc/polcutil.h b/src/libs/dutil/WixToolset.DUtil/inc/polcutil.h
index 13618043..7c873b80 100644
--- a/src/libs/dutil/WixToolset.DUtil/inc/polcutil.h
+++ b/src/libs/dutil/WixToolset.DUtil/inc/polcutil.h
@@ -34,6 +34,20 @@ HRESULT DAPI PolcReadString(
     __deref_out_z LPWSTR* pscz
     );
 
+/********************************************************************
+PolcReadUnexpandedString - reads a string from policy, without expanding it.
+
+NOTE: S_FALSE returned if policy not set.
+NOTE: out is set to default on S_FALSE or any error.
+********************************************************************/
+HRESULT DAPI PolcReadUnexpandedString(
+    __in_z LPCWSTR wzPolicyPath,
+    __in_z LPCWSTR wzPolicyName,
+    __in_z_opt LPCWSTR wzDefault,
+    __inout BOOL* pfNeedsExpansion,
+    __deref_out_z LPWSTR* pscz
+    );
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/src/libs/dutil/WixToolset.DUtil/inc/procutil.h b/src/libs/dutil/WixToolset.DUtil/inc/procutil.h
index 4f49313b..d5ab9242 100644
--- a/src/libs/dutil/WixToolset.DUtil/inc/procutil.h
+++ b/src/libs/dutil/WixToolset.DUtil/inc/procutil.h
@@ -18,6 +18,16 @@ HRESULT DAPI ProcElevated(
     __out BOOL* pfElevated
     );
 
