Import implementation of IisCA from old repo's scasched/scaexec.

81 files changed, 18951 insertions, 3 deletions

diff --git a/appveyor.cmd b/appveyor.cmd
index 9b376415..3a8bbfae 100644
--- a/appveyor.cmd
+++ b/appveyor.cmd
@@ -5,7 +5,7 @@ nuget restore
 
 msbuild -p:Configuration=Release -t:Restore
 
-rem msbuild -p:Configuration=Release src\test\WixToolsetTest.Iis\WixToolsetTest.Iis.csproj
+msbuild -p:Configuration=Release src\test\WixToolsetTest.Iis\WixToolsetTest.Iis.csproj
 
 msbuild -p:Configuration=Release -t:Pack src\wixext\WixToolset.Iis.wixext.csproj
 
diff --git a/src/ca/CustomMsiErrors.h b/src/ca/CustomMsiErrors.h
new file mode 100644
index 00000000..1fd8d050
--- /dev/null
+++ b/src/ca/CustomMsiErrors.h
@@ -0,0 +1,48 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#define msierrIISCannotConnect                 26001
+#define msierrIISFailedReadWebSite             26002
+#define msierrIISFailedReadWebDirs             26003
+#define msierrIISFailedReadVDirs               26004
+#define msierrIISFailedReadFilters             26005
+#define msierrIISFailedReadAppPool             26006
+#define msierrIISFailedReadMimeMap             26007
+#define msierrIISFailedReadProp                26008
+#define msierrIISFailedReadWebSvcExt           26009
+#define msierrIISFailedReadWebError            26010
+#define msierrIISFailedReadHttpHeader          26011
+
+#define msierrIISFailedSchedTransaction        26031
+#define msierrIISFailedSchedInstallWebs        26032
+#define msierrIISFailedSchedInstallWebDirs     26033
+#define msierrIISFailedSchedInstallVDirs       26034
+#define msierrIISFailedSchedInstallFilters     26035
+#define msierrIISFailedSchedInstallAppPool     26036
+#define msierrIISFailedSchedInstallProp        26037
+#define msierrIISFailedSchedInstallWebSvcExt   26038
+
+#define msierrIISFailedSchedUninstallWebs      26051
+#define msierrIISFailedSchedUninstallWebDirs   26052
+#define msierrIISFailedSchedUninstallVDirs     26053
+#define msierrIISFailedSchedUninstallFilters   26054
+#define msierrIISFailedSchedUninstallAppPool   26055
+#define msierrIISFailedSchedUninstallProp      26056
+#define msierrIISFailedSchedUninstallWebSvcExt 26057
+
+#define msierrIISFailedStartTransaction        26101
+#define msierrIISFailedOpenKey                 26102
+#define msierrIISFailedCreateKey               26103
+#define msierrIISFailedWriteData               26104
+#define msierrIISFailedCreateApp               26105
+#define msierrIISFailedDeleteKey               26106
+#define msierrIISFailedDeleteApp               26107
+#define msierrIISFailedDeleteValue             26108
+#define msierrIISFailedCommitInUse             26109
+
+// Last available value 26200
+
+#define msierrCERTFailedOpen                   26351
+#define msierrCERTFailedAdd                    26352
+
+// Last available value 26450
diff --git a/src/ca/caSuffix.h b/src/ca/caSuffix.h
new file mode 100644
index 00000000..303a99e9
--- /dev/null
+++ b/src/ca/caSuffix.h
@@ -0,0 +1,11 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+#if defined _WIN64
+#define PLATFORM_DECORATION(f) f L"_64"
+#elif defined ARM
+#define PLATFORM_DECORATION(f) f L"_ARM"
+#else
+#define PLATFORM_DECORATION(f) f
+#endif
diff --git a/src/ca/iisca.def b/src/ca/iisca.def
index 187269e1..b9127da6 100644
--- a/src/ca/iisca.def
+++ b/src/ca/iisca.def
@@ -4,4 +4,27 @@
 LIBRARY      "iisca"
 
 EXPORTS
-        
+;scacert.cpp
+    InstallCertificates
+    UninstallCertificates
+;scacertexec.cpp
+    AddUserCertificate
+    AddMachineCertificate
+    DeleteUserCertificate
+    DeleteMachineCertificate
+;scaexec.cpp
+    StartMetabaseTransaction
+    RollbackMetabaseTransaction
+    CommitMetabaseTransaction
+
+    WriteMetabaseChanges
+
+    StartIIS7ConfigTransaction
+    RollbackIIS7ConfigTransaction
+    CommitIIS7ConfigTransaction
+
+    WriteIIS7ConfigChanges  
+;scasched.cpp
+    ConfigureIIs
+    ConfigureIIsExec
+    ConfigureIIs7Exec
diff --git a/src/ca/iisca.vcxproj b/src/ca/iisca.vcxproj
index f83268b2..08ac4444 100644
--- a/src/ca/iisca.vcxproj
+++ b/src/ca/iisca.vcxproj
@@ -38,7 +38,7 @@
   </ImportGroup>
 
   <PropertyGroup>
-    <ProjectAdditionalLinkLibraries>msi.lib</ProjectAdditionalLinkLibraries>
+    <ProjectAdditionalLinkLibraries>crypt32.lib;msi.lib;Ws2_32.lib</ProjectAdditionalLinkLibraries>
   </PropertyGroup>
 
   <ItemGroup>
@@ -46,10 +46,87 @@
       <PrecompiledHeader>Create</PrecompiledHeader>
     </ClCompile>
     <ClCompile Include="iisca.cpp" />
+    <ClCompile Include="scaapppool.cpp" />
+    <ClCompile Include="scaapppool7.cpp" />
+    <ClCompile Include="scacert.cpp" />
+    <ClCompile Include="scacertexec.cpp" />
+    <ClCompile Include="scaexec.cpp" />
+    <ClCompile Include="scaexecIIS7.cpp" />
+    <ClCompile Include="scafilter.cpp" />
+    <ClCompile Include="scafilter7.cpp" />
+    <ClCompile Include="scahttpheader.cpp" />
+    <ClCompile Include="scahttpheader7.cpp" />
+    <ClCompile Include="scaiis.cpp" />
+    <ClCompile Include="scaiis7.cpp" />
+    <ClCompile Include="scamimemap.cpp" />
+    <ClCompile Include="scamimemap7.cpp" />
+    <ClCompile Include="scaproperty.cpp" />
+    <ClCompile Include="scaproperty7.cpp" />
+    <ClCompile Include="scasched.cpp" />
+    <ClCompile Include="scassl.cpp" />
+    <ClCompile Include="scassl7.cpp" />
+    <ClCompile Include="scauser.cpp" />
+    <ClCompile Include="scavdir.cpp" />
+    <ClCompile Include="scavdir7.cpp" />
+    <ClCompile Include="scaweb.cpp" />
+    <ClCompile Include="scaweb7.cpp" />
+    <ClCompile Include="scawebapp.cpp" />
+    <ClCompile Include="scawebapp7.cpp" />
+    <ClCompile Include="scawebappext.cpp" />
+    <ClCompile Include="scawebappext7.cpp" />
+    <ClCompile Include="scawebdir.cpp" />
+    <ClCompile Include="scawebdir7.cpp" />
+    <ClCompile Include="scaweberr.cpp" />
+    <ClCompile Include="scaweberr7.cpp" />
+    <ClCompile Include="scaweblog.cpp" />
+    <ClCompile Include="scaweblog7.cpp" />
+    <ClCompile Include="scawebprop.cpp" />
+    <ClCompile Include="scawebprop7.cpp" />
+    <ClCompile Include="scawebsvcext.cpp" />
+    <ClCompile Include="scawebsvcext7.cpp" />
   </ItemGroup>
 
   <ItemGroup>
+    <ClInclude Include="caSuffix.h" />
+    <ClInclude Include="CustomMsiErrors.h" />
     <ClInclude Include="precomp.h" />
+    <ClInclude Include="sca.h" />
+    <ClInclude Include="scaapppool.h" />
+    <ClInclude Include="scaapppool7.h" />
+    <ClInclude Include="scacert.h" />
+    <ClInclude Include="scacost.h" />
+    <ClInclude Include="scaexecIIS7.h" />
+    <ClInclude Include="scafilter.h" />
+    <ClInclude Include="scafilter7.h" />
+    <ClInclude Include="scahttpheader.h" />
+    <ClInclude Include="scahttpheader7.h" />
+    <ClInclude Include="scaiis.h" />
+    <ClInclude Include="scaiis7.h" />
+    <ClInclude Include="scamimemap.h" />
+    <ClInclude Include="scamimemap7.h" />
+    <ClInclude Include="scaproperty.h" />
+    <ClInclude Include="scaproperty7.h" />
+    <ClInclude Include="scassl.h" />
+    <ClInclude Include="scassl7.h" />
+    <ClInclude Include="scauser.h" />
+    <ClInclude Include="scavdir.h" />
+    <ClInclude Include="scavdir7.h" />
+    <ClInclude Include="scaweb.h" />
+    <ClInclude Include="scaweb7.h" />
+    <ClInclude Include="scawebapp.h" />
+    <ClInclude Include="scawebapp7.h" />
+    <ClInclude Include="scawebappext.h" />
+    <ClInclude Include="scawebappext7.h" />
+    <ClInclude Include="scawebdir.h" />
+    <ClInclude Include="scawebdir7.h" />
+    <ClInclude Include="scaweberr.h" />
+    <ClInclude Include="scaweberr7.h" />
+    <ClInclude Include="scaweblog.h" />
+    <ClInclude Include="scaweblog7.h" />
+    <ClInclude Include="scawebprop.h" />
+    <ClInclude Include="scawebprop7.h" />
+    <ClInclude Include="scawebsvcext.h" />
+    <ClInclude Include="scawebsvcext7.h" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/ca/precomp.h b/src/ca/precomp.h
index 3edad7ed..efddb5f2 100644
--- a/src/ca/precomp.h
+++ b/src/ca/precomp.h
@@ -2,12 +2,66 @@
 // Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
 
 
+#if _WIN32_MSI < 150
+#define _WIN32_MSI 150
+#endif
+
 #include <windows.h>
 #include <msiquery.h>
+#include <msidefs.h>
+#include <strsafe.h>
+
+#include <lm.h>        // NetApi32.lib
+
+#include <Dsgetdc.h>
+#include <ComAdmin.h>
+#include <ahadmin.h>    // IIS 7 config
 
 #define MAXUINT USHRT_MAX
 #include <Setup.Configuration.h>
 
 #include "wcautil.h"
+#include "wcawow64.h"
+#include "wcawrapquery.h"
+
+#include "certutil.h"
+#include "cryputil.h"
 #include "fileutil.h"
+#include "iis7util.h"
+#include "memutil.h"
+#include "metautil.h"
 #include "strutil.h"
+#include "userutil.h"
+#include "wiutil.h"
+
+#include "CustomMsiErrors.h"
+#include "sca.h"
+#include "scacost.h"
+#include "scacert.h"
+#include "scafilter.h"
+
+#include "scaiis.h"
+#include "scaiis7.h"
+#include "scaproperty.h"
+#include "scaweb.h"
+#include "scawebdir.h"
+#include "scawebsvcext.h"
+#include "scavdir.h"
+#include "scaweb7.h"
+#include "scaapppool7.h"
+#include "scavdir7.h"
+#include "scawebapp7.h"
+#include "scawebappext7.h"
+#include "scamimemap7.h"
+#include "scawebprop7.h"
+#include "scaweblog7.h"
+#include "scafilter7.h"
+#include "scahttpheader7.h"
+#include "scaweberr7.h"
+#include "scawebsvcext7.h"
+#include "scaproperty7.h"
+#include "scawebdir7.h"
+#include "scassl7.h"
+#include "scaexecIIS7.h"
+
+#include "caSuffix.h"
diff --git a/src/ca/sca.h b/src/ca/sca.h
new file mode 100644
index 00000000..64567dcb
--- /dev/null
+++ b/src/ca/sca.h
@@ -0,0 +1,124 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+#define MAGIC_MULTISZ_CHAR 127
+
+// Generic action enum.
+enum SCA_ACTION
+{
+    SCA_ACTION_NONE,
+    SCA_ACTION_INSTALL,
+    SCA_ACTION_UNINSTALL
+};
+
+
+// IIS Metabase actions
+enum METABASE_ACTION
+{
+    MBA_UNKNOWNACTION = 0,
+    MBA_CREATEKEY,
+    MBA_DELETEKEY,
+    MBA_WRITEVALUE,
+    MBA_DELETEVALUE,
+    MBA_CREATEAPP,
+    MBA_DELETEAPP,
+};
+
+// IIS 7 Config actions
+enum IIS_CONFIG_ACTION
+{
+    IIS_CREATE,
+    IIS_DELETE,
+    IIS_SITE,
+    IIS_APPLICATION,
+    IIS_APPPOOL,
+    IIS_APPPOOL_RECYCLE_MIN,
+    IIS_APPPOOL_RECYCLE_REQ,
+    IIS_APPPOOL_RECYCLE_TIMES,
+    IIS_APPPOOL_RECYCLE_VIRMEM,
+    IIS_APPPOOL_RECYCLE_PRIVMEM,
+    IIS_APPPOOL_RECYCLE_IDLTIMEOUT,
+    IIS_APPPOOL_RECYCLE_QUEUELIMIT,
+    IIS_APPPOOL_RECYCLE_CPU_PCT,
+    IIS_APPPOOL_RECYCLE_CPU_REFRESH,
+    IIS_APPPOOL_RECYCLE_CPU_ACTION,
+    IIS_APPPOOL_MAXPROCESS,
+    IIS_APPPOOL_IDENTITY,
+    IIS_APPPOOL_USER,
+    IIS_APPPOOL_PWD,
+    IIS_APPPOOL_32BIT,
+    IIS_APPPOOL_MANAGED_PIPELINE_MODE,
+    IIS_APPPOOL_MANAGED_RUNTIME_VERSION,
+    IIS_APPPOOL_END,
+    IIS_APPEXT_BEGIN,
+    IIS_APPEXT,
+    IIS_APPEXT_END,
+    IIS_VDIR,
+    IIS_BINDING,
+    IIS_MIMEMAP_BEGIN,
+    IIS_MIMEMAP,
+    IIS_MIMEMAP_END,
+    IIS_DIRPROP_BEGIN,
+    IIS_DIRPROP_ACCESS,
+    IIS_DIRPROP_AUTH,
+    IIS_DIRPROP_USER,
+    IIS_DIRPROP_PWD,
+    IIS_DIRPROP_PWDCTRL,
+    IIS_DIRPROP_LOG,
+    IIS_DIRPROP_DEFDOCS,
+    IIS_DIRPROP_SSLFLAGS,
+    IIS_DIRPROP_AUTHPROVID,
+    IIS_DIRPROP_ASPERROR,
+    IIS_DIRPROP_HTTPEXPIRES,
+    IIS_DIRPROP_MAXAGE,
+    IIS_DIRPROP_CACHECUST,
+    IIS_DIRPROP_NOCUSTERROR,
+    IIS_DIRPROP_LOGVISITS,
+    IIS_DIRPROP_END,
+    IIS_WEBLOG,
+    IIS_FILTER_BEGIN,
+    IIS_FILTER_GLOBAL_BEGIN,
+    IIS_FILTER,
+    IIS_FILTER_END,
+    IIS_HTTP_HEADER_BEGIN,
+    IIS_HTTP_HEADER,
+    IIS_HTTP_HEADER_END,
+    IIS_WEBERROR_BEGIN,
+    IIS_WEBERROR,
+    IIS_WEBERROR_END,
+    IIS_WEB_SVC_EXT,
+    IIS_PROPERTY,
+    IIS_PROPERTY_MAXBAND,
+    IIS_PROPERTY_LOGUTF8,
+    IIS_WEBDIR,
+    IIS_ASP_BEGIN,
+    IIS_ASP_SESSIONSTATE,
+    IIS_ASP_SESSIONTIMEOUT,
+    IIS_ASP_BUFFER,
+    IIS_ASP_PARENTPATHS,
+    IIS_ASP_SCRIPTLANG,
+    IIS_ASP_SCRIPTTIMEOUT,
+    IIS_ASP_SCRIPTSERVERDEBUG,
+    IIS_ASP_SCRIPTCLIENTDEBUG,
+    IIS_ASP_END,
+    IIS_SSL_BINDING
+};
+
+
+// user creation attributes definitions
+enum SCAU_ATTRIBUTES
+{
+    SCAU_DONT_EXPIRE_PASSWRD = 0x00000001,
+    SCAU_PASSWD_CANT_CHANGE = 0x00000002,
+    SCAU_PASSWD_CHANGE_REQD_ON_LOGIN = 0x00000004,
+    SCAU_DISABLE_ACCOUNT = 0x00000008,
+    SCAU_FAIL_IF_EXISTS = 0x00000010,
+    SCAU_UPDATE_IF_EXISTS = 0x00000020,
+    SCAU_ALLOW_LOGON_AS_SERVICE = 0x00000040,
+    SCAU_ALLOW_LOGON_AS_BATCH = 0x00000080,
+
+    SCAU_DONT_REMOVE_ON_UNINSTALL = 0x00000100,
+    SCAU_DONT_CREATE_USER = 0x00000200,
+    SCAU_NON_VITAL = 0x00000400,
+};
diff --git a/src/ca/scaapppool.cpp b/src/ca/scaapppool.cpp
new file mode 100644
index 00000000..781c55ca
--- /dev/null
+++ b/src/ca/scaapppool.cpp
@@ -0,0 +1,594 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+/*------------------------------------------------------------------
+AppPool table:
+
+Column                Type   Nullable     Example Value
+AppPool               s72    No           TestPool
+Name                  s72    No           "TestPool"
+Component_            s72    No           ComponentName
+Attributes            i2     No           8 (APATTR_OTHERUSER)
+User_                 s72    Yes          UserKey
+RecycleMinutes        i2     Yes          500
+RecycleRequests       i2     Yes          5000
+RecycleTimes          s72    Yes          "1:45,13:30,22:00"
+IdleTimeout           i2     Yes          15
+QueueLimit            i2     Yes          500
+CPUMon                s72    Yes          "65,500,1" (65% CPU usage, 500 minutes, Shutdown Action)
+MaxProc               i2     Yes          5
+ManagedRuntimeVersion s72    Yes          "v2.0"
+ManagedPipelineMode   s72    Yes          "Integrated"
+
+Notes:
+RecycleTimes is a comma delimeted list of times.  CPUMon is a
+comma delimeted list of the following format:
+<percent CPU usage>,<refress minutes>,<Action>.  The values for
+Action are 1 (Shutdown) and 0 (No Action).
+
+------------------------------------------------------------------*/
+
+enum eAppPoolQuery { apqAppPool = 1, apqName, apqComponent, apqAttributes, apqUser, apqRecycleMinutes, apqRecycleRequests, apqRecycleTimes, apqVirtualMemory, apqPrivateMemory, apqIdleTimeout, apqQueueLimit, apqCpuMon, apqMaxProc, apqManagedRuntimeVersion, apqManagedPipelineMode, apqInstalled, apqAction };
+
+enum eComponentAttrQuery { caqComponent = 1, caqAttributes };
+
+// prototypes
+static HRESULT AppPoolExists(
+    __in IMSAdminBase* piMetabase,
+    __in LPCWSTR wzAppPool
+    );
+
+// functions
+
+void ScaAppPoolFreeList(
+    __in SCA_APPPOOL* psapList
+    )
+{
+    SCA_APPPOOL* psapDelete = psapList;
+    while (psapList)
+    {
+        psapDelete = psapList;
+        psapList = psapList->psapNext;
+
+        MemFree(psapDelete);
+    }
+}
+
+
+HRESULT ScaAppPoolRead(
+    __inout SCA_APPPOOL** ppsapList,
+    __in WCA_WRAPQUERY_HANDLE hUserQuery,
+    __inout LPWSTR *ppwzCustomActionData
+    )
+{
+    Assert(ppsapList);
+
+    HRESULT hr = S_OK;
+
+    MSIHANDLE hRec, hRecComp;
+    LPWSTR pwzData = NULL;
+    SCA_APPPOOL* psap = NULL;
+    WCA_WRAPQUERY_HANDLE hAppPoolQuery = NULL;
+    WCA_WRAPQUERY_HANDLE hComponentQuery = NULL;
+
+    hr = WcaBeginUnwrapQuery(&hAppPoolQuery, ppwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap query for ScaAppPoolRead");
+
+    if (0 == WcaGetQueryRecords(hAppPoolQuery))
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping ScaAppPoolRead() - required table not present");
+        ExitFunction1(hr = S_FALSE);
+    }
+    
+    hr = WcaBeginUnwrapQuery(&hComponentQuery, ppwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap query for ScaAppPoolRead");
+
+    // loop through all the AppPools
+    while (S_OK == (hr = WcaFetchWrappedRecord(hAppPoolQuery, &hRec)))
+    {
+        // Add this record's information into the list of things to process.
+        hr = AddAppPoolToList(ppsapList);
+        ExitOnFailure(hr, "failed to add app pool to app pool list");
+
+        psap = *ppsapList;
+
+        hr = WcaGetRecordString(hRec, apqComponent, &pwzData);
+        ExitOnFailure(hr, "failed to get AppPool.Component");
+
+        if (pwzData && *pwzData)
+        {
+            psap->fHasComponent = TRUE;
+
+            hr = ::StringCchCopyW(psap->wzComponent, countof(psap->wzComponent), pwzData);
+            ExitOnFailure(hr, "failed to copy component name: %ls", pwzData);
+
+            hr = WcaGetRecordInteger(hRec, apqInstalled, (int *)&psap->isInstalled);
+            ExitOnFailure(hr, "Failed to get Component installed state for app pool");
+
+            hr = WcaGetRecordInteger(hRec, apqAction, (int *)&psap->isAction);
+            ExitOnFailure(hr, "Failed to get Component action state for app pool");
+
+            WcaFetchWrappedReset(hComponentQuery);
+            hr = WcaFetchWrappedRecordWhereString(hComponentQuery, caqComponent, psap->wzComponent, &hRecComp);
+            ExitOnFailure(hr, "Failed to fetch Component.Attributes for Component '%ls'", psap->wzComponent);
+
+            hr = WcaGetRecordInteger(hRecComp, caqAttributes, &psap->iCompAttributes);
+            ExitOnFailure(hr, "failed to get Component.Attributes");
+        }
+
+        hr = WcaGetRecordString(hRec, apqAppPool, &pwzData);
+        ExitOnFailure(hr, "failed to get AppPool.AppPool");
+        hr = ::StringCchCopyW(psap->wzAppPool, countof(psap->wzAppPool), pwzData);
+        ExitOnFailure(hr, "failed to copy AppPool name: %ls", pwzData);
+
+        hr = WcaGetRecordString(hRec, apqName, &pwzData);
+        ExitOnFailure(hr, "failed to get AppPool.Name");
+        hr = ::StringCchCopyW(psap->wzName, countof(psap->wzName), pwzData);
+        ExitOnFailure(hr, "failed to copy app pool name: %ls", pwzData);
+        hr = ::StringCchPrintfW(psap->wzKey, countof(psap->wzKey), L"/LM/W3SVC/AppPools/%s", pwzData);
+        ExitOnFailure(hr, "failed to format app pool key name");
+
+        hr = WcaGetRecordInteger(hRec, apqAttributes, &psap->iAttributes);
+        ExitOnFailure(hr, "failed to get AppPool.Attributes");
+
+        hr = WcaGetRecordString(hRec, apqUser, &pwzData);
+        ExitOnFailure(hr, "failed to get AppPool.User");
+        hr = ScaGetUserDeferred(pwzData, hUserQuery, &psap->suUser);
+        ExitOnFailure(hr, "failed to get user: %ls", pwzData);
+
+        hr = WcaGetRecordInteger(hRec, apqRecycleRequests, &psap->iRecycleRequests);
+        ExitOnFailure(hr, "failed to get AppPool.RecycleRequests");
+
+        hr = WcaGetRecordInteger(hRec, apqRecycleMinutes, &psap->iRecycleMinutes);
+        ExitOnFailure(hr, "failed to get AppPool.Minutes");
+
+        hr = WcaGetRecordString(hRec, apqRecycleTimes, &pwzData);
+        ExitOnFailure(hr, "failed to get AppPool.RecycleTimes");
+        hr = ::StringCchCopyW(psap->wzRecycleTimes, countof(psap->wzRecycleTimes), pwzData);
+        ExitOnFailure(hr, "failed to copy recycle value: %ls", pwzData);
+
+        hr = WcaGetRecordInteger(hRec, apqVirtualMemory, &psap->iVirtualMemory);
+        ExitOnFailure(hr, "failed to get AppPool.VirtualMemory");
+
+        hr = WcaGetRecordInteger(hRec, apqPrivateMemory, &psap->iPrivateMemory);
+        ExitOnFailure(hr, "failed to get AppPool.PrivateMemory");
+
+        hr = WcaGetRecordInteger(hRec, apqIdleTimeout, &psap->iIdleTimeout);
+        ExitOnFailure(hr, "failed to get AppPool.IdleTimeout");
+
+        hr = WcaGetRecordInteger(hRec, apqQueueLimit, &psap->iQueueLimit);
+        ExitOnFailure(hr, "failed to get AppPool.QueueLimit");
+
+        hr = WcaGetRecordString(hRec, apqCpuMon, &pwzData);
+        ExitOnFailure(hr, "failed to get AppPool.CPUMon");
+        hr = ::StringCchCopyW(psap->wzCpuMon, countof(psap->wzCpuMon), pwzData);
+        ExitOnFailure(hr, "failed to copy cpu monitor value: %ls", pwzData);
+
+        hr = WcaGetRecordInteger(hRec, apqMaxProc, &psap->iMaxProcesses);
+        ExitOnFailure(hr, "failed to get AppPool.MaxProc");
+
+        hr = WcaGetRecordString(hRec, apqManagedRuntimeVersion, &pwzData);
+        ExitOnFailure(hr, "failed to get AppPool.ManagedRuntimeVersion");
+        hr = ::StringCchCopyW(psap->wzManagedRuntimeVersion, countof(psap->wzManagedRuntimeVersion), pwzData);
+        ExitOnFailure(hr, "failed to copy ManagedRuntimeVersion value: %ls", pwzData);
+
+        hr = WcaGetRecordString(hRec, apqManagedPipelineMode, &pwzData);
+        ExitOnFailure(hr, "failed to get AppPool.ManagedPipelineMode");
+        hr = ::StringCchCopyW(psap->wzManagedPipelineMode, countof(psap->wzManagedPipelineMode), pwzData);
+        ExitOnFailure(hr, "failed to copy ManagedPipelineMode value: %ls", pwzData);
+
+    }
+
+    if (E_NOMOREITEMS == hr)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "failure while processing AppPools");
+
+LExit:
+    WcaFinishUnwrapQuery(hAppPoolQuery);
+    WcaFinishUnwrapQuery(hComponentQuery);
+
+    ReleaseStr(pwzData);
+    return hr;
+}
+
+
+HRESULT ScaFindAppPool(
+    __in IMSAdminBase* piMetabase,
+    __in LPCWSTR wzAppPool,
+    __out_ecount(cchName) LPWSTR wzName,
+    __in DWORD cchName,
+    __in SCA_APPPOOL *psapList
+    )
+{
+    Assert(piMetabase && wzAppPool && *wzAppPool && wzName && *wzName);
+
+    HRESULT hr = S_OK;
+
+    // check memory first
+    SCA_APPPOOL* psap = psapList;
+    for (; psap; psap = psap->psapNext)
+    {
+        if (0 == lstrcmpW(psap->wzAppPool, wzAppPool))
+        {
+            break;
+        }
+    }
+    ExitOnNull(psap, hr, HRESULT_FROM_WIN32(ERROR_NOT_FOUND), "Could not find the app pool: %ls", wzAppPool);
+
+    // copy the web app pool name
+    hr = ::StringCchCopyW(wzName, cchName, psap->wzName);
+    ExitOnFailure(hr, "failed to copy app pool name while finding app pool: %ls", psap->wzName);
+
+    // if it's not being installed now, check if it exists already
+    if (!psap->fHasComponent)
+    {
+        hr = AppPoolExists(piMetabase, psap->wzName);
+        ExitOnFailure(hr, "failed to check for existence of app pool: %ls", psap->wzName);
+    }
+
+LExit:
+    return hr;
+}
+
+
+static HRESULT AppPoolExists(
+    __in IMSAdminBase* piMetabase,
+    __in LPCWSTR wzAppPool
+    )
+{
+    Assert(piMetabase && wzAppPool && *wzAppPool);
+
+    HRESULT hr = S_OK;
+    WCHAR wzSubKey[METADATA_MAX_NAME_LEN];
+
+    for (DWORD dwIndex = 0; SUCCEEDED(hr); ++dwIndex)
+    {
+        hr = piMetabase->EnumKeys(METADATA_MASTER_ROOT_HANDLE, L"/LM/W3SVC/AppPools", wzSubKey, dwIndex);
+        if (SUCCEEDED(hr) && 0 == lstrcmpW(wzSubKey, wzAppPool))
+        {
+            hr = S_OK;
+            break;
+        }
+    }
+
+    if (E_NOMOREITEMS == hr || HRESULT_FROM_WIN32(ERROR_PATH_NOT_FOUND) == hr || HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND) == hr)
+    {
+        hr = S_FALSE;
+    }
+
+    return hr;
+}
+
+
+HRESULT ScaAppPoolInstall(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_APPPOOL* psapList
+    )
+{
+    Assert(piMetabase);
+
+    HRESULT hr = S_OK;
+
+    for (SCA_APPPOOL* psap = psapList; psap; psap = psap->psapNext)
+    {
+        // if we are installing the app pool
+        if (psap->fHasComponent && WcaIsInstalling(psap->isInstalled, psap->isAction))
+        {
+            hr = ScaWriteAppPool(piMetabase, psap);
+            ExitOnFailure(hr, "failed to write AppPool '%ls' to metabase", psap->wzAppPool);
+        }
+    }
+
+LExit:
+    return hr;
+}
+
+
+HRESULT ScaAppPoolUninstall(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_APPPOOL* psapList
+    )
+{
+    Assert(piMetabase);
+
+    HRESULT hr = S_OK;
+
+    for (SCA_APPPOOL* psap = psapList; psap; psap = psap->psapNext)
+    {
+        // if we are uninstalling the app pool
+        if (psap->fHasComponent && WcaIsUninstalling(psap->isInstalled, psap->isAction))
+        {
+            hr = ScaRemoveAppPool(piMetabase, psap);
+            ExitOnFailure(hr, "Failed to remove AppPool '%ls' from metabase", psap->wzAppPool);
+        }
+    }
+
+LExit:
+    return hr;
+}
+
+
+HRESULT ScaWriteAppPool(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_APPPOOL* psap
+    )
+{
+    Assert(piMetabase && psap);
+
+    HRESULT hr = S_OK;
+    DWORD dwIdentity = 0xFFFFFFFF;
+    BOOL fExists = FALSE;
+    LPWSTR pwzValue = NULL;
+    LPWSTR wz = NULL;
+
+    hr = AppPoolExists(piMetabase, psap->wzName);
+    ExitOnFailure(hr, "failed to check if app pool already exists");
+    if (S_FALSE == hr)
+    {
+        // didn't find the AppPool key, so we need to create it
+        hr = ScaCreateMetabaseKey(piMetabase, psap->wzKey, L"");
+        ExitOnFailure(hr, "failed to create AppPool key: %ls", psap->wzKey);
+
+        // mark it as an AppPool
+        hr = ScaWriteMetabaseValue(piMetabase, psap->wzKey, NULL, MD_KEY_TYPE, METADATA_NO_ATTRIBUTES, IIS_MD_UT_SERVER, STRING_METADATA, (LPVOID)L"IIsApplicationPool");
+        ExitOnFailure(hr, "failed to mark key as AppPool key: %ls", psap->wzKey);
+
+        // TODO: Make this an Attribute?
+        // set autostart value
+        hr = ScaWriteMetabaseValue(piMetabase, psap->wzKey, NULL, MD_APPPOOL_AUTO_START, METADATA_NO_ATTRIBUTES, IIS_MD_UT_SERVER, DWORD_METADATA, (LPVOID)1);
+        ExitOnFailure(hr, "failed to mark key as AppPool key: %ls", psap->wzKey);
+    }
+    else
+    {
+        fExists = TRUE;
+    }
+
+    //
+    // Set the AppPool Recycling Tab
+    //
+    if (MSI_NULL_INTEGER != psap->iRecycleMinutes)
+    {
+        hr = ScaWriteMetabaseValue(piMetabase, psap->wzKey, NULL, MD_APPPOOL_PERIODIC_RESTART_TIME, METADATA_INHERIT, IIS_MD_UT_SERVER, DWORD_METADATA, (LPVOID)((DWORD_PTR)psap->iRecycleMinutes));
+        ExitOnFailure(hr, "failed to set periodic restart time");
+    }
+
+    if (MSI_NULL_INTEGER != psap->iRecycleRequests)
+    {
+        hr = ScaWriteMetabaseValue(piMetabase, psap->wzKey, NULL, MD_APPPOOL_PERIODIC_RESTART_REQUEST_COUNT, METADATA_INHERIT, IIS_MD_UT_SERVER, DWORD_METADATA, (LPVOID)((DWORD_PTR)psap->iRecycleRequests));
+        ExitOnFailure(hr, "failed to set periodic restart request count");
+    }
+
+    if (*psap->wzRecycleTimes)
+    {
+        // Add another NULL' onto pwz since it's a 'MULTISZ'
+        hr = StrAllocString(&pwzValue, psap->wzRecycleTimes, 0);
+        ExitOnFailure(hr, "failed to allocate string for MULTISZ");
+        hr = StrAllocConcat(&pwzValue, L"\0", 1);
+        ExitOnFailure(hr, "failed to add second null to RecycleTime multisz");
+
+        // Replace the commas with NULLs
+        wz = pwzValue;
+        while (NULL != (wz = wcschr(wz, L',')))
+        {
+            *wz = L'\0';
+            ++wz;
+        }
+
+        hr = ScaWriteMetabaseValue(piMetabase, psap->wzKey, NULL, MD_APPPOOL_PERIODIC_RESTART_SCHEDULE, METADATA_INHERIT, IIS_MD_UT_SERVER, MULTISZ_METADATA, (LPVOID)pwzValue);
+        ExitOnFailure(hr, "failed to set periodic restart schedule");
+    }
+
+    if (MSI_NULL_INTEGER != psap->iVirtualMemory)
+    {
+        hr = ScaWriteMetabaseValue(piMetabase, psap->wzKey, NULL, MD_APPPOOL_PERIODIC_RESTART_MEMORY, METADATA_INHERIT, IIS_MD_UT_SERVER, DWORD_METADATA, (LPVOID)((DWORD_PTR)psap->iVirtualMemory));
+        ExitOnFailure(hr, "failed to set periodic restart memory count");
+    }
+
+    if (MSI_NULL_INTEGER != psap->iPrivateMemory)
+    {
+        hr = ScaWriteMetabaseValue(piMetabase, psap->wzKey, NULL, MD_APPPOOL_PERIODIC_RESTART_PRIVATE_MEMORY, METADATA_INHERIT, IIS_MD_UT_SERVER, DWORD_METADATA, (LPVOID)((DWORD_PTR)psap->iPrivateMemory));
+        ExitOnFailure(hr, "failed to set periodic restart private memory count");
+    }
+
+
+    //
+    // Set AppPool Performance Tab
+    //
+    if (MSI_NULL_INTEGER != psap->iIdleTimeout)
+    {
+        hr = ScaWriteMetabaseValue(piMetabase, psap->wzKey, NULL, MD_APPPOOL_IDLE_TIMEOUT, METADATA_INHERIT, IIS_MD_UT_SERVER, DWORD_METADATA, (LPVOID)((DWORD_PTR)psap->iIdleTimeout));
+        ExitOnFailure(hr, "failed to set idle timeout value");
+    }
+
+    if (MSI_NULL_INTEGER != psap->iQueueLimit)
+    {
+        hr = ScaWriteMetabaseValue(piMetabase, psap->wzKey, NULL, MD_APPPOOL_UL_APPPOOL_QUEUE_LENGTH, METADATA_INHERIT, IIS_MD_UT_SERVER, DWORD_METADATA, (LPVOID)((DWORD_PTR)psap->iQueueLimit));
+        ExitOnFailure(hr, "failed to set request queue limit value");
+    }
+
+    if (*psap->wzCpuMon)
+    {
+        hr = StrAllocString(&pwzValue, psap->wzCpuMon, 0);
+        ExitOnFailure(hr, "failed to allocate CPUMonitor string");
+
+        DWORD dwPercent = 0;
+        DWORD dwRefreshMinutes = 0;
+        DWORD dwAction = 0;
+
+        dwPercent = wcstoul(pwzValue, &wz, 10);
+        if (100  < dwPercent)
+        {
+            ExitOnFailure(hr = E_INVALIDARG, "invalid maximum cpu percentage value: %d", dwPercent);
+        }
+        if (wz && L',' == *wz)
+        {
+            ++wz;
+            dwRefreshMinutes = wcstoul(wz, &wz, 10);
+            if (wz && L',' == *wz)
+            {
+                ++wz;
+                dwAction = wcstoul(wz, &wz, 10);
+            }
+        }
+
+        if (dwPercent)
+        {
+            hr = ScaWriteMetabaseValue(piMetabase, psap->wzKey, NULL, MD_CPU_LIMIT, METADATA_INHERIT, IIS_MD_UT_SERVER, DWORD_METADATA, (LPVOID)((DWORD_PTR)(dwPercent * 1000)));
+            ExitOnFailure(hr, "failed to set CPU percentage max");
+        }
+        if (dwRefreshMinutes)
+        {
+            hr = ScaWriteMetabaseValue(piMetabase, psap->wzKey, NULL, MD_CPU_RESET_INTERVAL, METADATA_INHERIT, IIS_MD_UT_SERVER, DWORD_METADATA, (LPVOID)((DWORD_PTR)dwRefreshMinutes));
+            ExitOnFailure(hr, "failed to set refresh CPU minutes");
+        }
+        if (dwAction)
+        {
+            // 0 = No Action
+            // 1 = Shutdown
+            hr = ScaWriteMetabaseValue(piMetabase, psap->wzKey, NULL, MD_CPU_ACTION, METADATA_INHERIT, IIS_MD_UT_SERVER, DWORD_METADATA, (LPVOID)((DWORD_PTR)dwAction));
+            ExitOnFailure(hr, "failed to set CPU action");
+        }
+    }
+
+    if (MSI_NULL_INTEGER != psap->iMaxProcesses)
+    {
+        hr = ScaWriteMetabaseValue(piMetabase, psap->wzKey, NULL, MD_APPPOOL_MAX_PROCESS_COUNT, METADATA_INHERIT, IIS_MD_UT_SERVER, DWORD_METADATA, (LPVOID)((DWORD_PTR)psap->iMaxProcesses));
+        ExitOnFailure(hr, "failed to set web garden maximum worker processes");
+    }
+
+    // TODO: Health Tab if anyone wants it?