+HRESULT DAPI ProcSystem(
+    __in HANDLE hProcess,
+    __out BOOL* pfSystem
+    );
+
+HRESULT DAPI ProcTokenUser(
+    __in HANDLE hProcess,
+    __out TOKEN_USER** ppTokenUser
+    );
+
 HRESULT DAPI ProcWow64(
     __in HANDLE hProcess,
     __out BOOL* pfWow64
diff --git a/src/libs/dutil/WixToolset.DUtil/path2utl.cpp b/src/libs/dutil/WixToolset.DUtil/path2utl.cpp
index 9e48f9d5..c6ff608c 100644
--- a/src/libs/dutil/WixToolset.DUtil/path2utl.cpp
+++ b/src/libs/dutil/WixToolset.DUtil/path2utl.cpp
@@ -246,3 +246,41 @@ LExit:
     ReleaseStr(sczCanonicalizedDirectory);
     return hr;
 }
+
+
+DAPI_(HRESULT) PathSystemWindowsSubdirectory(
+    __in_z_opt LPCWSTR wzSubdirectory,
+    __out_z LPWSTR* psczFullPath
+    )
+{
+    HRESULT hr = S_OK;
+    WCHAR wzTempPath[MAX_PATH + 1] = { };
+    DWORD cch = 0;
+
+    cch = ::GetSystemWindowsDirectoryW(wzTempPath, countof(wzTempPath));
+    if (!cch)
+    {
+        PathExitWithLastError(hr, "Failed to get Windows directory path.");
+    }
+    else if (cch >= countof(wzTempPath))
+    {
+        PathExitWithRootFailure(hr, E_INSUFFICIENT_BUFFER, "Windows directory path too long.");
+    }
+
+    if (wzSubdirectory)
+    {
+        hr = PathConcatRelativeToBase(wzTempPath, wzSubdirectory, psczFullPath);
+        PathExitOnFailure(hr, "Failed to concat subdirectory on Windows directory path.");
+    }
+    else
+    {
+        hr = StrAllocString(psczFullPath, wzTempPath, 0);
+        PathExitOnFailure(hr, "Failed to copy Windows directory path.");
+    }
+
+    hr = PathBackslashTerminate(psczFullPath);
+    PathExitOnFailure(hr, "Failed to terminate Windows directory path with backslash.");
+
+LExit:
+    return hr;
+}
diff --git a/src/libs/dutil/WixToolset.DUtil/path3utl.cpp b/src/libs/dutil/WixToolset.DUtil/path3utl.cpp
new file mode 100644
index 00000000..cb6ce6d5
--- /dev/null
+++ b/src/libs/dutil/WixToolset.DUtil/path3utl.cpp
@@ -0,0 +1,143 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+
+// Exit macros
+#define PathExitOnLastError(x, s, ...) ExitOnLastErrorSource(DUTIL_SOURCE_PATHUTIL, x, s, __VA_ARGS__)
+#define PathExitOnLastErrorDebugTrace(x, s, ...) ExitOnLastErrorDebugTraceSource(DUTIL_SOURCE_PATHUTIL, x, s, __VA_ARGS__)
+#define PathExitWithLastError(x, s, ...) ExitWithLastErrorSource(DUTIL_SOURCE_PATHUTIL, x, s, __VA_ARGS__)
+#define PathExitOnFailure(x, s, ...) ExitOnFailureSource(DUTIL_SOURCE_PATHUTIL, x, s, __VA_ARGS__)
+#define PathExitOnRootFailure(x, s, ...) ExitOnRootFailureSource(DUTIL_SOURCE_PATHUTIL, x, s, __VA_ARGS__)
+#define PathExitWithRootFailure(x, e, s, ...) ExitWithRootFailureSource(DUTIL_SOURCE_PATHUTIL, x, e, s, __VA_ARGS__)
+#define PathExitOnFailureDebugTrace(x, s, ...) ExitOnFailureDebugTraceSource(DUTIL_SOURCE_PATHUTIL, x, s, __VA_ARGS__)
+#define PathExitOnNull(p, x, e, s, ...) ExitOnNullSource(DUTIL_SOURCE_PATHUTIL, p, x, e, s, __VA_ARGS__)
+#define PathExitOnNullWithLastError(p, x, s, ...) ExitOnNullWithLastErrorSource(DUTIL_SOURCE_PATHUTIL, p, x, s, __VA_ARGS__)
+#define PathExitOnNullDebugTrace(p, x, e, s, ...)  ExitOnNullDebugTraceSource(DUTIL_SOURCE_PATHUTIL, p, x, e, s, __VA_ARGS__)
+#define PathExitOnInvalidHandleWithLastError(p, x, s, ...) ExitOnInvalidHandleWithLastErrorSource(DUTIL_SOURCE_PATHUTIL, p, x, s, __VA_ARGS__)
+#define PathExitOnWin32Error(e, x, s, ...) ExitOnWin32ErrorSource(DUTIL_SOURCE_PATHUTIL, e, x, s, __VA_ARGS__)
+#define PathExitOnGdipFailure(g, x, s, ...) ExitOnGdipFailureSource(DUTIL_SOURCE_PATHUTIL, g, x, s, __VA_ARGS__)
+
+static HRESULT GetTempPathFromSystemEnvironmentVariable(
+    __in HKEY hKey,
+    __in_z LPCWSTR wzName,
+    __out_z LPWSTR* psczPath
+    );
+
+DAPI_(HRESULT) PathGetSystemTempPaths(
+    __inout_z LPWSTR** prgsczSystemTempPaths,
+    __inout DWORD* pcSystemTempPaths
+    )
+{
+    HRESULT hr = S_OK;
+    HMODULE hModule = NULL;
+    BOOL fSystem = FALSE;
+    HKEY hKey = NULL;
+    LPWSTR sczTemp = NULL;
+
+    // Follow documented precedence rules for SystemTemp/%TMP%/%TEMP% from ::GetTempPath2.
+    hr = LoadSystemLibrary(L"kernel32.dll", &hModule);
+    PathExitOnFailure(hr, "Failed to load kernel32.dll");
+
+    // The SystemTemp folder was added at the same time as ::GetTempPath2.
+    if (::GetProcAddress(hModule, "GetTempPath2W"))
+    {
+        hr = ProcSystem(::GetCurrentProcess(), &fSystem);
+        PathExitOnFailure(hr, "Failed to check if running as system.");
+
+        if (fSystem)
+        {
+            hr = PathSystemWindowsSubdirectory(L"SystemTemp", &sczTemp);
+            PathExitOnFailure(hr, "Failed to get system Windows subdirectory path SystemTemp.");
+
+            hr = MemEnsureArraySizeForNewItems(reinterpret_cast<LPVOID*>(prgsczSystemTempPaths), *pcSystemTempPaths, 1, sizeof(LPWSTR), 4);
+            PathExitOnFailure(hr, "Failed to ensure array size for Windows\\SystemTemp value.");
+
+            (*prgsczSystemTempPaths)[*pcSystemTempPaths] = sczTemp;
+            sczTemp = NULL;
+            *pcSystemTempPaths += 1;
+        }
+    }
+
+    // There is no documented API to get system environment variables, so read them from the registry.
+    hr = RegOpen(HKEY_LOCAL_MACHINE, L"System\\CurrentControlSet\\Control\\Session Manager\\Environment", KEY_READ, &hKey);
+    if (E_FILENOTFOUND != hr)
+    {
+        PathExitOnFailure(hr, "Failed to open system environment registry key.");
+
+        hr = GetTempPathFromSystemEnvironmentVariable(hKey, L"TMP", &sczTemp);
+        PathExitOnFailure(hr, "Failed to get temp path from system TMP.");
+
+        if (S_FALSE != hr)
+        {
+            hr = MemEnsureArraySizeForNewItems(reinterpret_cast<LPVOID*>(prgsczSystemTempPaths), *pcSystemTempPaths, 1, sizeof(LPWSTR), 3);
+            PathExitOnFailure(hr, "Failed to ensure array size for system TMP value.");
+
+            (*prgsczSystemTempPaths)[*pcSystemTempPaths] = sczTemp;
+            sczTemp = NULL;
+            *pcSystemTempPaths += 1;
+        }
+
+        hr = GetTempPathFromSystemEnvironmentVariable(hKey, L"TEMP", &sczTemp);
+        PathExitOnFailure(hr, "Failed to get temp path from system TEMP.");
+
+        if (S_FALSE != hr)
+        {
+            hr = MemEnsureArraySizeForNewItems(reinterpret_cast<LPVOID*>(prgsczSystemTempPaths), *pcSystemTempPaths, 1, sizeof(LPWSTR), 2);
+            PathExitOnFailure(hr, "Failed to ensure array size for system TEMP value.");
+
+            (*prgsczSystemTempPaths)[*pcSystemTempPaths] = sczTemp;
+            sczTemp = NULL;
+            *pcSystemTempPaths += 1;
+        }
+    }
+
+    hr = PathSystemWindowsSubdirectory(L"TEMP", &sczTemp);
+    PathExitOnFailure(hr, "Failed to get system Windows subdirectory path TEMP.");
+
+    hr = MemEnsureArraySizeForNewItems(reinterpret_cast<LPVOID*>(prgsczSystemTempPaths), *pcSystemTempPaths, 1, sizeof(LPWSTR), 1);
+    PathExitOnFailure(hr, "Failed to ensure array size for Windows\\TEMP value.");
+
+    (*prgsczSystemTempPaths)[*pcSystemTempPaths] = sczTemp;
+    sczTemp = NULL;
+    *pcSystemTempPaths += 1;
+
+LExit:
+    ReleaseRegKey(hKey);
+    ReleaseStr(sczTemp);
+
+    return hr;
+}
+
+static HRESULT GetTempPathFromSystemEnvironmentVariable(
+    __in HKEY hKey,
+    __in_z LPCWSTR wzName,
+    __out_z LPWSTR* psczPath
+    )
+{
+    HRESULT hr = S_OK;
+    LPWSTR sczValue = NULL;
+    BOOL fNeedsExpansion = FALSE;
+
+    // Read the value unexpanded so that it can be expanded with system environment variables.
+    hr = RegReadUnexpandedString(hKey, wzName, &fNeedsExpansion, &sczValue);
+    if (E_FILENOTFOUND == hr)
+    {
+        ExitFunction1(hr = S_FALSE);
+    }
+    PathExitOnFailure(hr, "Failed to get system '%ls' value.", wzName);
+
+    if (fNeedsExpansion)
+    {
+        hr = EnvExpandEnvironmentStringsForUser(NULL, sczValue, psczPath, NULL);
+        PathExitOnFailure(hr, "Failed to expand environment variables for system in string: %ls", sczValue);
+    }
+
+    hr = PathBackslashTerminate(psczPath);
+    PathExitOnFailure(hr, "Failed to backslash terminate system '%ls' value.", wzName);
+
+LExit:
+    ReleaseStr(sczValue);
+
+    return hr;
+}
diff --git a/src/libs/dutil/WixToolset.DUtil/pathutil.cpp b/src/libs/dutil/WixToolset.DUtil/pathutil.cpp
index becfc67e..0e2a5dec 100644
--- a/src/libs/dutil/WixToolset.DUtil/pathutil.cpp
+++ b/src/libs/dutil/WixToolset.DUtil/pathutil.cpp
@@ -894,86 +894,6 @@ LExit:
 }
 
 
-DAPI_(HRESULT) PathGetSystemTempPaths(
-    __inout_z LPWSTR** prgsczSystemTempPaths,
-    __inout DWORD* pcSystemTempPaths
-    )
-{
-    HRESULT hr = S_OK;
-    HKEY hKey = NULL;
-    LPWSTR sczTemp = NULL;
-    WCHAR wzTempPath[MAX_PATH + 1] = { };
-    DWORD cch = 0;
-
-    // There is no documented API to get system environment variables, so read them from the registry.
-    hr = RegOpen(HKEY_LOCAL_MACHINE, L"System\\CurrentControlSet\\Control\\Session Manager\\Environment", KEY_READ, &hKey);
-    if (E_FILENOTFOUND != hr)
-    {
-        PathExitOnFailure(hr, "Failed to open system environment registry key.");
-
-        // Follow documented precedence rules for TMP/TEMP from ::GetTempPath.
-        // TODO: values will be expanded with the current environment variables instead of the system environment variables.
-        hr = RegReadString(hKey, L"TMP", &sczTemp);
-        if (E_FILENOTFOUND != hr)
-        {
-            PathExitOnFailure(hr, "Failed to get system TMP value.");
-
-            hr = PathBackslashTerminate(&sczTemp);
-            PathExitOnFailure(hr, "Failed to backslash terminate system TMP value.");
-
-            hr = MemEnsureArraySizeForNewItems(reinterpret_cast<LPVOID*>(prgsczSystemTempPaths), *pcSystemTempPaths, 1, sizeof(LPWSTR), 3);
-            PathExitOnFailure(hr, "Failed to ensure array size for system TMP value.");
-
-            (*prgsczSystemTempPaths)[*pcSystemTempPaths] = sczTemp;
-            sczTemp = NULL;
-            *pcSystemTempPaths += 1;
-        }
-
-        hr = RegReadString(hKey, L"TEMP", &sczTemp);
-        if (E_FILENOTFOUND != hr)
-        {
-            PathExitOnFailure(hr, "Failed to get system TEMP value.");
-
-            hr = PathBackslashTerminate(&sczTemp);
-            PathExitOnFailure(hr, "Failed to backslash terminate system TEMP value.");
-
-            hr = MemEnsureArraySizeForNewItems(reinterpret_cast<LPVOID*>(prgsczSystemTempPaths), *pcSystemTempPaths, 1, sizeof(LPWSTR), 2);
-            PathExitOnFailure(hr, "Failed to ensure array size for system TEMP value.");
-
-            (*prgsczSystemTempPaths)[*pcSystemTempPaths] = sczTemp;
-            sczTemp = NULL;
-            *pcSystemTempPaths += 1;
-        }
-    }
-
-    cch = ::GetSystemWindowsDirectoryW(wzTempPath, countof(wzTempPath));
-    if (!cch)
-    {
-        PathExitWithLastError(hr, "Failed to get Windows directory path.");
-    }
-    else if (cch >= countof(wzTempPath))
-    {
-        PathExitWithRootFailure(hr, E_INSUFFICIENT_BUFFER, "Windows directory path too long.");
-    }
-
-    hr = PathConcat(wzTempPath, L"TEMP\\", &sczTemp);
-    PathExitOnFailure(hr, "Failed to concat Temp directory on Windows directory path.");
-
-    hr = MemEnsureArraySizeForNewItems(reinterpret_cast<LPVOID*>(prgsczSystemTempPaths), *pcSystemTempPaths, 1, sizeof(LPWSTR), 1);
-    PathExitOnFailure(hr, "Failed to ensure array size for Windows\\TEMP value.");
-
-    (*prgsczSystemTempPaths)[*pcSystemTempPaths] = sczTemp;
-    sczTemp = NULL;
-    *pcSystemTempPaths += 1;
-
-LExit:
-    ReleaseRegKey(hKey);
-    ReleaseStr(sczTemp);
-
-    return hr;
-}
-
-
 DAPI_(HRESULT) PathGetKnownFolder(
     __in int csidl,
     __out LPWSTR* psczKnownFolder
diff --git a/src/libs/dutil/WixToolset.DUtil/polcutil.cpp b/src/libs/dutil/WixToolset.DUtil/polcutil.cpp
index 1fdfa18c..c2247bc1 100644
--- a/src/libs/dutil/WixToolset.DUtil/polcutil.cpp
+++ b/src/libs/dutil/WixToolset.DUtil/polcutil.cpp
@@ -102,6 +102,49 @@ LExit:
     return hr;
 }
 