+
+    //
+    // Set the AppPool Identity tab
+    //
+    if (psap->iAttributes & APATTR_NETSERVICE)
+    {
+        dwIdentity = MD_APPPOOL_IDENTITY_TYPE_NETWORKSERVICE;
+    }
+    else if (psap->iAttributes & APATTR_LOCSERVICE)
+    {
+        dwIdentity = MD_APPPOOL_IDENTITY_TYPE_LOCALSERVICE;
+    }
+    else if (psap->iAttributes & APATTR_LOCSYSTEM)
+    {
+        dwIdentity = MD_APPPOOL_IDENTITY_TYPE_LOCALSYSTEM;
+    }
+    else if (psap->iAttributes & APATTR_OTHERUSER)
+    {
+        if (!*psap->suUser.wzDomain || CSTR_EQUAL == ::CompareStringW(LOCALE_INVARIANT, NORM_IGNORECASE, psap->suUser.wzDomain, -1, L".", -1))
+        {
+            if (CSTR_EQUAL == ::CompareStringW(LOCALE_INVARIANT, NORM_IGNORECASE, psap->suUser.wzName, -1, L"NetworkService", -1))
+            {
+                dwIdentity = MD_APPPOOL_IDENTITY_TYPE_NETWORKSERVICE;
+            }
+            else if (CSTR_EQUAL == ::CompareStringW(LOCALE_INVARIANT, NORM_IGNORECASE, psap->suUser.wzName, -1, L"LocalService", -1))
+            {
+                dwIdentity = MD_APPPOOL_IDENTITY_TYPE_LOCALSERVICE;
+            }
+            else if (CSTR_EQUAL == ::CompareStringW(LOCALE_INVARIANT, NORM_IGNORECASE, psap->suUser.wzName, -1, L"LocalSystem", -1))
+            {
+                dwIdentity = MD_APPPOOL_IDENTITY_TYPE_LOCALSYSTEM;
+            }
+            else
+            {
+                dwIdentity = MD_APPPOOL_IDENTITY_TYPE_SPECIFICUSER;
+            }
+        }
+        else if (CSTR_EQUAL == ::CompareStringW(LOCALE_INVARIANT, NORM_IGNORECASE, psap->suUser.wzDomain, -1, L"NT AUTHORITY", -1))
+        {
+            if (CSTR_EQUAL == ::CompareStringW(LOCALE_INVARIANT, NORM_IGNORECASE, psap->suUser.wzName, -1, L"NETWORK SERVICE", -1))
+            {
+                dwIdentity = MD_APPPOOL_IDENTITY_TYPE_NETWORKSERVICE;
+            }
+            else if (CSTR_EQUAL == ::CompareStringW(LOCALE_INVARIANT, NORM_IGNORECASE, psap->suUser.wzName, -1, L"SERVICE", -1))
+            {
+                dwIdentity = MD_APPPOOL_IDENTITY_TYPE_LOCALSERVICE;
+            }
+            else if (CSTR_EQUAL == ::CompareStringW(LOCALE_INVARIANT, NORM_IGNORECASE, psap->suUser.wzName, -1, L"SYSTEM", -1))
+            {
+                dwIdentity = MD_APPPOOL_IDENTITY_TYPE_LOCALSYSTEM;
+            }
+            else
+            {
+                dwIdentity = MD_APPPOOL_IDENTITY_TYPE_SPECIFICUSER;
+            }
+        }
+        else
+        {
+            dwIdentity = MD_APPPOOL_IDENTITY_TYPE_SPECIFICUSER;
+        }
+    }
+
+    if (-1 != dwIdentity)
+    {
+        hr = ScaWriteMetabaseValue(piMetabase, psap->wzKey, NULL, MD_APPPOOL_IDENTITY_TYPE, METADATA_INHERIT , IIS_MD_UT_SERVER, DWORD_METADATA, (LPVOID)((DWORD_PTR)dwIdentity));
+        ExitOnFailure(hr, "failed to set app pool identity");
+
+        if (MD_APPPOOL_IDENTITY_TYPE_SPECIFICUSER == dwIdentity)
+        {
+            if (*psap->suUser.wzDomain)
+            {
+                hr = StrAllocFormatted(&pwzValue, L"%s\\%s", psap->suUser.wzDomain, psap->suUser.wzName);
+                ExitOnFailure(hr, "failed to format user name: %ls domain: %ls", psap->suUser.wzName, psap->suUser.wzDomain);
+            }
+            else
+            {
+                hr = StrAllocFormatted(&pwzValue, L"%s", psap->suUser.wzName);
+                ExitOnFailure(hr, "failed to format user name: %ls", psap->suUser.wzName);
+            }
+
+            hr = ScaWriteMetabaseValue(piMetabase, psap->wzKey, NULL, MD_WAM_USER_NAME, METADATA_INHERIT , IIS_MD_UT_FILE, STRING_METADATA, (LPVOID)pwzValue);
+            ExitOnFailure(hr, "failed to set app pool identity name");
+
+            hr = ScaWriteMetabaseValue(piMetabase, psap->wzKey, NULL, MD_WAM_PWD, METADATA_INHERIT | METADATA_SECURE, IIS_MD_UT_FILE, STRING_METADATA, (LPVOID)psap->suUser.wzPassword);
+            ExitOnFailure(hr, "failed to set app pool identity password");
+        }
+    }
+
+LExit:
+    ReleaseStr(pwzValue);
+
+    return hr;
+}
+
+
+HRESULT ScaRemoveAppPool(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_APPPOOL* psap
+    )
+{
+    Assert(piMetabase && psap);
+
+    HRESULT hr = S_OK;
+
+    // simply remove the root key and everything else is pulled at the same time
+    if (0 != lstrlenW(psap->wzKey))
+    {
+        hr = ScaDeleteMetabaseKey(piMetabase, psap->wzKey, L"");
+        ExitOnFailure(hr, "failed to delete AppPool key: %ls", psap->wzKey);
+    }
+
+    // TODO: Maybe check to make sure any web sites that are using this AppPool are put back in the 'DefaultAppPool'
+
+LExit:
+    return hr;
+}
+
+
+HRESULT AddAppPoolToList(
+    __in SCA_APPPOOL** ppsapList
+    )
+{
+    HRESULT hr = S_OK;
+    SCA_APPPOOL* psap = static_cast<SCA_APPPOOL*>(MemAlloc(sizeof(SCA_APPPOOL), TRUE));
+    ExitOnNull(psap, hr, E_OUTOFMEMORY, "failed to allocate memory for new element in app pool list");
+
+    psap->psapNext = *ppsapList;
+    *ppsapList = psap;
+
+LExit:
+    return hr;
+}
diff --git a/src/ca/scaapppool.h b/src/ca/scaapppool.h
new file mode 100644
index 00000000..68575fcb
--- /dev/null
+++ b/src/ca/scaapppool.h
@@ -0,0 +1,88 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+#include "scauser.h"
+
+// Identity
+#define APATTR_NETSERVICE 0x0001 // Network Service
+#define APATTR_LOCSERVICE 0x0002 // Local Service
+#define APATTR_LOCSYSTEM 0x0004 // Local System
+#define APATTR_OTHERUSER 0x0008 // Other User
+
+struct SCA_APPPOOL
+{
+    // iis app pool configuation information
+    WCHAR wzAppPool[MAX_DARWIN_KEY + 1];
+    WCHAR wzName[METADATA_MAX_NAME_LEN + 1];
+    WCHAR wzKey[METADATA_MAX_NAME_LEN + 1];
+    WCHAR wzComponent[METADATA_MAX_NAME_LEN + 1];
+    BOOL fHasComponent;
+    INSTALLSTATE isInstalled;
+    INSTALLSTATE isAction;
+    INT iAttributes;
+
+    SCA_USER suUser;
+
+    INT iRecycleRequests;
+    INT iRecycleMinutes;
+    WCHAR wzRecycleTimes[MAX_DARWIN_KEY + 1];
+    INT iVirtualMemory;
+    INT iPrivateMemory;
+
+    INT iIdleTimeout;
+    INT iQueueLimit;
+    WCHAR wzCpuMon[MAX_DARWIN_KEY + 1];
+    INT iMaxProcesses;
+    WCHAR wzManagedPipelineMode[MAX_DARWIN_KEY + 1];
+    WCHAR wzManagedRuntimeVersion[MAX_DARWIN_KEY + 1];
+
+    int iCompAttributes;
+
+    SCA_APPPOOL *psapNext;
+};
+
+
+// prototypes
+
+HRESULT ScaAppPoolRead(
+    __inout SCA_APPPOOL** ppsapList,
+    __in WCA_WRAPQUERY_HANDLE hUserQuery,
+    __inout LPWSTR *ppwzCustomActionData
+    );
+
+void ScaAppPoolFreeList(
+    __in SCA_APPPOOL* psapList
+    );
+
+HRESULT ScaFindAppPool(
+    __in IMSAdminBase* piMetabase,
+    __in LPCWSTR wzAppPool,
+    __out_ecount(cchName) LPWSTR wzName,
+    __in DWORD cchName,
+    __in SCA_APPPOOL *psapList
+    );
+
+HRESULT ScaAppPoolInstall(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_APPPOOL* psapList
+    );
+
+HRESULT ScaAppPoolUninstall(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_APPPOOL* psapList
+    );
+
+HRESULT ScaWriteAppPool(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_APPPOOL* psap
+    );
+
+HRESULT ScaRemoveAppPool(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_APPPOOL* psap
+    );
+
+HRESULT AddAppPoolToList(
+    __in SCA_APPPOOL** ppsapList
+    );
diff --git a/src/ca/scaapppool7.cpp b/src/ca/scaapppool7.cpp
new file mode 100644
index 00000000..0fac4346
--- /dev/null
+++ b/src/ca/scaapppool7.cpp
@@ -0,0 +1,401 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+// prototypes
+static HRESULT AppPoolExists(
+    __in LPCWSTR wzAppPool
+    );
+
+// functions
+HRESULT ScaFindAppPool7(
+    __in LPCWSTR wzAppPool,
+    __out_ecount(cchName) LPWSTR wzName,
+    __in DWORD cchName,
+    __in SCA_APPPOOL *psapList
+    )
+{
+    Assert(wzAppPool && *wzAppPool && wzName && *wzName);
+
+    HRESULT hr = S_OK;
+
+    // check memory first
+    SCA_APPPOOL* psap = psapList;
+    for (; psap; psap = psap->psapNext)
+    {
+        if (0 == wcscmp(psap->wzAppPool, wzAppPool))
+        {
+            break;
+        }
+    }
+    ExitOnNull(psap, hr, HRESULT_FROM_WIN32(ERROR_NOT_FOUND), "Could not find the app pool: %ls", wzAppPool);
+
+    // copy the web app pool name
+#pragma prefast(suppress:26037, "Source string is null terminated - it is populated as target of ::StringCchCopyW")
+    hr = ::StringCchCopyW(wzName, cchName, psap->wzName);
+    ExitOnFailure(hr, "failed to copy app pool name while finding app pool: %ls", psap->wzName);
+
+    // if it's not being installed now, check if it exists already
+    if (!psap->fHasComponent)
+    {
+        hr = AppPoolExists(psap->wzName);
+        ExitOnFailure(hr, "failed to check for existence of app pool: %ls", psap->wzName);
+    }
+
+LExit:
+    return hr;
+}
+
+
+static HRESULT AppPoolExists(
+    __in LPCWSTR /*wzAppPool*/
+    )
+{
+    HRESULT hr = S_OK;
+
+    //this function checks for existance of app pool in IIS7 config
+    //at schedule time, we will defer this to execute time.
+
+    return hr;
+}
+
+
+HRESULT ScaAppPoolInstall7(
+    __in SCA_APPPOOL* psapList
+    )
+{
+    HRESULT hr = S_OK;
+
+    for (SCA_APPPOOL* psap = psapList; psap; psap = psap->psapNext)
+    {
+        // if we are installing the app pool
+        if (psap->fHasComponent && WcaIsInstalling(psap->isInstalled, psap->isAction))
+        {
+            hr = ScaWriteAppPool7(psap);
+            ExitOnFailure(hr, "failed to write AppPool '%ls' to metabase", psap->wzAppPool);
+        }
+    }
+
+LExit:
+    return hr;
+}
+
+
+HRESULT ScaAppPoolUninstall7(
+    __in SCA_APPPOOL* psapList
+    )
+{
+
+    HRESULT hr = S_OK;
+
+    for (SCA_APPPOOL* psap = psapList; psap; psap = psap->psapNext)
+    {
+        // if we are uninstalling the app pool
+        if (psap->fHasComponent && WcaIsUninstalling(psap->isInstalled, psap->isAction))
+        {
+            hr = ScaRemoveAppPool7(psap);
+            ExitOnFailure(hr, "Failed to remove AppPool '%ls' from metabase", psap->wzAppPool);
+        }
+    }
+
+LExit:
+    return hr;
+}
+
+
+HRESULT ScaWriteAppPool7(
+    __in const SCA_APPPOOL* psap
+    )
+{
+    Assert(psap);
+
+    HRESULT hr = S_OK;
+    DWORD dwIdentity = 0xFFFFFFFF;
+    LPWSTR pwzValue = NULL;
+    LPWSTR wz = NULL;
+
+    //create the app pool
+    hr = ScaWriteConfigID(IIS_APPPOOL);
+    ExitOnFailure(hr, "failed to write AppPool key.");
+
+    hr = ScaWriteConfigID(IIS_CREATE);
+    ExitOnFailure(hr, "failed to write AppPool create action.");
+
+    hr = ScaWriteConfigString(psap->wzName);
+    ExitOnFailure(hr, "failed to write AppPool name: %ls", psap->wzName);
+
+    // Now do all the optional stuff
+
+    // Set the AppPool Recycling Tab
+    if (MSI_NULL_INTEGER != psap->iRecycleMinutes)
+    {
+        hr = ScaWriteConfigID(IIS_APPPOOL_RECYCLE_MIN);
+        ExitOnFailure(hr, "failed to set periodic restart time id");
+        hr = ScaWriteConfigInteger(psap->iRecycleMinutes);
+        ExitOnFailure(hr, "failed to set periodic restart time");
+    }
+
+    if (MSI_NULL_INTEGER != psap->iRecycleRequests)
+    {
+        hr = ScaWriteConfigID(IIS_APPPOOL_RECYCLE_REQ);
+        ExitOnFailure(hr, "failed to set periodic restart request count id");
+        hr = ScaWriteConfigInteger(psap->iRecycleRequests);
+        ExitOnFailure(hr, "failed to set periodic restart request count");
+    }
+
+    if (*psap->wzRecycleTimes)
+    {
+        hr = ScaWriteConfigID(IIS_APPPOOL_RECYCLE_TIMES);
+        ExitOnFailure(hr, "failed to set periodic restart schedule id");
+        hr = ScaWriteConfigString(psap->wzRecycleTimes);
+        ExitOnFailure(hr, "failed to set periodic restart schedule");
+    }
+
+    if (MSI_NULL_INTEGER != psap->iVirtualMemory)
+    {
+        hr = ScaWriteConfigID(IIS_APPPOOL_RECYCLE_VIRMEM);
+        ExitOnFailure(hr, "failed to set periodic restart memory count id");
+        hr = ScaWriteConfigInteger(psap->iVirtualMemory);
+        ExitOnFailure(hr, "failed to set periodic restart memory count");
+    }
+
+    if (MSI_NULL_INTEGER != psap->iPrivateMemory)
+    {
+        hr = ScaWriteConfigID(IIS_APPPOOL_RECYCLE_PRIVMEM);
+        ExitOnFailure(hr, "failed to set periodic restart private memory count id");
+        hr = ScaWriteConfigInteger(psap->iPrivateMemory);
+        ExitOnFailure(hr, "failed to set periodic restart private memory count");
+    }
+
+    // Set AppPool Performance Tab
+    if (MSI_NULL_INTEGER != psap->iIdleTimeout)
+    {
+        hr = ScaWriteConfigID(IIS_APPPOOL_RECYCLE_IDLTIMEOUT);
+        ExitOnFailure(hr, "failed to set idle timeout value id");
+        hr = ScaWriteConfigInteger(psap->iIdleTimeout);
+        ExitOnFailure(hr, "failed to set idle timeout value");
+    }
+
+    if (MSI_NULL_INTEGER != psap->iQueueLimit)
+    {
+        hr = ScaWriteConfigID(IIS_APPPOOL_RECYCLE_QUEUELIMIT);
+        ExitOnFailure(hr, "failed to set request queue limit value id");
+        hr = ScaWriteConfigInteger(psap->iQueueLimit);
+        ExitOnFailure(hr, "failed to set request queue limit value");
+    }
+    if (*psap->wzCpuMon)
+    {
+#pragma prefast(suppress:26037, "Source string is null terminated - it is populated as target of ::StringCchCopyW")
+        hr = ::StrAllocString(&pwzValue, psap->wzCpuMon, 0);
+        ExitOnFailure(hr, "failed to allocate CPUMonitor string");
+
+        DWORD dwPercent = 0;
+        DWORD dwRefreshMinutes = 0;
+        DWORD dwAction = 0;
+
+        dwPercent = wcstoul(pwzValue, &wz, 10);
+        if (100  < dwPercent)
+        {
+            ExitOnFailure(hr = E_INVALIDARG, "invalid maximum cpu percentage value: %d", dwPercent);
+        }
+        if (wz && L',' == *wz)
+        {
+            ++wz;
+            dwRefreshMinutes = wcstoul(wz, &wz, 10);
+            if (wz && L',' == *wz)
+            {
+                ++wz;
+                dwAction = wcstoul(wz, &wz, 10);
+            }
+        }
+        if (dwPercent)
+        {
+            hr = ScaWriteConfigID(IIS_APPPOOL_RECYCLE_CPU_PCT);
+            ExitOnFailure(hr, "failed to set recycle pct id");
+            hr = ScaWriteConfigInteger(dwPercent);
+            ExitOnFailure(hr, "failed to set CPU percentage max");
+        }
+        if (dwRefreshMinutes)
+        {
+            hr = ScaWriteConfigID(IIS_APPPOOL_RECYCLE_CPU_REFRESH);
+            ExitOnFailure(hr, "failed to set recycle refresh id");
+            hr = ScaWriteConfigInteger(dwRefreshMinutes);
+            ExitOnFailure(hr, "failed to set refresh CPU minutes");
+        }
+        if (dwAction)
+        {
+            // 0 = No Action
+            // 1 = Shutdown
+            hr = ScaWriteConfigID(IIS_APPPOOL_RECYCLE_CPU_ACTION);
+            ExitOnFailure(hr, "failed to set recycle refresh id");
+            hr = ScaWriteConfigInteger(dwAction);
+            ExitOnFailure(hr, "failed to set CPU action");
+        }
+    }
+
+    if (MSI_NULL_INTEGER != psap->iMaxProcesses)
+    {
+        hr = ScaWriteConfigID(IIS_APPPOOL_MAXPROCESS);
+        ExitOnFailure(hr, "Failed to write max processes config ID");
+
+        hr = ScaWriteConfigInteger(psap->iMaxProcesses);
+        ExitOnFailure(hr, "failed to set web garden maximum worker processes");
+    }
+
+    hr = ScaWriteConfigID(IIS_APPPOOL_32BIT);
+    ExitOnFailure(hr, "Failed to write 32 bit app pool config ID");
+    hr = ScaWriteConfigInteger(psap->iCompAttributes & msidbComponentAttributes64bit ? 0 : 1);
+    ExitOnFailure(hr, "Failed to write 32 bit app pool config value");
+
+    //
+    // Set the AppPool Identity tab
+    //
+    if (psap->iAttributes & APATTR_APPPOOLIDENTITY)
+    {
+        dwIdentity = 4;
+    }
+    else if (psap->iAttributes & APATTR_NETSERVICE)
+    {
+        dwIdentity = 2;
+    }
+    else if (psap->iAttributes & APATTR_LOCSERVICE)
+    {
+        dwIdentity = 1;
+    }
+    else if (psap->iAttributes & APATTR_LOCSYSTEM)
+    {
+        dwIdentity = 0;
+    }
+    else if (psap->iAttributes & APATTR_OTHERUSER)
+    {
+        if (!*psap->suUser.wzDomain || 0 == _wcsicmp(psap->suUser.wzDomain, L"."))