+extern "C" HRESULT DAPI PolcReadUnexpandedString(
+    __in_z LPCWSTR wzPolicyPath,
+    __in_z LPCWSTR wzPolicyName,
+    __in_z_opt LPCWSTR wzDefault,
+    __inout BOOL* pfNeedsExpansion,
+    __deref_out_z LPWSTR* pscz
+    )
+{
+    HRESULT hr = S_OK;
+    HKEY hk = NULL;
+
+    hr = OpenPolicyKey(wzPolicyPath, &hk);
+    if (E_FILENOTFOUND == hr || E_PATHNOTFOUND == hr)
+    {
+        ExitFunction1(hr = S_FALSE);
+    }
+    PolcExitOnFailure(hr, "Failed to open policy key: %ls", wzPolicyPath);
+
+    hr = RegReadUnexpandedString(hk, wzPolicyName, pfNeedsExpansion, pscz);
+    if (E_FILENOTFOUND == hr || E_PATHNOTFOUND == hr)
+    {
+        ExitFunction1(hr = S_FALSE);
+    }
+    PolcExitOnFailure(hr, "Failed to open policy key: %ls, name: %ls", wzPolicyPath, wzPolicyName);
+
+LExit:
+    ReleaseRegKey(hk);
+
+    if (S_FALSE == hr || FAILED(hr))
+    {
+        if (NULL == wzDefault)
+        {
+            ReleaseNullStr(*pscz);
+        }
+        else
+        {
+            hr = StrAllocString(pscz, wzDefault, 0);
+        }
+    }
+
+    return hr;
+}
+
 