+        {
+            if (0 == _wcsicmp(psap->suUser.wzName, L"NetworkService"))
+            {
+                dwIdentity = 2;
+            }
+            else if (0 == _wcsicmp(psap->suUser.wzName, L"LocalService"))
+            {
+                dwIdentity = 1;
+            }
+            else if (0 == _wcsicmp(psap->suUser.wzName, L"LocalSystem"))
+            {
+                dwIdentity = 0;
+            }
+            else
+            {
+                dwIdentity = 3;
+            }
+        }
+        else if (0 == _wcsicmp(psap->suUser.wzDomain, L"NT AUTHORITY"))
+        {
+            if (0 == _wcsicmp(psap->suUser.wzName, L"NETWORK SERVICE"))
+            {
+                dwIdentity = 2;
+            }
+            else if (0 == _wcsicmp(psap->suUser.wzName, L"SERVICE"))
+            {
+                dwIdentity = 1;
+            }
+            else if (0 == _wcsicmp(psap->suUser.wzName, L"SYSTEM"))
+            {
+                dwIdentity = 0;
+            }
+            else
+            {
+                dwIdentity = 3;
+            }
+        }
+        else
+        {
+            dwIdentity = 3;
+        }
+    }
+
+    if (-1 != dwIdentity)
+    {
+        hr = ScaWriteConfigID(IIS_APPPOOL_IDENTITY);
+        ExitOnFailure(hr, "failed to set app pool identity id");
+        hr = ScaWriteConfigInteger(dwIdentity);
+        ExitOnFailure(hr, "failed to set app pool identity");
+
+        if (3 == dwIdentity)
+        {
+            if (*psap->suUser.wzDomain)
+            {
+                hr = StrAllocFormatted(&pwzValue, L"%s\\%s", psap->suUser.wzDomain, psap->suUser.wzName);
+                ExitOnFailure(hr, "failed to format user name: %ls domain: %ls", psap->suUser.wzName, psap->suUser.wzDomain);
+            }
+            else
+            {
+                hr = StrAllocFormatted(&pwzValue, L"%s", psap->suUser.wzName);
+                ExitOnFailure(hr, "failed to format user name: %ls", psap->suUser.wzName);
+            }
+
+            hr = ScaWriteConfigID(IIS_APPPOOL_USER);
+            ExitOnFailure(hr, "failed to set app pool identity name id");
+            hr = ScaWriteConfigString(pwzValue);
+            ExitOnFailure(hr, "failed to set app pool identity name");
+
+            hr = ScaWriteConfigID(IIS_APPPOOL_PWD);
+            ExitOnFailure(hr, "failed to set app pool identity password id");
+            hr = ScaWriteConfigString(psap->suUser.wzPassword);
+            ExitOnFailure(hr, "failed to set app pool identity password");
+        }
+    }
+    
+    if (*psap->wzManagedPipelineMode)
+    {
+        hr = ScaWriteConfigID(IIS_APPPOOL_MANAGED_PIPELINE_MODE);
+        ExitOnFailure(hr, "failed to set app pool integrated mode");
+        hr = ScaWriteConfigString(psap->wzManagedPipelineMode);
+        ExitOnFailure(hr, "failed to set app pool managed pipeline mode value");
+    }
+
+    if (*psap->wzManagedRuntimeVersion)
+    {
+        hr = ScaWriteConfigID(IIS_APPPOOL_MANAGED_RUNTIME_VERSION);
+        ExitOnFailure(hr, "failed to set app pool managed runtime version mode");
+        hr = ScaWriteConfigString(psap->wzManagedRuntimeVersion);
+        ExitOnFailure(hr, "failed to set app pool managed runtime version value");
+    }
+
+    //
+    //The number of properties above is variable so we put an end tag in so the
+    //execute CA will know when to stop looking for AppPool properties
+    //
+    hr = ScaWriteConfigID(IIS_APPPOOL_END);
+    ExitOnFailure(hr, "failed to set app pool end of properties id");
+
+LExit:
+    ReleaseStr(pwzValue);
+
+    return hr;
+}
+
+
+HRESULT ScaRemoveAppPool7(
+    __in const SCA_APPPOOL* psap
+    )
+{
+    Assert(psap);
+
+    HRESULT hr = S_OK;
+
+    //do not delete the default App Pool
+    if (0 != _wcsicmp(psap->wzAppPool, L"DefaultAppPool"))
+    {
+        //delete the app pool
+        hr = ScaWriteConfigID(IIS_APPPOOL);
+        ExitOnFailure(hr, "failed to write AppPool key.");
+
+        hr = ScaWriteConfigID(IIS_DELETE);
+        ExitOnFailure(hr, "failed to write AppPool delete action.");
+
+        hr = ScaWriteConfigString(psap->wzName);
+        ExitOnFailure(hr, "failed to delete AppPool: %ls", psap->wzName);
+    }
+
+LExit:
+    return hr;
+}
diff --git a/src/ca/scaapppool7.h b/src/ca/scaapppool7.h
new file mode 100644
index 00000000..1f49d899
--- /dev/null
+++ b/src/ca/scaapppool7.h
@@ -0,0 +1,36 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+#include "scauser.h"
+
+// Identity
+#define APATTR_NETSERVICE 0x0001 // Network Service
+#define APATTR_LOCSERVICE 0x0002 // Local Service
+#define APATTR_LOCSYSTEM 0x0004 // Local System
+#define APATTR_OTHERUSER 0x0008 // Other User
+#define APATTR_APPPOOLIDENTITY 0x0010 // ApplicationPoolIdentity
+
+// prototypes
+HRESULT ScaFindAppPool7(
+    __in LPCWSTR wzAppPool,
+    __out_ecount(cchName) LPWSTR wzName,
+    __in DWORD cchName,
+    __in SCA_APPPOOL *psapList
+    );
+
+HRESULT ScaAppPoolInstall7(
+    __in SCA_APPPOOL* psapList
+    );
+
+HRESULT ScaAppPoolUninstall7(
+    __in SCA_APPPOOL* psapList
+    );
+
+HRESULT ScaWriteAppPool7(
+    __in const SCA_APPPOOL* psap
+    );
+
+HRESULT ScaRemoveAppPool7(
+    __in const SCA_APPPOOL* psap
+    );
diff --git a/src/ca/scacert.cpp b/src/ca/scacert.cpp
new file mode 100644
index 00000000..90db6375
--- /dev/null
+++ b/src/ca/scacert.cpp
@@ -0,0 +1,1479 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+// prototypes
+static HRESULT ConfigureCertificates(
+    __in SCA_ACTION saAction
+    );
+
+static LPCWSTR StoreMapping(
+    __in int iStore
+    );
+
+static HRESULT FindExistingCertificate(
+    __in LPCWSTR wzName,
+    __in DWORD dwStoreLocation,
+    __in LPCWSTR wzStore,
+    __out BYTE** prgbCertificate,
+    __out DWORD* pcbCertificate
+    );
+
+static HRESULT ResolveCertificate(
+    __in LPCWSTR wzId,
+    __in LPCWSTR wzName,
+    __in DWORD dwStoreLocation,
+    __in LPCWSTR wzStoreName,
+    __in DWORD dwAttributess,
+    __in LPCWSTR wzData,
+    __in LPCWSTR wzPFXPassword,
+    __out BYTE** ppbCertificate,
+    __out DWORD* pcbCertificate
+    );
+
+static HRESULT ReadCertificateFile(
+    __in LPCWSTR wzPath,
+    __out BYTE** prgbData,
+    __out DWORD* pcbData
+    );
+
+static HRESULT CertificateToHash(
+    __in BYTE* pbCertificate,
+    __in DWORD cbCertificate,
+    __in DWORD dwStoreLocation,
+    __in LPCWSTR wzPFXPassword,
+    __in BYTE rgbHash[],
+    __in DWORD cbHash
+    );
+
+/*
+HRESULT ScaGetCertificateByPath(LPCWSTR pwzName, BOOL fIsInstalling,
+                                BOOL fIsUninstalling, INT iStore,
+                                INT iStoreLocation, LPCWSTR wzSslCertificate,
+                                LPCWSTR wzPFXPassword, BSTR* pbstrCertificate,
+                                DWORD* pcbCertificate, BYTE* pbaHashBuffer);
+
+HRESULT ScaGetCertificateByRequest(LPCWSTR pwzName, BOOL fIsInstalling,
+                                   BOOL fIsUninstalling, INT iStore,
+                                   INT iStoreLocation, LPCWSTR wzDistinguishedName,
+                                   LPCWSTR wzCA, BSTR* pbstrCertificate,
+                                   DWORD* pcbCertificate, BYTE* pbaHashBuffer);
+
+HRESULT ScaSslNewCertificate(LPCWSTR pwzName, INT iStore,
+                            INT iStoreLocation, LPCWSTR wzComputerName,
+                            LPCWSTR wzDistinguishedName, LPCWSTR wzCertificateAuthorityOrig,
+                            BSTR* pbstrCertificate, DWORD* pcbCertificate,
+                            BYTE* pbaHashBuffer);
+
+HRESULT ScaSslExistingCertificateByName(LPCWSTR pwzName, INT iStore,
+                                       INT iStoreLocation, BSTR* pbstrCertificate,
+                                       DWORD* pcbCertificate, BYTE* pbaHashBuffer);
+
+HRESULT ScaSslExistingCertificateByBinaryData(INT iStore, INT iStoreLocation,
+                                             BYTE* pwzData, DWORD cchData);
+
+HRESULT CreateEnroll(ICEnroll2 **hEnroll, INT iStore,
+                     INT iStoreLocation);
+
+HRESULT RequestCertificate(LPCWSTR pwzName, INT iStore,
+                           INT iStoreLocation, LPCWSTR wzComputerName,
+                           LPCWSTR wzDistinguishedName, LPCWSTR wzCertificateAuthority,
+                           BSTR *pbstrCertificate);
+
+VOID ParseCertificateAuthority(__in LPCWSTR wzCertificateAuthorityOrig, __out LPWSTR *pwzBuffer,
+                               __out LPWSTR **hwzCAArray, __out int *piCAArray);
+*/
+
+
+LPCWSTR vcsCertQuery = L"SELECT `Certificate`, `Name`, `Component_`, `StoreLocation`, `StoreName`, `Attributes`, `Binary_`, `CertificatePath`, `PFXPassword` FROM `Certificate`";
+enum eCertQuery { cqCertificate = 1, cqName, cqComponent, cqStoreLocation, cqStoreName, cqAttributes, cqCertificateBinary, cqCertificatePath, cqPFXPassword };
+
+
+/********************************************************************
+InstallCertificates - CUSTOM ACTION ENTRY POINT for installing
+                      certificates
+
+********************************************************************/
+extern "C" UINT __stdcall InstallCertificates(
+    __in MSIHANDLE hInstall
+    )
+{
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    // initialize
+    hr = WcaInitialize(hInstall, "InstallCertificates");
+    ExitOnFailure(hr, "Failed to initialize");
+
+    hr = ConfigureCertificates(SCA_ACTION_INSTALL);
+
+LExit:
+    er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+
+/********************************************************************
+UninstallCertificates - CUSTOM ACTION ENTRY POINT for uninstalling
+                        certificates
+
+********************************************************************/
+extern "C" UINT __stdcall UninstallCertificates(
+    __in MSIHANDLE hInstall
+    )
+{
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    // initialize
+    hr = WcaInitialize(hInstall, "UninstallCertificates");
+    ExitOnFailure(hr, "Failed to initialize");
+
+    hr = ConfigureCertificates(SCA_ACTION_UNINSTALL);
+
+LExit:
+    er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+
+static HRESULT ConfigureCertificates(
+    __in SCA_ACTION saAction
+    )
+{
+    //AssertSz(FALSE, "debug ConfigureCertificates().");
+
+    HRESULT hr = S_OK;
+    DWORD er = ERROR_SUCCESS;
+
+    PMSIHANDLE hViewCertificate;
+    PMSIHANDLE hRecCertificate;
+    INSTALLSTATE isInstalled = INSTALLSTATE_UNKNOWN;
+    INSTALLSTATE isAction = INSTALLSTATE_UNKNOWN;
+
+    WCHAR* pwzId = NULL;
+    WCHAR* pwzName = NULL;
+    WCHAR* pwzComponent = NULL;
+    int iData = 0;
+    DWORD dwStoreLocation = 0;
+    LPWSTR pwzStoreName = 0;
+    DWORD dwAttributes = 0;
+    WCHAR* pwzData = NULL;
+    WCHAR* pwzPFXPassword = NULL;
+    WCHAR* pwzCaData = NULL;
+    WCHAR* pwzRollbackCaData = NULL;
+
+    BYTE* pbCertificate = NULL;
+    DWORD cbCertificate = 0;
+    DWORD cbPFXPassword = 0;
+
+    // Bail quickly if the Certificate table isn't around.
+    if (S_OK != WcaTableExists(L"Certificate"))
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping ConfigureCertificates() - required table not present.");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    // Process the Certificate table.
+    hr = WcaOpenExecuteView(vcsCertQuery, &hViewCertificate);
+    ExitOnFailure(hr, "failed to open view on Certificate table");
+
+    while (SUCCEEDED(hr = WcaFetchRecord(hViewCertificate, &hRecCertificate)))
+    {
+        hr = WcaGetRecordString(hRecCertificate, cqCertificate, &pwzId); // the id is just useful to have up front
+        ExitOnFailure(hr, "failed to get Certificate.Certificate");
+
+        hr = WcaGetRecordString(hRecCertificate, cqComponent, &pwzComponent);
+        ExitOnFailure(hr, "failed to get Certificate.Component_");
+
+        er = ::MsiGetComponentStateW(WcaGetInstallHandle(), pwzComponent, &isInstalled, &isAction);
+        hr = HRESULT_FROM_WIN32(er);
+        ExitOnFailure(hr, "failed to get state for component: %ls", pwzComponent);
+
+        if (!(WcaIsInstalling(isInstalled, isAction) && SCA_ACTION_INSTALL == saAction) &&
+            !(WcaIsUninstalling(isInstalled, isAction) && SCA_ACTION_UNINSTALL == saAction) &&
+            !(WcaIsReInstalling(isInstalled, isAction)))
+        {
+            WcaLog(LOGMSG_VERBOSE, "Skipping non-action certificate: %ls", pwzId);
+            continue;
+        }
+
+        // extract the rest of the data from the Certificate table
+        hr = WcaGetRecordFormattedString(hRecCertificate, cqName, &pwzName);
+        ExitOnFailure(hr, "failed to get Certificate.Name");
+
+        hr = WcaGetRecordInteger(hRecCertificate, cqStoreLocation, &iData);
+        ExitOnFailure(hr, "failed to get Certificate.StoreLocation");
+
+        switch (iData)
+        {
+        case SCA_CERTSYSTEMSTORE_CURRENTUSER:
+            dwStoreLocation = CERT_SYSTEM_STORE_CURRENT_USER;
+            break;
+        case SCA_CERTSYSTEMSTORE_LOCALMACHINE:
+            dwStoreLocation = CERT_SYSTEM_STORE_LOCAL_MACHINE;
+            break;
+        default:
+            hr = E_INVALIDARG;
+            ExitOnFailure(hr, "Invalid store location value: %d", iData);
+        }
+
+        hr = WcaGetRecordString(hRecCertificate, cqStoreName, &pwzStoreName);
+        ExitOnFailure(hr, "failed to get Certificate.StoreName");
+
+        hr = WcaGetRecordInteger(hRecCertificate, cqAttributes, reinterpret_cast<int*>(&dwAttributes));
+        ExitOnFailure(hr, "failed to get Certificate.Attributes");
+
+        if (dwAttributes & SCA_CERT_ATTRIBUTE_BINARYDATA)
+        {
+            hr = WcaGetRecordString(hRecCertificate, cqCertificateBinary, &pwzData);
+            ExitOnFailure(hr, "failed to get Certificate.Binary_");
+        }
+        else
+        {
+            hr = WcaGetRecordFormattedString(hRecCertificate, cqCertificatePath, &pwzData);
+            ExitOnFailure(hr, "failed to get Certificate.CertificatePath");
+        }
+
+        hr = WcaGetRecordFormattedString(hRecCertificate, cqPFXPassword, &pwzPFXPassword);
+        ExitOnFailure(hr, "failed to get Certificate.PFXPassword");
+
+        // Write the common data (for both install and uninstall) to the CustomActionData
+        // to pass data to the deferred CustomAction.
+        hr = StrAllocString(&pwzCaData, pwzName, 0);
+        ExitOnFailure(hr, "Failed to pass Certificate.Certificate to deferred CustomAction.");
+        hr = WcaWriteStringToCaData(pwzStoreName, &pwzCaData);
+        ExitOnFailure(hr, "Failed to pass Certificate.StoreName to deferred CustomAction.");
+        hr = WcaWriteIntegerToCaData(SCA_CERT_ATTRIBUTE_BINARYDATA, &pwzCaData);
+        ExitOnFailure(hr, "Failed to pass Certificate.Attributes to deferred CustomAction.");
+
+        // Copy the rollback data from the deferred data because it's the same up to this point.
+        hr = StrAllocString(&pwzRollbackCaData, pwzCaData, 0);
+        ExitOnFailure(hr, "Failed to allocate string for rollback CustomAction.");
+
+        // Finally, schedule the correct deferred CustomAction to actually do work.
+        LPCWSTR wzAction = NULL;
+        LPCWSTR wzRollbackAction = NULL;
+        DWORD dwCost = 0;
+        if (SCA_ACTION_UNINSTALL == saAction)
+        {
+            // Find an existing certificate one (if there is one) to so we have it for rollback.
+            hr = FindExistingCertificate(pwzName, dwStoreLocation, pwzStoreName, &pbCertificate, &cbCertificate);
+            ExitOnFailure(hr, "Failed to search for existing certificate with friendly name: %ls", pwzName);
+
+            if (pbCertificate)
+            {
+                hr = WcaWriteStreamToCaData(pbCertificate, cbCertificate, &pwzRollbackCaData);
+                ExitOnFailure(hr, "Failed to pass Certificate.Data to rollback CustomAction.");
+
+                hr = WcaWriteStringToCaData(pwzPFXPassword, &pwzRollbackCaData);
+                ExitOnFailure(hr, "Failed to pass Certificate.PFXPassword to rollback CustomAction.");
+            }
+
+            // Pick the right action to run based on what store we're uninstalling from.
+            if (CERT_SYSTEM_STORE_LOCAL_MACHINE == dwStoreLocation)
+            {
+                wzAction = L"DeleteMachineCertificate";
+                if (pbCertificate)
+                {
+                    wzRollbackAction = L"RollbackDeleteMachineCertificate";
+                }
+            }
+            else
+            {
+                wzAction = L"DeleteUserCertificate";
+                if (pbCertificate)
+                {
+                    wzRollbackAction = L"RollbackDeleteUserCertificate";
+                }
+            }
+            dwCost = COST_CERT_DELETE;
+        }
+        else
+        {
+            // Actually get the certificate, resolve it to a blob, and get the blob's hash.
+            hr = ResolveCertificate(pwzId, pwzName, dwStoreLocation, pwzStoreName, dwAttributes, pwzData, pwzPFXPassword, &pbCertificate, &cbCertificate);
+            ExitOnFailure(hr, "Failed to resolve certificate: %ls", pwzId);
+
+            hr = WcaWriteStreamToCaData(pbCertificate, cbCertificate, &pwzCaData);
+            ExitOnFailure(hr, "Failed to pass Certificate.Data to deferred CustomAction.");
+
+            hr = WcaWriteStringToCaData(pwzPFXPassword, &pwzCaData);
+            ExitOnFailure(hr, "Failed to pass Certificate.PFXPassword to deferred CustomAction.");
+
+            // Pick the right action to run based on what store we're installing into.
+            if (CERT_SYSTEM_STORE_LOCAL_MACHINE == dwStoreLocation)
+            {
+                wzAction = L"AddMachineCertificate";
+                wzRollbackAction = L"RollbackAddMachineCertificate";
+            }
+            else
+            {
+                wzAction = L"AddUserCertificate";
+                wzRollbackAction = L"RollbackAddUserCertificate";
+            }
+            dwCost = COST_CERT_ADD;
+        }
+
+        if (wzRollbackAction)
+        {
+            hr = WcaDoDeferredAction(wzRollbackAction, pwzRollbackCaData, dwCost);
+            ExitOnFailure(hr, "Failed to schedule rollback certificate action '%ls' for: %ls", wzRollbackAction, pwzId);
+        }
+
+        hr = WcaDoDeferredAction(wzAction, pwzCaData, dwCost);
+        ExitOnFailure(hr, "Failed to schedule certificate action '%ls' for: %ls", wzAction, pwzId);
+
+        // Clean up for the next certificate.
+        ReleaseNullMem(pbCertificate);
+    }
+
+    if (E_NOMOREITEMS == hr)
+    {
+        hr = S_OK;
+    }
+
+LExit:
+    if (NULL != pwzPFXPassword && SUCCEEDED(StrSize(pwzPFXPassword, &cbPFXPassword)))
+    {
+        SecureZeroMemory(pwzPFXPassword, cbPFXPassword);
+    }
+
+    ReleaseMem(pbCertificate);
+    ReleaseStr(pwzCaData);
+    ReleaseStr(pwzPFXPassword);
+    ReleaseStr(pwzData);
+    ReleaseStr(pwzName);
+    ReleaseStr(pwzStoreName);
+    ReleaseStr(pwzComponent);
+    ReleaseStr(pwzId);
+
+    return hr;
+}
+
+
+static HRESULT ResolveCertificate(
+    __in LPCWSTR wzId,
+    __in LPCWSTR /*wzName*/,
+    __in DWORD dwStoreLocation,
+    __in LPCWSTR /*wzStoreName*/,
+    __in DWORD dwAttributes,
+    __in LPCWSTR wzData,
+    __in LPCWSTR wzPFXPassword,
+    __out BYTE** ppbCertificate,
+    __out DWORD* pcbCertificate
+    )
+{
+    HRESULT hr = S_OK;
+
+    LPWSTR pwzSql = NULL;
+    PMSIHANDLE hView;
+    PMSIHANDLE hRec;
+    MSIHANDLE hCertificateHashView = NULL;
+    MSIHANDLE hCertificateHashColumns = NULL;
+
+    BYTE rgbCertificateHash[CB_CERTIFICATE_HASH] = { 0 };
+    WCHAR wzEncodedCertificateHash[CB_CERTIFICATE_HASH * 2 + 1] = { 0 };
+
+    PMSIHANDLE hViewCertificateRequest, hRecCertificateRequest;
+
+    WCHAR* pwzDistinguishedName = NULL;
+    WCHAR* pwzCA = NULL;
+
+    BYTE* pbData = NULL;
+    DWORD cbData = 0;
+
+    if (dwAttributes & SCA_CERT_ATTRIBUTE_REQUEST)
+    {
+        hr = E_NOTIMPL;
+        ExitOnFailure(hr, "Installing certificates by requesting them from a certificate authority is not currently supported");
+        //if (dwAttributes & SCA_CERT_ATTRIBUTE_OVERWRITE)
+        //{
+        //    // try to overwrite with the patch to a cert file
+        //    WcaLog(LOGMSG_VERBOSE, "ConfigureCertificates - Overwrite with SSLCERTIFICATE");
+        //    hr = ScaGetCertificateByPath(pwzName, fIsInstalling, fIsUninstalling,
+        //        iStore, iStoreLocation, pwzData, wzPFXPassword, pbstrCertificate, pcbCertificate, pbaHashBuffer);
+        //}
+        //if (hr != S_OK)
+        //{
+        //    if (fIsUninstalling && !fIsInstalling)
+        //    {
+        //        // for uninstall, we just want to find the existing certificate
+        //        hr = ScaSslExistingCertificateByName(pwzName, iStore, iStoreLocation, pbstrCertificate, pcbCertificate, pbaHashBuffer);
+        //        ExitOnFailure(hr, "Failed Retrieving existing certificate during uninstall");
+        //        // ok if no existing cert
+        //        if (S_OK != hr)
+        //            hr = S_OK;
+        //    }
+        //    else
+        //    {
+        //        // still no certificate
+        //        // user has request this certificate, try to locate DistinguishedName and CA
+        //        hr = WcaTableExists(L"CertificateRequest");
+        //        ExitOnFailure(hr, "CertificateRequest is referenced but not found");
+        //        WcaLog(LOGMSG_VERBOSE, "ConfigureCertificates - CertificateRequest table present");
+        //        cchSQLView = 255 + lstrlenW(pwzName);
+        //        pwzSQLView = new WCHAR[cchSQLView];
+        //        if (pwzSQLView)
+        //        {
+        //            hr = ::StringCchPrintfW(pwzSQLView, cchSQLView, L"SELECT `DistinguishedName`, `CA` FROM `CertificateRequest` WHERE `Certificate_`=\'%s\'", pwzName);
+        //            ExitOnFailure(hr, "::StringCchPrintfW failed");
+        //            hr = WcaOpenExecuteView(pwzSQLView, &hViewCertificateRequest);
+        //            ExitOnFailure(hr, "failed to open view on CertificateRequest table");
+        //            hr = WcaFetchSingleRecord(hViewCertificateRequest, &hRecCertificateRequest);
+        //            ExitOnFailure(hr, "failed to retrieve request from CertificateRequest table");
+        //            hr = WcaGetRecordString(hRecCertificateRequest,  1, &pwzDistinguishedName);
+        //            ExitOnFailure(hr, "failed to get DistinguishedName");
+        //            hr = WcaGetRecordString(hRecCertificateRequest,  2, &pwzCA);
+        //            ExitOnFailure(hr, "failed to get CA");
+        //            if (pwzDistinguishedName && pwzCA && *pwzDistinguishedName && *pwzCA)
+        //            {
+        //                hr = ScaGetCertificateByRequest(pwzName, fIsInstalling, fIsUninstalling, iStore, iStoreLocation, pwzDistinguishedName, pwzCA, pbstrCertificate, pcbCertificate, pbaHashBuffer);
+        //            }
+        //            else
+        //            {
+        //                hr = E_FAIL;
+        //                ExitOnFailure(hr, "CertificateRequest entry is empty");
+        //            }
+        //        }
+        //        else
+        //        {
+        //            hr = E_FAIL;
+        //            ExitOnFailure(hr, "Out of memory");
+        //        }
+        //    }
+        //}
+    }
+    else if (dwAttributes & SCA_CERT_ATTRIBUTE_BINARYDATA)
+    {
+        // get the binary stream in Binary
+        hr = WcaTableExists(L"Binary");
+        if (S_OK != hr)
+        {
+            if (SUCCEEDED(hr))
+            {
+                hr = E_UNEXPECTED;
+            }
+            ExitOnFailure(hr, "Binary was referenced but there is no Binary table.");
+        }
+
+        hr = StrAllocFormatted(&pwzSql, L"SELECT `Data` FROM `Binary` WHERE `Name`=\'%s\'", wzData);
+        ExitOnFailure(hr, "Failed to allocate Binary table query.");
+
+        hr = WcaOpenExecuteView(pwzSql, &hView);
+        ExitOnFailure(hr, "Failed to open view on Binary table");
+
+        hr = WcaFetchSingleRecord(hView, &hRec);
+        ExitOnFailure(hr, "Failed to retrieve request from Binary table");
+
+        hr = WcaGetRecordStream(hRec, 1, &pbData, &cbData);
+        ExitOnFailure(hr, "Failed to ready Binary.Data for certificate.");
+    }
+    else if (dwAttributes == SCA_CERT_ATTRIBUTE_DEFAULT)
+    {
+        hr = ReadCertificateFile(wzData, &pbData, &cbData);
+        ExitOnFailure(hr, "Failed to read certificate from file path.");
+    }
+    else
+    {
+        hr = E_INVALIDARG;
+        ExitOnFailure(hr, "Invalid Certificate.Attributes.");
+    }
+
+    // If we have loaded a certificate, update the Certificate.Hash column.
+    if (pbData)
+    {
+        hr = CertificateToHash(pbData, cbData, dwStoreLocation, wzPFXPassword, rgbCertificateHash, countof(rgbCertificateHash));
+        ExitOnFailure(hr, "Failed to get SHA1 hash of certificate.");
+
+        hr = StrHexEncode(rgbCertificateHash, countof(rgbCertificateHash), wzEncodedCertificateHash, countof(wzEncodedCertificateHash));
+        ExitOnFailure(hr, "Failed to hex encode SHA1 hash of certificate.");
+
+        // Update the CertificateHash table.
+        hr = WcaAddTempRecord(&hCertificateHashView, &hCertificateHashColumns, L"CertificateHash", NULL, 0, 2, wzId, wzEncodedCertificateHash);
+        ExitOnFailure(hr, "Failed to add encoded has for certificate: %ls", wzId);
+    }
+
+    *ppbCertificate = pbData;
+    *pcbCertificate = cbData;
+    pbData = NULL;
+
+LExit:
+    if (hCertificateHashColumns)
+    {
+        ::MsiCloseHandle(hCertificateHashColumns);
+    }
+
+    if (hCertificateHashView)
+    {
+        ::MsiCloseHandle(hCertificateHashView);
+    }
+
+    ReleaseStr(pwzDistinguishedName);
+    ReleaseStr(pwzCA);
+    ReleaseMem(pbData);
+    ReleaseStr(pwzSql);
+
+    return hr;
+}
+
+
+static HRESULT ReadCertificateFile(
+    __in LPCWSTR wzPath,
+    __out BYTE** prgbData,
+    __out DWORD* pcbData
+    )
+{
+    HRESULT hr = S_OK;
+
+    PCCERT_CONTEXT pCertContext = NULL;
+    DWORD dwContentType;
+    BYTE* pbData = NULL;
+    DWORD cbData = 0;
+
+    if (!::CryptQueryObject(CERT_QUERY_OBJECT_FILE, reinterpret_cast<LPCVOID>(wzPath), CERT_QUERY_CONTENT_FLAG_ALL, CERT_QUERY_FORMAT_FLAG_ALL, 0, NULL, &dwContentType, NULL, NULL, NULL, (LPCVOID*)&pCertContext))
+    {
+        ExitOnFailure(hr, "Failed to read certificate from file: %ls", wzPath);
+    }
+
+    if (pCertContext)
+    {
+        cbData = pCertContext->cbCertEncoded;
+        pbData = static_cast<BYTE*>(MemAlloc(cbData, FALSE));
+        ExitOnNull(pbData, hr, E_OUTOFMEMORY, "Failed to allocate memory to read certificate from file: %ls", wzPath);
+
+        CopyMemory(pbData, pCertContext->pbCertEncoded, pCertContext->cbCertEncoded);
+    }
+    else
+    {
+        // If we have a PFX blob, get the first certificate out of the PFX and use that instead of the PFX.
+        if (dwContentType & CERT_QUERY_CONTENT_PFX)
+        {
+            hr = FileRead(&pbData, &cbData, wzPath);
+            ExitOnFailure(hr, "Failed to read PFX file: %ls", wzPath);
+        }
+        else
+        {
+            hr = E_UNEXPECTED;
+            ExitOnFailure(hr, "Unexpected certificate type read from disk.");
+        }
+    }
+
+    *pcbData = cbData;
+    *prgbData = pbData;
+    pbData = NULL;
+
+LExit:
+    ReleaseMem(pbData);
+    return hr;
+}
+
+
+static HRESULT CertificateToHash(
+    __in BYTE* pbCertificate,
+    __in DWORD cbCertificate,
+    __in DWORD dwStoreLocation,
+    __in LPCWSTR wzPFXPassword,
+    __in BYTE rgbHash[],
+    __in DWORD cbHash
+    )
+{
+    HRESULT hr = S_OK;
+
+    HCERTSTORE hPfxCertStore = NULL;
+    PCCERT_CONTEXT pCertContext = NULL;
+    PCCERT_CONTEXT pCertContextEnum = NULL;
+    CRYPT_DATA_BLOB blob = { 0 };
+    CRYPT_KEY_PROV_INFO* pPfxInfo = NULL;
+    DWORD dwKeyset = (CERT_SYSTEM_STORE_CURRENT_USER == dwStoreLocation) ? CRYPT_USER_KEYSET : CRYPT_MACHINE_KEYSET;
+    DWORD dwEncodingType;
+    DWORD dwContentType;
+    DWORD dwFormatType;
+
+    blob.pbData = pbCertificate;
+    blob.cbData = cbCertificate;
+
+    if (!::CryptQueryObject(CERT_QUERY_OBJECT_BLOB, &blob, CERT_QUERY_CONTENT_FLAG_ALL, CERT_QUERY_FORMAT_FLAG_ALL, 0, &dwEncodingType, &dwContentType, &dwFormatType, NULL, NULL, (LPCVOID*)&pCertContext))
+    {
+        ExitWithLastError(hr, "Failed to process certificate as a valid certificate.");
+    }
+
+    if (!pCertContext)
+    {
+        // If we have a PFX blob, get the first certificate out of the PFX and use that instead of the PFX.
+        if (dwContentType & CERT_QUERY_CONTENT_PFX)
+        {
+            // If we fail and our password is blank, also try passing in NULL for the password (according to the docs)
+            hPfxCertStore = ::PFXImportCertStore((CRYPT_DATA_BLOB*)&blob, wzPFXPassword, dwKeyset);
+            if (NULL == hPfxCertStore && !*wzPFXPassword)
+            {
+                hPfxCertStore = ::PFXImportCertStore((CRYPT_DATA_BLOB*)&blob, NULL, dwKeyset);
+            }
+            ExitOnNullWithLastError(hPfxCertStore, hr, "Failed to open PFX file.");
+
+            // Find the first cert with a private key, or just use the last one
+            for (pCertContextEnum = ::CertEnumCertificatesInStore(hPfxCertStore, pCertContextEnum);
+                 pCertContextEnum;
+                 pCertContextEnum = ::CertEnumCertificatesInStore(hPfxCertStore, pCertContextEnum))
+            {
+                pCertContext = pCertContextEnum;
+
+                if (pCertContext && CertHasPrivateKey(pCertContext, NULL))
+                {
+                    break;
+                }
+            }
+
+            ExitOnNullWithLastError(pCertContext, hr, "Failed to read first certificate out of PFX file.");
+
+            // Ignore failures, the worst that happens is some parts of the PFX get left behind.
+            CertReadProperty(pCertContext, CERT_KEY_PROV_INFO_PROP_ID, &pPfxInfo, NULL);
+        }
+        else
+        {
+            hr = E_UNEXPECTED;
+            ExitOnFailure(hr, "Unexpected certificate type processed.");
+        }
+    }
+
+    DWORD cb = cbHash;
+    if (!::CertGetCertificateContextProperty(pCertContext, CERT_SHA1_HASH_PROP_ID, static_cast<LPVOID>(rgbHash), &cb))
+    {
+        ExitWithLastError(hr, "Failed to get certificate SHA1 hash property.");
+    }
+    AssertSz(cb == cbHash, "Did not correctly read certificate SHA1 hash.");
+
+LExit:
+    if (pCertContext)
+    {
+        ::CertFreeCertificateContext(pCertContext);
+    }
+
+    if (hPfxCertStore)
+    {
+        ::CertCloseStore(hPfxCertStore, 0);
+    }
+
+    if (pPfxInfo)
+    {
+        HCRYPTPROV hProvIgnored = NULL; // ignored on deletes.
+        ::CryptAcquireContextW(&hProvIgnored, pPfxInfo->pwszContainerName, pPfxInfo->pwszProvName, pPfxInfo->dwProvType, dwKeyset | CRYPT_DELETEKEYSET | CRYPT_SILENT);
+
+        MemFree(pPfxInfo);
+    }
+
+    return hr;
+}
+
+
+static HRESULT FindExistingCertificate(
+    __in LPCWSTR wzName,
+    __in DWORD dwStoreLocation,
+    __in LPCWSTR wzStore,
+    __out BYTE** prgbCertificate,
+    __out DWORD* pcbCertificate
+    )
+{
+    HRESULT hr = S_OK;
+    HCERTSTORE hCertStore = NULL;
+    PCCERT_CONTEXT pCertContext = NULL;
+    BYTE* pbCertificate = NULL;
+    DWORD cbCertificate = 0;
+
+    hCertStore = ::CertOpenStore(CERT_STORE_PROV_SYSTEM, 0, NULL, dwStoreLocation | CERT_STORE_READONLY_FLAG, wzStore);
+    MessageExitOnNullWithLastError(hCertStore, hr, msierrCERTFailedOpen, "Failed to open certificate store.");
+
+    // Loop through the certificate, looking for certificates that match our friendly name.
+    pCertContext = CertFindCertificateInStore(hCertStore, PKCS_7_ASN_ENCODING | X509_ASN_ENCODING, 0, CERT_FIND_ANY, NULL, NULL);
+    while (pCertContext)
+    {
+        WCHAR wzFriendlyName[256] = { 0 };
+        DWORD cbFriendlyName = sizeof(wzFriendlyName);
+
+        if (::CertGetCertificateContextProperty(pCertContext, CERT_FRIENDLY_NAME_PROP_ID, reinterpret_cast<BYTE*>(wzFriendlyName), &cbFriendlyName) &&
+            CSTR_EQUAL == ::CompareStringW(LOCALE_SYSTEM_DEFAULT, 0, wzName, -1, wzFriendlyName, -1))
+        {
+            // If the certificate with matching friendly name is valid, let's use that.
+            long lVerify = ::CertVerifyTimeValidity(NULL, pCertContext->pCertInfo);
+            if (0 == lVerify)
+            {
+                cbCertificate = pCertContext->cbCertEncoded;
+                pbCertificate = static_cast<BYTE*>(MemAlloc(cbCertificate, FALSE));
+                ExitOnNull(pbCertificate, hr, E_OUTOFMEMORY, "Failed to allocate memory to copy out exist certificate.");
+
+                CopyMemory(pbCertificate, pCertContext->pbCertEncoded, cbCertificate);
+                break; // found a matching certificate, no more searching necessary
+            }
+        }
+
+         // Next certificate in the store.