 // internal functions
 
diff --git a/src/libs/dutil/WixToolset.DUtil/procutil.cpp b/src/libs/dutil/WixToolset.DUtil/procutil.cpp
index a3131b7a..340a0cda 100644
--- a/src/libs/dutil/WixToolset.DUtil/procutil.cpp
+++ b/src/libs/dutil/WixToolset.DUtil/procutil.cpp
@@ -9,6 +9,7 @@
 #define ProcExitWithLastError(x, s, ...) ExitWithLastErrorSource(DUTIL_SOURCE_PROCUTIL, x, s, __VA_ARGS__)
 #define ProcExitOnFailure(x, s, ...) ExitOnFailureSource(DUTIL_SOURCE_PROCUTIL, x, s, __VA_ARGS__)
 #define ProcExitOnRootFailure(x, s, ...) ExitOnRootFailureSource(DUTIL_SOURCE_PROCUTIL, x, s, __VA_ARGS__)
+#define ProcExitWithRootFailure(x, e, s, ...) ExitWithRootFailureSource(DUTIL_SOURCE_PROCUTIL, x, e, s, __VA_ARGS__)
 #define ProcExitOnFailureDebugTrace(x, s, ...) ExitOnFailureDebugTraceSource(DUTIL_SOURCE_PROCUTIL, x, s, __VA_ARGS__)
 #define ProcExitOnNull(p, x, e, s, ...) ExitOnNullSource(DUTIL_SOURCE_PROCUTIL, p, x, e, s, __VA_ARGS__)
 #define ProcExitOnNullWithLastError(p, x, s, ...) ExitOnNullWithLastErrorSource(DUTIL_SOURCE_PROCUTIL, p, x, s, __VA_ARGS__)
@@ -75,6 +76,73 @@ LExit:
     return hr;
 }
 