+        PCCERT_CONTEXT pNext = ::CertFindCertificateInStore(hCertStore, PKCS_7_ASN_ENCODING | X509_ASN_ENCODING, 0, CERT_FIND_ANY, NULL, pCertContext);
+        // old pCertContext is freed by CertFindCertificateInStore
+        pCertContext = pNext;
+    }
+
+    *prgbCertificate = pbCertificate;
+    *pcbCertificate = cbCertificate;
+    pbCertificate = NULL;
+
+LExit:
+    ReleaseMem(pbCertificate);
+
+    if (pCertContext)
+    {
+        ::CertFreeCertificateContext(pCertContext);
+    }
+
+    if (hCertStore)
+    {
+        ::CertCloseStore(hCertStore, 0);
+    }
+
+    return hr;
+}
+
+/*
+HRESULT CreateEnroll(ICEnroll2 **hEnroll, INT iStore, INT iStoreLocation)
+{
+    ICEnroll2 *pEnroll = NULL;
+    HRESULT hr = S_OK;
+    LONG lFlags;
+    DWORD dwFlags = iStoreLocation << CERT_SYSTEM_STORE_LOCATION_SHIFT;
+
+    // create IEntroll
+    hr = CoCreateInstance( CLSID_CEnroll, NULL, CLSCTX_INPROC_SERVER, IID_ICEnroll2, (void **)&pEnroll );
+    if (FAILED(hr))
+        return hr;
+
+    switch (iStore)
+    {
+    case SCA_CERT_STORENAME_MY:
+        pEnroll->get_MyStoreFlags(&lFlags);
+        lFlags &= ~CERT_SYSTEM_STORE_LOCATION_MASK;
+        lFlags |= dwFlags;
+        // following call will change Request store flags also
+        pEnroll->put_MyStoreFlags(lFlags);
+        break;
+    case SCA_CERT_STORENAME_CA:
+        pEnroll->get_CAStoreFlags(&lFlags);
+        lFlags &= ~CERT_SYSTEM_STORE_LOCATION_MASK;
+        lFlags |= dwFlags;
+        // following call will change Request store flags also
+        pEnroll->put_CAStoreFlags(lFlags);
+        break;
+    case SCA_CERT_STORENAME_REQUEST:
+        pEnroll->get_RequestStoreFlags(&lFlags);
+        lFlags &= ~CERT_SYSTEM_STORE_LOCATION_MASK;
+        lFlags |= dwFlags;
+        // following call will change Request store flags also
+        pEnroll->put_RequestStoreFlags(lFlags);
+        break;
+    case SCA_CERT_STORENAME_ROOT:
+        pEnroll->get_RootStoreFlags(&lFlags);
+        lFlags &= ~CERT_SYSTEM_STORE_LOCATION_MASK;
+        lFlags |= dwFlags;
+        // following call will change Request store flags also
+        pEnroll->put_RootStoreFlags(lFlags);
+        break;
+    default:
+        hr = E_FAIL;
+        return hr;
+    }
+
+    pEnroll->get_GenKeyFlags(&lFlags);
+    lFlags |= CRYPT_EXPORTABLE;
+    pEnroll->put_GenKeyFlags(lFlags);
+
+    pEnroll->put_KeySpec(AT_KEYEXCHANGE);
+    pEnroll->put_ProviderType(PROV_RSA_SCHANNEL);
+    pEnroll->put_DeleteRequestCert(TRUE);
+
+    *hEnroll = pEnroll;
+    return hr;
+}
+
+
+HRESULT RequestCertificate(LPCWSTR pwzName, INT iStore, INT iStoreLocation,
+                           LPCWSTR wzComputerName, LPCWSTR wzDistinguishedName, LPCWSTR wzCertificateAuthority,
+                           BSTR *pbstrCertificate)
+{
+    if (pbstrCertificate == NULL)
+        return E_INVALIDARG;
+
+    HRESULT hr;
+    ICEnroll2 *pEnroll = NULL;
+    ICertRequest *pCertRequest = NULL;
+    BSTR bstrRequest = NULL;
+    LONG nDisposition;
+
+    BSTR bstrCertificateUsage = NULL;
+    BSTR bstrCertificateAttributes = NULL;
+    BSTR bstrCertificateAuthority = NULL;
+
+    // equivalent to: sprintf(bstrDistinguishedName, L"%s,CN=%s", wzDistinguishedName, wzComputerName);
+    DWORD cchComputerName = lstrlenW(wzComputerName);
+    DWORD cchDistinguishedName = lstrlenW(wzDistinguishedName);
+    CONST DWORD cchbstrDistinguishedName = 5 + cchComputerName + cchDistinguishedName;
+    BSTR bstrDistinguishedName = SysAllocStringLen(NULL, cchbstrDistinguishedName);
+    ExitOnNull(bstrDistinguishedName, hr, E_OUTOFMEMORY, "Failed to allocate space for distinguished name.");
+    ::StringCchCopyW((WCHAR*) bstrDistinguishedName, cchbstrDistinguishedName, wzDistinguishedName);
+    ::StringCchCatW((WCHAR*) bstrDistinguishedName, cchbstrDistinguishedName, L",CN=");
+    ::StringCchCatW((WCHAR*) bstrDistinguishedName, cchbstrDistinguishedName, wzComputerName);
+
+    bstrCertificateUsage = SysAllocString(WIDE(szOID_PKIX_KP_SERVER_AUTH));
+    ExitOnNull(bstrCertificateUsage, hr, E_OUTOFMEMORY, "Failed to allocate space for Certificate Usage.");
+    bstrCertificateAttributes = SysAllocString(L"CertificateTemplate:WebServer");
+    bstrCertificateAuthority = SysAllocString(wzCertificateAuthority);
+    ExitOnNull(bstrCertificateAuthority, hr, E_OUTOFMEMORY, "Failed to allocate space for Certificate Authority.");
+
+    hr = CreateEnroll(&pEnroll, iStore, iStoreLocation);
+    ExitOnFailure(hr, "failed CoCreateInstance IEnroll");
+
+    hr = pEnroll->createPKCS10(bstrDistinguishedName, bstrCertificateUsage, &bstrRequest);
+    ExitOnFailure(hr, "failed createPKCS10");
+
+    hr = CoCreateInstance(CLSID_CCertRequest, NULL, CLSCTX_INPROC_SERVER, IID_ICertRequest, (void **)&pCertRequest);
+    ExitOnFailure(hr, "failed CoCreateInstance ICertRequest");
+
+    hr = pCertRequest->Submit(CR_IN_BASE64 | CR_IN_PKCS10, bstrRequest, bstrCertificateAttributes, bstrCertificateAuthority, &nDisposition);
+    ExitOnFailure(hr, "failed ICertRequest.Submit");
+
+    hr = (nDisposition == CR_DISP_ISSUED) ? S_OK : E_FAIL;
+    ExitOnFailure(hr, "failed CR_DISP_ISSUED");
+
+    hr = pCertRequest->GetCertificate(CR_OUT_BASE64, pbstrCertificate);
+    ExitOnFailure(hr, "failed ICertRequest.GetCertificate");
+
+    // save the certificate in place, cannot be passed to a deferred custom action
+    hr = pEnroll->acceptPKCS7(*pbstrCertificate);
+    ExitOnFailure(hr, "failed accept certificate into MY store");
+
+LExit:
+    ReleaseObject(pCertRequest);
+    ReleaseBSTR(bstrRequest);
+    ReleaseObject(pEnroll);
+    ReleaseBSTR(bstrCertificateAuthority);
+    ReleaseBSTR(bstrCertificateAttributes);
+    ReleaseBSTR(bstrDistinguishedName);
+
+    return hr;
+}
+
+
+VOID ParseCertificateAuthority(__in LPCWSTR wzCertificateAuthorityOrig, __out LPWSTR *pwzBuffer, __out LPWSTR **hwzCAArray, __out int *piCAArray)
+{
+    // @asAuthorities = split /;/, $sAuthority;
+    CONST WCHAR wchDelimiter = L';';
+
+    // copy constant into a buffer
+    Assert(wzCertificateAuthorityOrig);
+
+    INT cchCA = lstrlenW(wzCertificateAuthorityOrig) + 1;
+    WCHAR* wzBuffer = new WCHAR[cchCA];
+    if (!wzBuffer)
+        return;
+
+    ::StringCchCopyW(wzBuffer, cchCA, wzCertificateAuthorityOrig);
+
+    // determine the number of strings in the field
+    int iCAArray = 1;
+    int i;
+    for (i = 0; i < cchCA; ++i)
+    {
+        if (wzBuffer[i] == wchDelimiter)
+            ++iCAArray;
+    }
+    LPWSTR *pwzCAArray = (LPWSTR*) new BYTE[iCAArray * sizeof(LPWSTR)];
+    if (!pwzCAArray)
+    {
+        return;
+    }
+
+    pwzCAArray[0] = wzBuffer;
+    iCAArray = 0;
+    for (i = 0; i < cchCA; ++i)
+    {
+        if (wzBuffer[i] != wchDelimiter)
+            continue;
+        wzBuffer[i] = 0; // convert buffer into MULTISZ
+        pwzCAArray[iCAArray] = &wzBuffer[i+1];
+        ++iCAArray;
+    }
+
+    *pwzBuffer = wzBuffer;
+    *hwzCAArray = pwzCAArray;
+    *piCAArray = iCAArray;
+}
+
+
+HRESULT ScaSslExistingCertificateByBinaryData(INT iStore, INT iStoreLocation, BYTE* pwzData, DWORD cchData)
+{
+    HRESULT hr = S_FALSE;
+    HCERTSTORE hCertStore = NULL;
+    PCCERT_CONTEXT pCertCtx = NULL, pCertCtxExisting = NULL;
+    DWORD dwFlags = 0;
+    LPCWSTR wzStore = StoreMapping(iStore);
+    CERT_BLOB blob;
+
+    dwFlags = iStoreLocation << CERT_SYSTEM_STORE_LOCATION_SHIFT;
+    hCertStore = CertOpenStore(CERT_STORE_PROV_SYSTEM, 0, NULL, dwFlags, wzStore);
+    MessageExitOnNullWithLastError(hCertStore, hr, msierrCERTFailedOpen, "failed to open certificate store, OK on uninstall");
+
+    blob.pbData = pwzData;
+    blob.cbData = cchData;
+
+    if (!::CryptQueryObject(CERT_QUERY_OBJECT_BLOB, &blob, CERT_QUERY_CONTENT_FLAG_ALL, CERT_QUERY_FORMAT_FLAG_ALL,
+        0, NULL, NULL, NULL, NULL, NULL, (LPCVOID*)&pCertCtx))
+        ExitOnLastError(hr, "failed to parse the certificate blob, OK on uninstall");
+
+    pCertCtxExisting = CertFindCertificateInStore(
+        hCertStore,
+        PKCS_7_ASN_ENCODING | X509_ASN_ENCODING,
+        0,
+        CERT_FIND_EXISTING,
+        pCertCtx,
+        NULL);
+
+    if (pCertCtxExisting)
+    {
+        hr = S_OK;
+    }
+
+LExit:
+    if (pCertCtx)
+    {
+        CertFreeCertificateContext(pCertCtx);
+        pCertCtx = NULL;
+    }
+    if (pCertCtxExisting)
+    {
+        CertFreeCertificateContext(pCertCtxExisting);
+        pCertCtxExisting = NULL;
+    }
+    if (hCertStore)
+    {
+        CertCloseStore(hCertStore, 0);
+        hCertStore = NULL;
+    }
+
+    return hr;
+}
+
+
+HRESULT ScaSslExistingCertificateByName(LPCWSTR pwzName, INT iStore, INT iStoreLocation,
+                                       BSTR* pbstrCertificate, DWORD* pcbCertificate, BYTE* pbaHashBuffer)
+{
+    HRESULT hr = S_FALSE;
+    HCERTSTORE hSystemStore = NULL;
+    PCCERT_CONTEXT pTargetCert = NULL;
+    WCHAR wzFriendlyName[MAX_PATH] = {0};
+    DWORD dwFriendlyNameLen = sizeof(wzFriendlyName);
+
+    // Call CertOpenStore to open the CA store.
+    hSystemStore = CertOpenStore(
+        CERT_STORE_PROV_SYSTEM_REGISTRY,
+        0,
+        NULL,
+        (iStoreLocation << CERT_SYSTEM_STORE_LOCATION_SHIFT) | CERT_STORE_OPEN_EXISTING_FLAG,
+        StoreMapping(iStore));
+    if (hSystemStore == NULL)
+        ExitFunction();
+
+    // Get a particular certificate using CertFindCertificateInStore.
+    pTargetCert = CertFindCertificateInStore(
+        hSystemStore,
+        PKCS_7_ASN_ENCODING | X509_ASN_ENCODING,
+        0,
+        CERT_FIND_ANY,
+        NULL,
+        NULL);
+    while (pTargetCert != NULL)
+    {
+        if ((CertGetCertificateContextProperty(pTargetCert, CERT_FRIENDLY_NAME_PROP_ID,
+            (BYTE*)wzFriendlyName, &dwFriendlyNameLen)) &&
+            lstrcmpW(wzFriendlyName, pwzName) == 0)
+        {
+            // pTargetCert is a pointer to the desired certificate.
+            // Check the certificate's validity.
+            switch (CertVerifyTimeValidity(
+                NULL,
+                pTargetCert->pCertInfo))
+            {
+            case 1:
+                // Certificate is expired
+                WcaLog(LOGMSG_STANDARD, "The SSL certificate has expired");
+                // always remove it
+                {
+                    PCCERT_CONTEXT pDupCertContext = CertDuplicateCertificateContext(pTargetCert);
+                    if (pDupCertContext && CertDeleteCertificateFromStore(pDupCertContext))
+                    {
+                        WcaLog(LOGMSG_STANDARD, "A SSL certificate has removed");
+                    }
+                }
+                break;
+            case 0:
+                // Certificate is valid
+                WcaLog(LOGMSG_STANDARD, "The SSL certificate is valid");
+                hr = S_OK;
+                if (pbaHashBuffer)
+                {
+                    // if the certificate already exists and is valid, use that one
+                    DWORD dwHashSize = CB_CERTIFICATE_HASH;
+                    hr = CertGetCertificateContextProperty(pTargetCert, CERT_SHA1_HASH_PROP_ID, (VOID*)pbaHashBuffer, &dwHashSize)
+                        ? S_OK : E_FAIL;
+                    ExitOnFailure(hr, "failed CertGetCertificateContextProperty CERT_SHA1_HASH_PROP_ID");
+                    Assert(pbstrCertificate);
+                    Assert(pcbCertificate);
+                    ReleaseBSTR(*pbstrCertificate);
+
+                    *pbstrCertificate = SysAllocStringByteLen((LPCSTR)(pTargetCert->pbCertEncoded), pTargetCert->cbCertEncoded);
+                    *pcbCertificate = pTargetCert->cbCertEncoded;
+                }
+                ExitFunction();
+                break;
+            default:
+                // Certificate not valid yet, ignore it
+                WcaLog(LOGMSG_STANDARD, "The SSL certificate is not valid");
+                break;
+            }
+        }
+        pTargetCert = CertFindCertificateInStore(
+            hSystemStore,
+            PKCS_7_ASN_ENCODING | X509_ASN_ENCODING,
+            0,
+            CERT_FIND_ANY,
+            NULL,
+            pTargetCert);
+        wzFriendlyName[0] = 0;
+        dwFriendlyNameLen = sizeof(wzFriendlyName);
+    }
+
+LExit:
+    // Clean up memory and quit.
+    if (pTargetCert)
+    {
+        CertFreeCertificateContext(pTargetCert);
+        pTargetCert = NULL;
+    }
+    if (hSystemStore)
+    {
+        CertCloseStore(hSystemStore, CERT_CLOSE_STORE_CHECK_FLAG);
+        hSystemStore = NULL;
+    }
+
+    return hr;
+}
+
+
+HRESULT ScaSslNewCertificate(LPCWSTR pwzName, INT iStore, INT iStoreLocation, LPCWSTR wzComputerName, LPCWSTR wzDistinguishedName, LPCWSTR wzCertificateAuthorityOrig,
+                            BSTR* pbstrCertificate, DWORD* pcbCertificate, BYTE* pbaHashBuffer)
+{
+
+    if (pbstrCertificate == NULL)
+        return E_INVALIDARG;
+
+    HRESULT hr = S_OK;
+    LPWSTR wzCABuffer = NULL;
+    LPWSTR *wzCAArray = NULL;
+    int iCAArray = 0;
+
+    // otherwise call the CA for one
+    ParseCertificateAuthority(wzCertificateAuthorityOrig, &wzCABuffer, &wzCAArray, &iCAArray);
+
+    // try each authority three times
+    for (int i = 0; i < 3 * iCAArray; ++i)
+    {
+        LPCWSTR wzCA = wzCAArray[i % iCAArray];
+        if (NULL == wzCA || NULL == wzCA[0]) continue;
+        WcaLog(LOGMSG_STANDARD, "Requesting SSL certificate from %ls", wzCA);
+        hr = RequestCertificate(pwzName, iStore, iStoreLocation, wzComputerName, wzDistinguishedName, wzCA, pbstrCertificate);
+        if (hr == S_OK && pbstrCertificate)
+        {
+            // set the friendly name
+            CRYPT_HASH_BLOB hblob;
+            CERT_BLOB blob;
+            HCERTSTORE hCertStore = NULL;
+            PCCERT_CONTEXT pCertCtxExisting = NULL;
+
+            blob.pbData = (BYTE*)pwzName;
+            blob.cbData = (lstrlenW(pwzName) + 1) * sizeof(pwzName[0]); // including terminating null
+
+            *pcbCertificate = SysStringByteLen(*pbstrCertificate);
+            hr = CertificateToHash(*pbstrCertificate, pbaHashBuffer);
+            ExitOnFailure(hr, "failed to CertificateToHash for an existing certificate");
+
+            hblob.pbData = pbaHashBuffer;
+            hblob.cbData = CB_CERTIFICATE_HASH;
+
+            hCertStore = CertOpenStore(CERT_STORE_PROV_SYSTEM, 0, NULL, (iStoreLocation << CERT_SYSTEM_STORE_LOCATION_SHIFT), StoreMapping(iStore));
+            MessageExitOnNullWithLastError(hCertStore, hr, msierrCERTFailedOpen, "failed to open certificate store");
+
+            pCertCtxExisting = CertFindCertificateInStore(
+                hCertStore,
+                PKCS_7_ASN_ENCODING | X509_ASN_ENCODING,
+                0,
+                CERT_FIND_HASH,
+                &hblob,
+                NULL);
+
+            if (pCertCtxExisting)
+            {
+                CertSetCertificateContextProperty(
+                    pCertCtxExisting,
+                    CERT_FRIENDLY_NAME_PROP_ID,
+                    0,
+                    &blob);
+            }
+
+            if (pCertCtxExisting)
+            {
+                CertFreeCertificateContext(pCertCtxExisting);
+                pCertCtxExisting = NULL;
+            }
+            if (hCertStore)
+            {
+                CertCloseStore(hCertStore, 0);
+                hCertStore = NULL;
+            }
+            ExitFunction();
+        }
+        if (pbstrCertificate && *pbstrCertificate)
+        {
+            SysFreeString(*pbstrCertificate);
+            pbstrCertificate = NULL;
+        }
+    }
+    hr = E_FAIL;
+    ExitOnFailure(hr, "failed to RequestCertificate");
+
+LExit:
+    if (wzCABuffer)
+    {
+        delete wzCABuffer;
+    }
+    if (wzCAArray)
+    {
+        delete wzCAArray;
+    }
+
+    return hr;
+}
+
+
+HRESULT ScaGetCertificateByRequest(LPCWSTR pwzName, BOOL fIsInstalling, BOOL fIsUninstalling,
+                                   INT iStore, INT iStoreLocation,
+                                   LPCWSTR wzDistinguishedName, LPCWSTR wzCA,
+                                   BSTR* pbstrCertificate, DWORD* pcbCertificate, BYTE* pbaHashBuffer)
+{
+    HRESULT hr = S_OK;
+    WCHAR wzComputerName[MAX_COMPUTER_NAME] = {0};
+    WCHAR* pwzData = NULL;
+    DWORD cchData = 0;
+
+    // override %COMPUTERNAME% with DOMAINNAME property
+    hr = WcaGetProperty( L"DOMAINNAME", &pwzData);
+    ExitOnFailure(hr, "Failed to get Property DOMAINNAME");
+    if (*pwzData)
+    {
+        // if DOMAINNAME is set, use it
+        ::StringCchCopyW(wzComputerName, MAX_COMPUTER_NAME, pwzData);
+    }
+    else
+    {
+        // otherwise get the intranet name given by %COMPUTERNAME%
+        GetEnvironmentVariableW(L"COMPUTERNAME", wzComputerName, MAX_COMPUTER_NAME);
+    }
+
+    hr = ScaSslExistingCertificateByName(pwzName, iStore, iStoreLocation, pbstrCertificate, pcbCertificate, pbaHashBuffer);
+    ExitOnFailure(hr, "Failed ScaSslExistingCertificateByName");
+    if (S_OK != hr)
+    {
+        if (!fIsUninstalling && fIsInstalling)
+        {
+            // if no existing cert and not on uninstall, hit the authority
+            WcaLog(LOGMSG_STANDARD, "Adding certificate: requested, %ls", wzDistinguishedName);
+            hr = ScaSslNewCertificate(pwzName, iStore, iStoreLocation, wzComputerName, wzDistinguishedName, wzCA,
+                pbstrCertificate, pcbCertificate, pbaHashBuffer);
+            ExitOnFailure(hr, "Failed ScaSslNewCertificate");
+        }
+        else
+        {
+            // if no existing cert and uninstall
+            hr = S_OK;
+        }
+    }
+
+LExit:
+    ReleaseStr(pwzData);
+
+    return hr;
+}
+
+
+HRESULT ScaInstallCertificateByContext(LPCWSTR pwzName, INT iStore, INT iStoreLocation,
+                                       PCCERT_CONTEXT pCertContext)
+{
+    HRESULT hr = S_OK;
+    HCERTSTORE hCertStore = NULL;
+    DWORD dwFlags = iStoreLocation << CERT_SYSTEM_STORE_LOCATION_SHIFT;
+    CERT_BLOB blob;
+
+    hCertStore = CertOpenStore(CERT_STORE_PROV_SYSTEM, 0, NULL, dwFlags, StoreMapping(iStore));
+    if (hCertStore == NULL)
+        MessageExitOnLastError(hr, msierrCERTFailedOpen, "failed to open certificate store");
+
+    blob.pbData = (BYTE*)pwzName;
+    blob.cbData = (lstrlenW(pwzName) + 1) * sizeof(pwzName[0]); // including terminating null
+    CertSetCertificateContextProperty(
+        pCertContext,
+        CERT_FRIENDLY_NAME_PROP_ID,
+        0,
+        &blob);
+
+    if (!CertAddCertificateContextToStore(
+        hCertStore,
+        pCertContext,
+        CERT_STORE_ADD_REPLACE_EXISTING,
+        NULL))
+    {
+        hr = E_FAIL;
+        MessageExitOnLastError(hr, msierrCERTFailedAdd, "failed to add certificate to the store");
+    }
+
+LExit:
+    if (hCertStore)
+    {
+        CertCloseStore(hCertStore, 0);
+        hCertStore = NULL;
+    }
+
+    return hr;
+}
+
+
+HRESULT ScaGetCertificateByPath(LPCWSTR pwzName, BOOL fIsInstalling, BOOL fIsUninstalling,
+                                INT iStore, INT iStoreLocation, LPCWSTR wzSslCertificate, LPCWSTR wzPFXPassword,
+                                BSTR* pbstrCertificate, DWORD* pcbCertificate, BYTE* pbaHashBuffer)
+{
+    Assert(wzSslCertificate);
+    HRESULT hr = S_OK;
+    PCCERT_CONTEXT pCertContext = NULL;
+    DWORD dwEncodingType = 0;
+    DWORD dwContentType = 0;
+    DWORD dwFormatType = 0;
+    DWORD dwHashSize = CB_CERTIFICATE_HASH;
+    HANDLE hPfxFile = INVALID_HANDLE_VALUE;
+    CRYPT_DATA_BLOB blob;
+
+    blob.pbData = NULL;
+    blob.cbData = 0;
+
+    if (wzSslCertificate && wzSslCertificate[0] != 0)
+    {
+        if (!::CryptQueryObject(CERT_QUERY_OBJECT_FILE, (LPVOID)wzSslCertificate, CERT_QUERY_CONTENT_FLAG_ALL, CERT_QUERY_FORMAT_FLAG_ALL,
+            0, &dwEncodingType, &dwContentType, &dwFormatType, NULL, NULL, (LPCVOID*)&pCertContext))
+            hr = fIsUninstalling ? S_FALSE : HRESULT_FROM_WIN32(::GetLastError());  // don't fail on uninstall
+        ExitOnFailure(hr, "failed CryptQueryObject");
+    }
+    else
+    {
+        hr = S_FALSE;
+        ExitFunction();
+    }
+
+    if (!pCertContext)
+    {
+        // this is a pfx?
+        // make sure to exit this block of code properly for clean up blob.pbData
+        if (dwContentType & CERT_QUERY_CONTENT_PFX)
+        {
+            DWORD iSize = 0, iReadSize = 0;
+            HCERTSTORE hPfxCertStore = NULL;
+
+            hPfxFile = ::CreateFileW(wzSslCertificate, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+                NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
+            hr = (hPfxFile != INVALID_HANDLE_VALUE) ? S_OK : E_FAIL;
+            ExitOnFailure(hr, "failed CryptQueryObject, file handle is null");
+            iSize = ::GetFileSize(hPfxFile, NULL);
+            hr = (iSize > 0) ? S_OK : E_FAIL;
+            ExitOnFailure(hr, "failed CryptQueryObject, file size is 0");
+            blob.pbData = new BYTE[iSize];
+            blob.cbData = iSize;
+            hr = (blob.pbData) ? S_OK : E_FAIL;
+            ExitOnFailure(hr, "out of memory for blob");
+
+            if (::ReadFile(hPfxFile, (LPVOID)blob.pbData, iSize, &iReadSize, NULL))
+            {
+                hPfxCertStore = PFXImportCertStore((CRYPT_DATA_BLOB*)&blob, wzPFXPassword,
+                    (iStoreLocation == SCA_CERTSYSTEMSTORE_CURRENTUSER) ? CRYPT_USER_KEYSET : CRYPT_MACHINE_KEYSET);
+                if (hPfxCertStore)
+                {
+                    pCertContext = CertEnumCertificatesInStore(hPfxCertStore, NULL);
+                    // work only with the first certificate in pfx
+                    if (pCertContext)
+                    {
+                        hr = CertGetCertificateContextProperty(pCertContext, CERT_SHA1_HASH_PROP_ID, (VOID*)pbaHashBuffer, &dwHashSize)
+                            ? S_OK : E_FAIL;
+                        ExitOnFailure(hr, "failed CertGetCertificateContextProperty CERT_SHA1_HASH_PROP_ID");
+                        ReleaseBSTR(*pbstrCertificate);
+
+                        *pbstrCertificate = SysAllocStringByteLen((LPCSTR)(pCertContext->pbCertEncoded), pCertContext->cbCertEncoded);
+                        *pcbCertificate = pCertContext->cbCertEncoded;
+                        if (fIsInstalling)
+                        {
+                            // install the certificate, cannot defer because the data required cannot be passed
+                            hr = ScaInstallCertificateByContext(pwzName, iStore, iStoreLocation, pCertContext);
+                        }
+                    }
+                    else
+                        hr = E_FAIL;
+                }
+                else
+                    hr = E_FAIL;
+            }
+            else
+                hr = E_FAIL;
+        }
+        else
+        {
+            ExitOnFailure(hr = E_FAIL, "failed CryptQueryObject, unknown data");
+        }
+    }
+    else
+    {
+        // return cert and its hash
+        hr = CertGetCertificateContextProperty(pCertContext, CERT_SHA1_HASH_PROP_ID, (VOID*)pbaHashBuffer, &dwHashSize)
+            ? S_OK : E_FAIL;
+        ExitOnFailure(hr, "failed CertGetCertificateContextProperty CERT_SHA1_HASH_PROP_ID");
+        ReleaseBSTR(*pbstrCertificate);
+
+        *pbstrCertificate = SysAllocStringByteLen((LPCSTR)(pCertContext->pbCertEncoded), pCertContext->cbCertEncoded);
+        *pcbCertificate = pCertContext->cbCertEncoded;
+        if (fIsInstalling)
+        {
+            // install the certificate, cannot defer because the data required cannot be passed
+            hr = ScaInstallCertificateByContext(pwzName, iStore, iStoreLocation, pCertContext);
+        }
+    }
+
+LExit:
+    if (pCertContext)
+    {
+        CertFreeCertificateContext(pCertContext);
+        pCertContext = NULL;
+    }
+    if (hPfxFile != INVALID_HANDLE_VALUE)
+    {
+        CloseHandle(hPfxFile);
+        hPfxFile = INVALID_HANDLE_VALUE;
+    }
+    if (blob.pbData)
+    {
+        delete [] blob.pbData;
+        blob.pbData = NULL;
+        blob.cbData = 0;
+    }
+
+    return hr;
+}
+
+
+HRESULT ScaInstallCertificateByBinaryData(BOOL fAddCert, INT iStore, INT iStoreLocation, LPCWSTR wzName, BYTE* pwzData, DWORD cchData,
+                                          LPCWSTR wzPFXPassword)
+{
+    Assert(wzName);
+    Assert(pwzData);
+    Assert(cchData);
+    HRESULT hr = S_OK;
+    HCERTSTORE hCertStore = NULL, hPfxCertStore = NULL;
+    PCCERT_CONTEXT pCertCtx = NULL, pCertCtxExisting = NULL;
+    DWORD dwFlags, dwEncodingType, dwContentType, dwFormatType;
+    CERT_BLOB blob;
+    LPCWSTR wzStore = StoreMapping(iStore);
+
+    dwFlags = iStoreLocation << CERT_SYSTEM_STORE_LOCATION_SHIFT;
+    hCertStore = CertOpenStore(CERT_STORE_PROV_SYSTEM, 0, NULL, dwFlags, wzStore);
+    MessageExitOnNullWithLastError(hCertStore, hr, msierrCERTFailedOpen, "failed to open certificate store");
+
+    blob.pbData = pwzData;
+    blob.cbData = cchData;
+
+    if (!::CryptQueryObject(CERT_QUERY_OBJECT_BLOB, &blob, CERT_QUERY_CONTENT_FLAG_ALL, CERT_QUERY_FORMAT_FLAG_ALL,
+        0, &dwEncodingType, &dwContentType, &dwFormatType, NULL, NULL, (LPCVOID*)&pCertCtx))
+        ExitOnLastError(hr, "failed to parse the certificate blob");
+    ExitOnNull(pCertCtx, hr, E_UNEXPECTED, "failed to parse the certificate blob");
+
+    blob.pbData = (BYTE*)wzName;
+    blob.cbData = (lstrlenW(wzName) + 1) * sizeof(wzName[0]); // including terminating null
+
+    CertSetCertificateContextProperty(
+        pCertCtx,
+        CERT_FRIENDLY_NAME_PROP_ID,
+        0,
+        &blob);
+
+    if (fAddCert)
+    {
+        // Add
+        WcaLog(LOGMSG_STANDARD, "Adding certificate: binary name, %ls", wzName);
+        if (!CertAddCertificateContextToStore(
+            hCertStore,
+            pCertCtx,
+            CERT_STORE_ADD_REPLACE_EXISTING,
+            NULL))
+        {
+            hr = E_FAIL;
+            MessageExitOnLastError(hr, msierrCERTFailedAdd, "failed to add certificate to the store");
+        }
+    }
+    else
+    {
+        // Delete
+        WcaLog(LOGMSG_STANDARD, "Deleting certificate provided: binary name, %ls", wzName);
+        pCertCtxExisting = CertFindCertificateInStore(
+            hCertStore,
+            PKCS_7_ASN_ENCODING | X509_ASN_ENCODING,
+            0,
+            CERT_FIND_EXISTING,
+            pCertCtx,
+            NULL);
+
+        if (pCertCtxExisting)
+        {
+            if (!CertDeleteCertificateFromStore(pCertCtxExisting))
+            {
+                ExitOnLastError(hr, "failed to delete certificate");
+            }
+            else
+            {
+                pCertCtxExisting = NULL;
+            }
+        }
+    }
+
+LExit:
+    if (pCertCtx)
+    {
+        CertFreeCertificateContext(pCertCtx);
+        pCertCtx = NULL;
+    }
+    if (pCertCtxExisting)
+    {
+        CertFreeCertificateContext(pCertCtxExisting);
+        pCertCtxExisting = NULL;
+    }
+    // order is important for store
+    if (hCertStore)
+    {
+        CertCloseStore(hCertStore, 0);
+        hCertStore = NULL;
+    }
+    if (hPfxCertStore)
+    {
+        CertCloseStore(hPfxCertStore, 0);
+        hPfxCertStore = NULL;
+    }
+
+    return hr;
+}
+*/
diff --git a/src/ca/scacert.h b/src/ca/scacert.h
new file mode 100644
index 00000000..baa6fb8e
--- /dev/null
+++ b/src/ca/scacert.h
@@ -0,0 +1,22 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+#define CB_CERTIFICATE_HASH 20
+
+// Certificate.Attribute
+enum SCA_CERT_ATTRIBUTES
+{
+    SCA_CERT_ATTRIBUTE_DEFAULT = 0,
+    SCA_CERT_ATTRIBUTE_REQUEST = 1,
+    SCA_CERT_ATTRIBUTE_BINARYDATA = 2,
+    SCA_CERT_ATTRIBUTE_OVERWRITE = 4,
+};
+
+
+// Certificate.StoreLocation
+enum SCA_CERTSYSTEMSTORE
+{
+    SCA_CERTSYSTEMSTORE_CURRENTUSER = 1,
+    SCA_CERTSYSTEMSTORE_LOCALMACHINE = 2,
+};
diff --git a/src/ca/scacertexec.cpp b/src/ca/scacertexec.cpp
new file mode 100644
index 00000000..3864659f
--- /dev/null
+++ b/src/ca/scacertexec.cpp
@@ -0,0 +1,404 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+#define SIXTY_FOUR_MEG 64 * 1024 * 1024
+
+// prototypes
+static HRESULT ExecuteCertificateOperation(
+    __in MSIHANDLE hInstall,
+    __in SCA_ACTION saAction,
+    __in DWORD dwStoreRoot
+    );
+
+static HRESULT ReadCertificateFile(
+    __in LPCWSTR wzPath,
+    __out BYTE** prgbData,
+    __out DWORD* pcbData
+    );
+
+static HRESULT InstallCertificatePackage(
+    __in HCERTSTORE hStore,
+    __in BOOL fUserCertificateStore,
+    __in LPCWSTR wzName,
+    __in_opt BYTE* rgbData,
+    __in DWORD cbData,
+    __in_opt LPCWSTR wzPFXPassword
+    );
+
+static HRESULT UninstallCertificatePackage(
+    __in HCERTSTORE hStore,
+    __in BOOL fUserCertificateStore,
+    __in LPCWSTR wzName
+    );
+
+
+/* ****************************************************************
+ AddUserCertificate - CUSTOM ACTION ENTRY POINT for adding per-user
+                      certificates
+
+ * ***************************************************************/
+extern "C" UINT __stdcall AddUserCertificate(
+    __in MSIHANDLE hInstall
+    )
+{
+    HRESULT hr = S_OK;
+    DWORD er = ERROR_SUCCESS;
+
+    hr = WcaInitialize(hInstall, "AddUserCertificate");
+    ExitOnFailure(hr, "Failed to initialize AddUserCertificate.");
+
+    hr = ExecuteCertificateOperation(hInstall, SCA_ACTION_INSTALL, CERT_SYSTEM_STORE_CURRENT_USER);
+    ExitOnFailure(hr, "Failed to install per-user certificate.");
+
+LExit:
+    er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+
+/* ****************************************************************
+ AddMachineCertificate - CUSTOM ACTION ENTRY POINT for adding 
+                         per-machine certificates
+
+ * ***************************************************************/
+extern "C" UINT __stdcall AddMachineCertificate(
+    __in MSIHANDLE hInstall
+    )
+{
+    HRESULT hr = S_OK;
+    DWORD er = ERROR_SUCCESS;
+
+    hr = WcaInitialize(hInstall, "AddMachineCertificate");
+    ExitOnFailure(hr, "Failed to initialize AddMachineCertificate.");
+
+    hr = ExecuteCertificateOperation(hInstall, SCA_ACTION_INSTALL, CERT_SYSTEM_STORE_LOCAL_MACHINE);
+    ExitOnFailure(hr, "Failed to install per-machine certificate.");
+
+LExit:
+    er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+
+/* ****************************************************************
+ DeleteUserCertificate - CUSTOM ACTION ENTRY POINT for deleting 
+                         per-user certificates
+
+ * ***************************************************************/
+extern "C" UINT __stdcall DeleteUserCertificate(
+    __in MSIHANDLE hInstall
+    )
+{
+    HRESULT hr = S_OK;
+    DWORD er = ERROR_SUCCESS;
+
+    hr = WcaInitialize(hInstall, "DeleteUserCertificate");
+    ExitOnFailure(hr, "Failed to initialize DeleteUserCertificate.");
+
+    hr = ExecuteCertificateOperation(hInstall, SCA_ACTION_UNINSTALL, CERT_SYSTEM_STORE_CURRENT_USER);
+    ExitOnFailure(hr, "Failed to uninstall per-user certificate.");
+
+LExit:
+    er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+
+/* ****************************************************************
+ DeleteMachineCertificate - CUSTOM ACTION ENTRY POINT for deleting
+                            per-machine certificates
+
+ * ***************************************************************/
+extern "C" UINT __stdcall DeleteMachineCertificate(
+    __in MSIHANDLE hInstall
+    )
+{
+    HRESULT hr = S_OK;
+    DWORD er = ERROR_SUCCESS;
+
+    hr = WcaInitialize(hInstall, "DeleteMachineCertificate");
+    ExitOnFailure(hr, "Failed to initialize DeleteMachineCertificate.");
+
+    hr = ExecuteCertificateOperation(hInstall, SCA_ACTION_UNINSTALL, CERT_SYSTEM_STORE_LOCAL_MACHINE);
+    ExitOnFailure(hr, "Failed to uninstall per-machine certificate.");
+
+LExit:
+    er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+
+static HRESULT ExecuteCertificateOperation(
+    __in MSIHANDLE /*hInstall*/,
+    __in SCA_ACTION saAction,
+    __in DWORD dwStoreLocation
+    )
+{
+    //AssertSz(FALSE, "Debug ExecuteCertificateOperation() here.");
+    Assert(saAction & SCA_ACTION_INSTALL || saAction & SCA_ACTION_UNINSTALL);
+
+    HRESULT hr = S_OK;
+    LPWSTR pwzCaData = NULL;
+    LPWSTR pwz;
+    LPWSTR pwzName = NULL;
+    LPWSTR pwzStore = NULL;
+    int iAttributes = 0;
+    LPWSTR pwzPFXPassword = NULL;
+    LPWSTR pwzFilePath = NULL;
+    BYTE* pbData = NULL;
+    DWORD cbData = 0;
+    DWORD cbPFXPassword = 0;
+
+    BOOL fUserStoreLocation = (CERT_SYSTEM_STORE_CURRENT_USER == dwStoreLocation);
+    HCERTSTORE hCertStore = NULL;
+
+    hr = WcaGetProperty(L"CustomActionData", &pwzCaData);
+    ExitOnFailure(hr, "Failed to get CustomActionData");
+
+    WcaLog(LOGMSG_TRACEONLY, "CustomActionData: %ls", pwzCaData);
+
+    pwz = pwzCaData;
+    hr = WcaReadStringFromCaData(&pwz, &pwzName);
+    ExitOnFailure(hr, "Failed to parse certificate name.");
+    hr = WcaReadStringFromCaData(&pwz, &pwzStore);
+    ExitOnFailure(hr, "Failed to parse CustomActionData, StoreName");
+    hr = WcaReadIntegerFromCaData(&pwz, &iAttributes);
+    ExitOnFailure(hr, "Failed to parse certificate attribute");
+    if (SCA_ACTION_INSTALL == saAction) // install operations need more data
+    {
+        hr = WcaReadStreamFromCaData(&pwz, &pbData, (DWORD_PTR*)&cbData);
+        ExitOnFailure(hr, "Failed to parse certificate stream.");
+
+        hr = WcaReadStringFromCaData(&pwz, &pwzPFXPassword);
+        ExitOnFailure(hr, "Failed to parse certificate password.");
+    }
+
+    // Open the right store.
+    hCertStore = ::CertOpenStore(CERT_STORE_PROV_SYSTEM, 0, NULL, dwStoreLocation, pwzStore);
+    MessageExitOnNullWithLastError(hCertStore, hr, msierrCERTFailedOpen, "Failed to open certificate store: %ls", pwzStore);
+
+    if (SCA_ACTION_INSTALL == saAction) // install operations need more data
+    {
+        // Uninstall existing versions of this package.  Ignore any failures
+        // This is needed to clean up the private key of a cert when we replace an existing cert
+        // CertAddCertificateContextToStore(CERT_STORE_ADD_REPLACE_EXISTING) does not remove the private key if the cert is replaced
+        UninstallCertificatePackage(hCertStore, fUserStoreLocation, pwzName);
+
+        hr = InstallCertificatePackage(hCertStore, fUserStoreLocation, pwzName, pbData, cbData, pwzPFXPassword);
+        ExitOnFailure(hr, "Failed to install certificate.");
+    }
+    else
+    {
+        Assert(SCA_ACTION_UNINSTALL == saAction);
+
+        hr = UninstallCertificatePackage(hCertStore, fUserStoreLocation, pwzName);
+        ExitOnFailure(hr, "Failed to uninstall certificate.");
+    }
+
+LExit:
+    if (NULL != pwzPFXPassword && SUCCEEDED(StrSize(pwzPFXPassword, &cbPFXPassword)))
+    {
+        SecureZeroMemory(pwzPFXPassword, cbPFXPassword);
+    }
+
+    if (hCertStore)
+    {
+        if (!::CertCloseStore(hCertStore, CERT_CLOSE_STORE_CHECK_FLAG))
+        {
+            WcaLog(LOGMSG_VERBOSE, "Cert store was closed but not all resources were freed.  Error 0x%x", GetLastError());
+        }
+    }
+
+    ReleaseMem(pbData);
+    ReleaseStr(pwzFilePath);
+    ReleaseStr(pwzPFXPassword);
+    ReleaseStr(pwzStore);
+    ReleaseStr(pwzName);
+    ReleaseStr(pwzCaData);
+    return hr;
+}
+
+
+static HRESULT InstallCertificatePackage(
+    __in HCERTSTORE hStore,
+    __in BOOL fUserCertificateStore,
+    __in LPCWSTR wzName,
+    __in_opt BYTE* rgbData,
+    __in DWORD cbData,
+    __in_opt LPCWSTR wzPFXPassword
+    )
+{
+    HRESULT hr = S_OK;
+
+    HCERTSTORE hPfxCertStore = NULL;
+    PCCERT_CONTEXT pCertContext = NULL;
+    CERT_BLOB blob = { 0 };
+    DWORD dwKeyset = fUserCertificateStore ? CRYPT_USER_KEYSET : CRYPT_MACHINE_KEYSET;
+    DWORD dwEncodingType;
+    DWORD dwContentType;
+    DWORD dwFormatType;
+    LPWSTR pwzUniqueName = NULL;
+    int iUniqueId = 0;
+
+    // Figure out what type of blob (certificate or PFX) we're dealing with here.
+    blob.pbData = rgbData;
+    blob.cbData = cbData;
+
+    if (!::CryptQueryObject(CERT_QUERY_OBJECT_BLOB, &blob, CERT_QUERY_CONTENT_FLAG_ALL, CERT_QUERY_FORMAT_FLAG_ALL, 0, &dwEncodingType, &dwContentType, &dwFormatType, NULL, NULL, (LPCVOID*)&pCertContext))
+    {
+        ExitWithLastError(hr, "Failed to parse the certificate blob: %ls", wzName);
+    }
+
+    hr = StrAllocFormatted(&pwzUniqueName, L"%s_wixCert_%d", wzName, ++iUniqueId);
+    ExitOnFailure(hr, "Failed to format unique name");
+
+    if (!pCertContext)
+    {
+        // If we have a PFX blob, get the first certificate out of the PFX and use that instead of the PFX.