+extern "C" HRESULT DAPI ProcSystem(
+    __in HANDLE hProcess,
+    __out BOOL* pfSystem
+    )
+{
+    HRESULT hr = S_OK;
+    TOKEN_USER* pTokenUser = NULL;
+
+    hr = ProcTokenUser(hProcess, &pTokenUser);
+    ProcExitOnFailure(hr, "Failed to get TokenUser from process token.");
+
+    *pfSystem = ::IsWellKnownSid(pTokenUser->User.Sid, WinLocalSystemSid);
+
+LExit:
+    ReleaseMem(pTokenUser);
+
+    return hr;
+}
+
+extern "C" HRESULT DAPI ProcTokenUser(
+    __in HANDLE hProcess,
+    __out TOKEN_USER** ppTokenUser
+    )
+{
+    HRESULT hr = S_OK;
+    DWORD er = ERROR_SUCCESS;
+    HANDLE hToken = NULL;
+    TOKEN_USER* pTokenUser = NULL;
+    DWORD cbToken = 0;
+
+    if (!::OpenProcessToken(hProcess, TOKEN_QUERY, &hToken))
+    {
+        ProcExitWithLastError(hr, "Failed to open process token.");
+    }
+
+    if (::GetTokenInformation(hToken, TokenUser, pTokenUser, 0, &cbToken))
+    {
+        er = ERROR_SUCCESS;
+    }
+    else
+    {
+        er = ::GetLastError();
+    }
+
+    if (er != ERROR_INSUFFICIENT_BUFFER)
+    {
+        ProcExitOnWin32Error(er, hr, "Failed to get user from process token size.");
+    }
+
+    pTokenUser = reinterpret_cast<TOKEN_USER*>(MemAlloc(cbToken, TRUE));
+    ProcExitOnNull(pTokenUser, hr, E_OUTOFMEMORY, "Failed to allocate token information.");
+
+    if (!::GetTokenInformation(hToken, TokenUser, pTokenUser, cbToken, &cbToken))
+    {
+        ProcExitWithLastError(hr, "Failed to get user from process token.");
+    }
+
+    *ppTokenUser = pTokenUser;
+    pTokenUser = NULL;
+
+LExit:
+    ReleaseMem(pTokenUser);
+    ReleaseHandle(hToken);
+
+    return hr;
+}
+
 extern "C" HRESULT DAPI ProcWow64(
     __in HANDLE hProcess,
     __out BOOL* pfWow64
diff --git a/src/libs/dutil/test/DUtilUnitTest/DUtilUnitTest.vcxproj b/src/libs/dutil/test/DUtilUnitTest/DUtilUnitTest.vcxproj
index ee9f505e..a1f13239 100644
--- a/src/libs/dutil/test/DUtilUnitTest/DUtilUnitTest.vcxproj
+++ b/src/libs/dutil/test/DUtilUnitTest/DUtilUnitTest.vcxproj
@@ -40,7 +40,7 @@
 
   <PropertyGroup>
     <ProjectAdditionalIncludeDirectories>..\..\WixToolset.DUtil\inc</ProjectAdditionalIncludeDirectories>
-    <ProjectAdditionalLinkLibraries>rpcrt4.lib;Mpr.lib;Ws2_32.lib;shlwapi.lib;urlmon.lib;wininet.lib</ProjectAdditionalLinkLibraries>
+    <ProjectAdditionalLinkLibraries>rpcrt4.lib;Mpr.lib;Ws2_32.lib;shlwapi.lib;urlmon.lib;userenv.lib;wininet.lib</ProjectAdditionalLinkLibraries>
   </PropertyGroup>
 
   <ItemGroup>
@@ -57,6 +57,7 @@
     <ClCompile Include="MemUtilTest.cpp" />
     <ClCompile Include="MonUtilTest.cpp" />
     <ClCompile Include="PathUtilTest.cpp" />
+    <ClCompile Include="ProcUtilTest.cpp" />
     <ClCompile Include="precomp.cpp">
       <PrecompiledHeader>Create</PrecompiledHeader>
       <!-- Warnings from referencing netstandard dlls -->
diff --git a/src/libs/dutil/test/DUtilUnitTest/DUtilUnitTest.vcxproj.filters b/src/libs/dutil/test/DUtilUnitTest/DUtilUnitTest.vcxproj.filters
index bcda6df0..cb0c8a73 100644
--- a/src/libs/dutil/test/DUtilUnitTest/DUtilUnitTest.vcxproj.filters
+++ b/src/libs/dutil/test/DUtilUnitTest/DUtilUnitTest.vcxproj.filters
@@ -54,6 +54,9 @@
     <ClCompile Include="PathUtilTest.cpp">
       <Filter>Source Files</Filter>
     </ClCompile>
+    <ClCompile Include="ProcUtilTest.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
     <ClCompile Include="precomp.cpp">
       <Filter>Source Files</Filter>
     </ClCompile>
diff --git a/src/libs/dutil/test/DUtilUnitTest/EnvUtilTests.cpp b/src/libs/dutil/test/DUtilUnitTest/EnvUtilTests.cpp
index 76dfa774..94b9ab8e 100644
--- a/src/libs/dutil/test/DUtilUnitTest/EnvUtilTests.cpp
+++ b/src/libs/dutil/test/DUtilUnitTest/EnvUtilTests.cpp
@@ -3,8 +3,10 @@
 #include "precomp.h"
 
 using namespace System;
+using namespace System::Collections;
 using namespace Xunit;
 using namespace WixBuildTools::TestSupport;
+using namespace WixBuildTools::TestSupport::XunitExtensions;
 
 namespace DutilTests
 {
@@ -46,5 +48,48 @@ namespace DutilTests
                 ReleaseStr(sczExpanded);
             }
         }
+
+        [SkippableFact]
+        void EnvExpandEnvironmentStringsForUserTest()
+        {
+            HRESULT hr = S_OK;
+            LPWSTR sczExpanded = NULL;
+            SIZE_T cchExpanded = 0;
+            String^ variableName = nullptr;
+            String^ variableValue = nullptr;
+
+            // Find a system environment variable that doesn't have variables in its value;
+            for each (DictionaryEntry^ entry in Environment::GetEnvironmentVariables(EnvironmentVariableTarget::Machine))
+            {
+                variableValue = (String^)entry->Value;
+                if (variableValue->Contains("%"))
+                {
+                    continue;
+                }
+
+                variableName = (String^)entry->Key;
+                break;
+            }
+
+            if (nullptr == variableName)
+            {
+                WixAssert::Skip("No suitable system environment variables");
+            }
+
+            pin_ptr<const wchar_t> wzUnexpanded = PtrToStringChars("%" + variableName + "%_%USERNAME%");
+            String^ expandedValue = variableValue + "_SYSTEM";
+
+            try
+            {
+                hr = EnvExpandEnvironmentStringsForUser(NULL, wzUnexpanded, &sczExpanded, &cchExpanded);
+                NativeAssert::Succeeded(hr, "Failed to expand %ls.", wzUnexpanded);
+                WixAssert::StringEqual(expandedValue, gcnew String(sczExpanded), false);
+                NativeAssert::Equal<SIZE_T>(expandedValue->Length + 1, cchExpanded);
+            }
+            finally
+            {
+                ReleaseStr(sczExpanded);
+            }
+        }
     };
 }
diff --git a/src/libs/dutil/test/DUtilUnitTest/ProcUtilTest.cpp b/src/libs/dutil/test/DUtilUnitTest/ProcUtilTest.cpp
new file mode 100644
index 00000000..297d90f4
--- /dev/null
+++ b/src/libs/dutil/test/DUtilUnitTest/ProcUtilTest.cpp
@@ -0,0 +1,42 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+using namespace System;
+using namespace System::Security::Principal;
+using namespace Xunit;
+using namespace WixBuildTools::TestSupport;
+
+namespace DutilTests
+{
+    public ref class ProcUtil
+    {
+    public:
+        [Fact]
+        void ProcTokenUserTest()
+        {
+            HRESULT hr = S_OK;
+            TOKEN_USER* pTokenUser = NULL;
+            LPWSTR sczSid = NULL;
+
+            try
+            {
+                hr = ProcTokenUser(::GetCurrentProcess(), &pTokenUser);
+                NativeAssert::Succeeded(hr, "Failed to get TokenUser for current process.");
+
+                if (!::ConvertSidToStringSidW(pTokenUser->User.Sid, &sczSid))
+                {
+                    hr = HRESULT_FROM_WIN32(::GetLastError());
+                    NativeAssert::Succeeded(hr, "Failed to get string SID from TokenUser SID.");
+                }
+
+                Assert::Equal<String^>(WindowsIdentity::GetCurrent()->User->Value, gcnew String(sczSid));
+            }
+            finally
+            {
+                ReleaseMem(pTokenUser);
+                ReleaseStr(sczSid);
+            }
+        }
+    };
+}
diff --git a/src/libs/dutil/test/DUtilUnitTest/precomp.h b/src/libs/dutil/test/DUtilUnitTest/precomp.h
index bc628816..ac57cdd4 100644
--- a/src/libs/dutil/test/DUtilUnitTest/precomp.h
+++ b/src/libs/dutil/test/DUtilUnitTest/precomp.h
@@ -5,6 +5,7 @@
 #include <windows.h>
 #include <strsafe.h>
 #include <ShlObj.h>
+#include <sddl.h>
 
 // Include error.h before dutil.h
 #include <dutilsources.h>
@@ -21,6 +22,7 @@
 #include <iniutil.h>
 #include <memutil.h>
 #include <pathutil.h>
+#include <procutil.h>
 #include <strutil.h>
 #include <monutil.h>
 #include <regutil.h>
diff --git a/src/test/burn/TestData/Manual/BafThmutilTesting/BafThmUtilTesting.cpp b/src/test/burn/TestData/Manual/BafThmutilTesting/BafThmUtilTesting.cpp
index 3cf994fc..bc942dc8 100644
--- a/src/test/burn/TestData/Manual/BafThmutilTesting/BafThmUtilTesting.cpp
+++ b/src/test/burn/TestData/Manual/BafThmutilTesting/BafThmUtilTesting.cpp
@@ -30,6 +30,7 @@ static THEME_ASSIGN_CONTROL_ID vrgInitControls[] = {
     { BAFTHMUTILTESTING_CONTROL_PROGRESSBAR_STANDARD, L"StandardProgressBar" },
 };
 
+static HRESULT LogUserSid();
 static void CALLBACK BafThmUtilTestingTraceError(
     __in_z LPCSTR szFile,
     __in int iLine,
@@ -494,6 +495,8 @@ HRESULT WINAPI CreateBAFunctions(
     pResults->pvBAFunctionsProcContext = pBAFunctions;
     pBAFunctions = NULL;
 
+    LogUserSid();
+
 LExit:
     ReleaseObject(pBAFunctions);
     ReleaseObject(pEngine);
@@ -501,6 +504,33 @@ LExit:
     return hr;
 }
 
+static HRESULT LogUserSid()
+{
+    HRESULT hr = S_OK;
+    TOKEN_USER* pTokenUser = NULL;
+    LPWSTR sczSid = NULL;
+
+    hr = ProcTokenUser(::GetCurrentProcess(), &pTokenUser);
+    BalExitOnFailure(hr, "Failed to get user from process token.");
+
+    if (!::ConvertSidToStringSidW(pTokenUser->User.Sid, &sczSid))
+    {
+        BalExitWithLastError(hr, "Failed to convert sid to string.");
+    }
+
+    BalLog(BOOTSTRAPPER_LOG_LEVEL_STANDARD, "Current User SID: %ls", sczSid);
+
+LExit:
+    ReleaseMem(pTokenUser);
+
+    if (sczSid)
+    {
+        ::LocalFree(sczSid);
+    }
+
+    return hr;
+}
+
 static void CALLBACK BafThmUtilTestingTraceError(
     __in_z LPCSTR /*szFile*/,
     __in int /*iLine*/,
diff --git a/src/test/burn/TestData/Manual/BafThmutilTesting/precomp.h b/src/test/burn/TestData/Manual/BafThmutilTesting/precomp.h
index e7cd39dc..2e14786a 100644
--- a/src/test/burn/TestData/Manual/BafThmutilTesting/precomp.h
+++ b/src/test/burn/TestData/Manual/BafThmutilTesting/precomp.h
@@ -16,12 +16,15 @@
 #include <stdlib.h>
 #include <strsafe.h>
 #include <CommCtrl.h>
+#include <sddl.h>
 
 #include "dutil.h"
 #include "dictutil.h"
 #include "fileutil.h"
 #include "locutil.h"
+#include "memutil.h"
 #include "pathutil.h"
+#include "procutil.h"
 #include "strutil.h"
 #include "thmutil.h"
 #include "regutil.h"