+        if (dwContentType & CERT_QUERY_CONTENT_PFX)
+        {
+            ExitOnNull(wzPFXPassword, hr, E_INVALIDARG, "Failed to import PFX blob because no password was provided");
+
+            // If we fail and our password is blank, also try passing in NULL for the password (according to the docs)
+            hPfxCertStore = ::PFXImportCertStore((CRYPT_DATA_BLOB*)&blob, wzPFXPassword, dwKeyset);
+            if (NULL == hPfxCertStore && !*wzPFXPassword)
+            {
+                hPfxCertStore = ::PFXImportCertStore((CRYPT_DATA_BLOB*)&blob, NULL, dwKeyset);
+            }
+            ExitOnNullWithLastError(hPfxCertStore, hr, "Failed to open PFX file.");
+
+            // Install all certificates in the PFX
+            for (pCertContext = ::CertEnumCertificatesInStore(hPfxCertStore, pCertContext);
+                 pCertContext;
+                 pCertContext = ::CertEnumCertificatesInStore(hPfxCertStore, pCertContext))
+            {
+                WcaLog(LOGMSG_STANDARD, "Adding certificate: %ls", pwzUniqueName);
+                hr = CertInstallSingleCertificate(hStore, pCertContext, pwzUniqueName);
+                MessageExitOnFailure(hr, msierrCERTFailedAdd, "Failed to add certificate to the store.");
+
+                hr = StrAllocFormatted(&pwzUniqueName, L"%s_wixCert_%d", wzName, ++iUniqueId);
+                ExitOnFailure(hr, "Failed to format unique name");
+            }
+        }
+        else
+        {
+            hr = E_UNEXPECTED;
+            ExitOnFailure(hr, "Unexpected certificate type processed.");
+        }
+    }
+    else
+    {
+        WcaLog(LOGMSG_STANDARD, "Adding certificate: %ls", pwzUniqueName);
+        hr = CertInstallSingleCertificate(hStore, pCertContext, pwzUniqueName);
+        MessageExitOnFailure(hr, msierrCERTFailedAdd, "Failed to add certificate to the store.");
+    }
+
+    hr = WcaProgressMessage(COST_CERT_ADD, FALSE);
+    ExitOnFailure(hr, "Failed to send install progress message.");
+
+LExit:
+    ReleaseStr(pwzUniqueName);
+
+    if (pCertContext)
+    {
+        ::CertFreeCertificateContext(pCertContext);
+    }
+
+    // Close the stores after the context's are released.
+    if (hPfxCertStore)
+    {
+        if (!::CertCloseStore(hPfxCertStore, CERT_CLOSE_STORE_CHECK_FLAG))
+        {
+            WcaLog(LOGMSG_VERBOSE, "PFX cert store was closed but not all resources were freed.  Error 0x%x", GetLastError());
+        }
+    }
+
+    return hr;
+}
+
+
+static HRESULT UninstallCertificatePackage(
+    __in HCERTSTORE hStore,
+    __in BOOL fUserCertificateStore,
+    __in LPCWSTR wzName
+    )
+{
+    HRESULT hr = S_OK;
+    DWORD er = ERROR_SUCCESS;
+    PCCERT_CONTEXT pCertContext = NULL;
+    CRYPT_KEY_PROV_INFO* pPrivateKeyInfo = NULL;
+    LPWSTR pwzUniquePrefix = NULL;
+    int ccUniquePrefix = 0;
+
+    hr = StrAllocFormatted(&pwzUniquePrefix, L"%s_wixCert_", wzName);
+    ExitOnFailure(hr, "Failed to format unique name");
+    ccUniquePrefix = ::lstrlenW(pwzUniquePrefix);
+
+    WcaLog(LOGMSG_STANDARD, "Deleting certificate that begin with friendly name: %ls", pwzUniquePrefix);
+
+    // Loop through all certificates in the store, deleting the ones that begin with our prefix.
+    while (NULL != (pCertContext = ::CertFindCertificateInStore(hStore, PKCS_7_ASN_ENCODING | X509_ASN_ENCODING, 0, CERT_FIND_ANY, NULL, pCertContext)))
+    {
+        WCHAR wzFriendlyName[256] = { 0 };
+        DWORD cbFriendlyName = sizeof(wzFriendlyName);
+
+        if (::CertGetCertificateContextProperty(pCertContext, CERT_FRIENDLY_NAME_PROP_ID, reinterpret_cast<BYTE*>(wzFriendlyName), &cbFriendlyName) &&
+            lstrlenW(wzFriendlyName) >= ccUniquePrefix &&
+            CSTR_EQUAL == ::CompareStringW(LOCALE_SYSTEM_DEFAULT, 0, pwzUniquePrefix, ccUniquePrefix, wzFriendlyName, ccUniquePrefix))
+        {
+            PCCERT_CONTEXT pCertContextDelete = ::CertDuplicateCertificateContext(pCertContext); // duplicate the context so we can delete it with out disrupting the looping
+            if(pCertContextDelete)
+            {
+                // Delete the certificate and if successful delete the matching private key as well.
+                if (::CertDeleteCertificateFromStore(pCertContextDelete))
+                {
+                    // If we found private key info, delete it.
+                    hr = CertReadProperty(pCertContextDelete, CERT_KEY_PROV_INFO_PROP_ID, &pPrivateKeyInfo, NULL);
+                    if (SUCCEEDED(hr))
+                    {
+                        HCRYPTPROV hProvIgnored = NULL; // ignored on deletes.
+                        DWORD dwKeyset = fUserCertificateStore ? CRYPT_USER_KEYSET : CRYPT_MACHINE_KEYSET;
+
+                        if (!::CryptAcquireContextW(&hProvIgnored, pPrivateKeyInfo->pwszContainerName, pPrivateKeyInfo->pwszProvName, pPrivateKeyInfo->dwProvType, dwKeyset | CRYPT_DELETEKEYSET | CRYPT_SILENT))
+                        {
+                            er = ::GetLastError();
+                            hr = HRESULT_FROM_WIN32(er);
+                        }
+
+                        ReleaseNullMem(pPrivateKeyInfo);
+                    }
+                    else // don't worry about failures to delete private keys.
+                    {
+                        hr = S_OK;
+                    }
+                }
+                else
+                {
+                    er = ::GetLastError();
+                    hr = HRESULT_FROM_WIN32(er);
+                }
+
+                if (FAILED(hr))
+                {
+                    WcaLog(LOGMSG_STANDARD, "Failed to delete certificate with friendly name: %ls, continuing anyway.  Error: 0x%x", wzFriendlyName, hr);
+                }
+
+                pCertContextDelete = NULL;
+            }
+        }
+    }
+
+    hr = WcaProgressMessage(COST_CERT_DELETE, FALSE);
+    ExitOnFailure(hr, "Failed to send uninstall progress message.");
+
+LExit:
+    ReleaseStr(pwzUniquePrefix);
+    ReleaseMem(pPrivateKeyInfo);
+    if(pCertContext)
+    {
+        ::CertFreeCertificateContext(pCertContext);
+    }
+
+    return hr;
+}
diff --git a/src/ca/scacost.h b/src/ca/scacost.h
new file mode 100644
index 00000000..be92cf26
--- /dev/null
+++ b/src/ca/scacost.h
@@ -0,0 +1,15 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+const UINT COST_IIS_TRANSACTIONS = 10000;
+
+const UINT COST_IIS_CREATEKEY = 5000;
+const UINT COST_IIS_DELETEKEY = 5000;
+const UINT COST_IIS_WRITEVALUE = 5000;
+const UINT COST_IIS_DELETEVALUE = 5000;
+const UINT COST_IIS_CREATEAPP = 5000;
+const UINT COST_IIS_DELETEAPP = 5000;
+
+const UINT COST_CERT_ADD = 5000;
+const UINT COST_CERT_DELETE = 5000;
diff --git a/src/ca/scaexec.cpp b/src/ca/scaexec.cpp
new file mode 100644
index 00000000..df25e8db
--- /dev/null
+++ b/src/ca/scaexec.cpp
@@ -0,0 +1,1184 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+
+/********************************************************************
+ StartMetabaseTransaction - CUSTOM ACTION ENTRY POINT for backing up metabase
+
+  Input:  deferred CustomActionData - BackupName
+********************************************************************/
+extern "C" UINT __stdcall StartMetabaseTransaction(MSIHANDLE hInstall)
+{
+//AssertSz(FALSE, "debug StartMetabaseTransaction here");
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    IMSAdminBase* piMetabase = NULL;
+    LPWSTR pwzData = NULL;
+    BOOL fInitializedCom = FALSE;
+
+    // initialize
+    hr = WcaInitialize(hInstall, "StartMetabaseTransaction");
+    ExitOnFailure(hr, "failed to initialize StartMetabaseTransaction");
+
+    hr = ::CoInitialize(NULL);
+    ExitOnFailure(hr, "failed to initialize COM");
+    fInitializedCom = TRUE;
+    hr = ::CoCreateInstance(CLSID_MSAdminBase, NULL, CLSCTX_ALL, IID_IMSAdminBase, reinterpret_cast<void**>(&piMetabase));
+    if (hr == REGDB_E_CLASSNOTREG)
+    {
+        WcaLog(LOGMSG_STANDARD, "Failed to get IIMSAdminBase to backup - continuing");
+        hr = S_OK;
+    }
+    else
+    {
+        MessageExitOnFailure(hr, msierrIISCannotConnect, "failed to get IID_IIMSAdminBase object");
+
+        hr = WcaGetProperty(L"CustomActionData", &pwzData);
+        ExitOnFailure(hr, "failed to get CustomActionData");
+
+        // back up the metabase
+        Assert(lstrlenW(pwzData) < MD_BACKUP_MAX_LEN);
+
+        // MD_BACKUP_OVERWRITE = Overwrite if a backup of the same name and version exists in the backup location
+        hr = piMetabase->Backup(pwzData, MD_BACKUP_NEXT_VERSION, MD_BACKUP_OVERWRITE | MD_BACKUP_FORCE_BACKUP | MD_BACKUP_SAVE_FIRST);
+        if (MD_WARNING_SAVE_FAILED == hr)
+        {
+            WcaLog(LOGMSG_STANDARD, "Failed to save metabase before backing up - continuing");
+            hr = S_OK;
+        }
+        MessageExitOnFailure(hr, msierrIISFailedStartTransaction, "failed to begin metabase transaction: '%ls'", pwzData);
+    }
+    hr = WcaProgressMessage(COST_IIS_TRANSACTIONS, FALSE);
+LExit:
+    ReleaseStr(pwzData);
+    ReleaseObject(piMetabase);
+
+    if (fInitializedCom)
+    {
+        ::CoUninitialize();
+    }
+
+    if (FAILED(hr))
+        er = ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+
+/********************************************************************
+ RollbackMetabaseTransaction - CUSTOM ACTION ENTRY POINT for unbacking up metabase
+
+  Input:  deferred CustomActionData - BackupName
+********************************************************************/
+extern "C" UINT __stdcall RollbackMetabaseTransaction(MSIHANDLE hInstall)
+{
+//AssertSz(FALSE, "debug RollbackMetabaseTransaction here");
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    IMSAdminBase* piMetabase = NULL;
+    LPWSTR pwzData = NULL;
+    BOOL fInitializedCom = FALSE;
+
+    hr = WcaInitialize(hInstall, "RollbackMetabaseTransaction");
+    ExitOnFailure(hr, "failed to initialize");
+
+    hr = ::CoInitialize(NULL);
+    ExitOnFailure(hr, "failed to initialize COM");
+    fInitializedCom = TRUE;
+    hr = ::CoCreateInstance(CLSID_MSAdminBase, NULL, CLSCTX_ALL, IID_IMSAdminBase, reinterpret_cast<void**>(&piMetabase));
+    if (hr == REGDB_E_CLASSNOTREG)
+    {
+        WcaLog(LOGMSG_STANDARD, "Failed to get IIMSAdminBase to rollback - continuing");
+        hr = S_OK;
+        ExitFunction();
+    }
+    ExitOnFailure(hr, "failed to get IID_IIMSAdminBase object");
+
+
+    hr = WcaGetProperty( L"CustomActionData", &pwzData);
+    ExitOnFailure(hr, "failed to get CustomActionData");
+
+    hr = piMetabase->Restore(pwzData, MD_BACKUP_HIGHEST_VERSION, 0);
+    ExitOnFailure(hr, "failed to rollback metabase transaction: '%ls'", pwzData);
+
+    hr = piMetabase->DeleteBackup(pwzData, MD_BACKUP_HIGHEST_VERSION);
+    ExitOnFailure(hr, "failed to cleanup metabase transaction '%ls', continuing", pwzData);
+
+LExit:
+    ReleaseStr(pwzData);
+    ReleaseObject(piMetabase);
+
+    if (fInitializedCom)
+    {
+        ::CoUninitialize();
+    }
+
+    if (FAILED(hr))
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+    return WcaFinalize(er);
+}
+
+
+/********************************************************************
+ CommitMetabaseTransaction - CUSTOM ACTION ENTRY POINT for unbacking up metabase
+
+  Input:  deferred CustomActionData - BackupName
+ * *****************************************************************/
+extern "C" UINT __stdcall CommitMetabaseTransaction(MSIHANDLE hInstall)
+{
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    IMSAdminBase* piMetabase = NULL;
+    LPWSTR pwzData = NULL;
+    BOOL fInitializedCom = FALSE;
+
+    hr = WcaInitialize(hInstall, "CommitMetabaseTransaction");
+    ExitOnFailure(hr, "failed to initialize");
+
+    hr = ::CoInitialize(NULL);
+    ExitOnFailure(hr, "failed to initialize COM");
+    fInitializedCom = TRUE;
+    hr = ::CoCreateInstance(CLSID_MSAdminBase, NULL, CLSCTX_ALL, IID_IMSAdminBase, reinterpret_cast<void**>(&piMetabase));
+    if (hr == REGDB_E_CLASSNOTREG)
+    {
+        WcaLog(LOGMSG_STANDARD, "Failed to get IIMSAdminBase to commit - continuing");
+        hr = S_OK;
+        ExitFunction();
+    }
+    ExitOnFailure(hr, "failed to get IID_IIMSAdminBase object");
+
+    hr = WcaGetProperty( L"CustomActionData", &pwzData);
+    ExitOnFailure(hr, "failed to get CustomActionData");
+
+    hr = piMetabase->DeleteBackup(pwzData, MD_BACKUP_HIGHEST_VERSION);
+    ExitOnFailure(hr, "failed to cleanup metabase transaction: '%ls'", pwzData);
+
+LExit:
+    ReleaseStr(pwzData);
+    ReleaseObject(piMetabase);
+
+    if (fInitializedCom)
+    {
+        ::CoUninitialize();
+    }
+
+    if (FAILED(hr))
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+    return WcaFinalize(er);
+}
+
+
+/********************************************************************
+ CreateMetabaseKey - Installs metabase keys
+
+  Input:  deferred CustomActionData - Key
+ * *****************************************************************/
+static HRESULT CreateMetabaseKey(__in LPWSTR* ppwzCustomActionData, __in IMSAdminBase* piMetabase)
+{
+//AssertSz(FALSE, "debug CreateMetabaseKey here");
+    HRESULT hr = S_OK;
+    METADATA_HANDLE mhRoot = 0;
+    LPWSTR pwzData = NULL;
+    LPCWSTR pwzKey;
+
+    int i;
+
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzData);
+    ExitOnFailure(hr, "failed to read key from custom action data");
+
+    hr = piMetabase->OpenKey(METADATA_MASTER_ROOT_HANDLE, L"/LM", METADATA_PERMISSION_WRITE, 10, &mhRoot);
+    for (i = 30; i > 0 && HRESULT_FROM_WIN32(ERROR_PATH_BUSY) == hr; i--)
+    {
+        ::Sleep(1000);
+        WcaLog(LOGMSG_STANDARD, "failed to open root key, retrying %d time(s)...", i);
+        hr = piMetabase->OpenKey(METADATA_MASTER_ROOT_HANDLE, L"/LM", METADATA_PERMISSION_WRITE, 10, &mhRoot);
+    }
+    MessageExitOnFailure(hr, msierrIISFailedOpenKey, "failed to open metabase key: %ls", L"/LM");
+
+    pwzKey = pwzData + 3;
+
+    WcaLog(LOGMSG_VERBOSE, "Creating Metabase Key: %ls", pwzKey);
+
+    hr = piMetabase->AddKey(mhRoot, pwzKey);
+    if (HRESULT_FROM_WIN32(ERROR_ALREADY_EXISTS) == hr)
+    {
+        WcaLog(LOGMSG_VERBOSE, "Key `%ls` already existed, continuing.", pwzData);
+        hr = S_OK;
+    }
+    MessageExitOnFailure(hr, msierrIISFailedCreateKey, "failed to create metabase key: %ls", pwzKey);
+
+    hr = WcaProgressMessage(COST_IIS_CREATEKEY, FALSE);
+
+LExit:
+    if (mhRoot)
+    {
+        piMetabase->CloseKey(mhRoot);
+    }
+
+    return hr;
+}
+
+
+/********************************************************************
+ WriteMetabaseValue -Installs metabase values
+
+  Input:  deferred CustomActionData - Key\tIdentifier\tAttributes\tUserType\tDataType\tData
+ * *****************************************************************/
+static HRESULT WriteMetabaseValue(__in LPWSTR* ppwzCustomActionData, __in IMSAdminBase* piMetabase)
+{
+    //AssertSz(FALSE, "debug WriteMetabaseValue here");
+    HRESULT hr = S_OK;
+
+    METADATA_HANDLE mhKey = 0;
+
+    LPWSTR pwzKey = NULL;
+    LPWSTR pwzTemp = NULL;
+    DWORD dwData = 0;
+    DWORD dwTemp = 0;
+    BOOL fFreeData = FALSE;
+    METADATA_RECORD mr;
+    ::ZeroMemory((LPVOID)&mr, sizeof(mr));
+    METADATA_RECORD mrGet;
+    ::ZeroMemory((LPVOID)&mrGet, sizeof(mrGet));
+
+    int i;
+
+    // get the key first
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzKey);
+    ExitOnFailure(hr, "failed to read key");
+    hr = WcaReadIntegerFromCaData(ppwzCustomActionData, reinterpret_cast<int *>(&mr.dwMDIdentifier));
+    ExitOnFailure(hr, "failed to read identifier");
+    hr = WcaReadIntegerFromCaData(ppwzCustomActionData, reinterpret_cast<int *>(&mr.dwMDAttributes));
+    ExitOnFailure(hr, "failed to read attributes");
+    hr = WcaReadIntegerFromCaData(ppwzCustomActionData, reinterpret_cast<int *>(&mr.dwMDUserType));
+    ExitOnFailure(hr, "failed to read user type");
+    hr = WcaReadIntegerFromCaData(ppwzCustomActionData, reinterpret_cast<int *>(&mr.dwMDDataType));
+    ExitOnFailure(hr, "failed to read data type");
+
+    switch (mr.dwMDDataType) // data
+    {
+    case DWORD_METADATA:
+        hr = WcaReadIntegerFromCaData(ppwzCustomActionData, reinterpret_cast<int *>(&dwData));
+        mr.dwMDDataLen = sizeof(dwData);
+        mr.pbMDData = reinterpret_cast<BYTE*>(&dwData);
+        break;
+    case STRING_METADATA:
+        hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzTemp);
+        mr.dwMDDataLen = (lstrlenW(pwzTemp) + 1) * sizeof(WCHAR);
+        mr.pbMDData = reinterpret_cast<BYTE*>(pwzTemp);
+        break;
+    case MULTISZ_METADATA:
+        {
+        hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzTemp);
+        mr.dwMDDataLen = (lstrlenW(pwzTemp) + 1) * sizeof(WCHAR);
+        for (LPWSTR pwzT = pwzTemp; *pwzT; ++pwzT)
+        {
+            if (MAGIC_MULTISZ_CHAR == *pwzT)
+            {
+                *pwzT = L'\0';
+            }
+        }
+        mr.pbMDData = reinterpret_cast<BYTE*>(pwzTemp);
+        }
+        break;
+    case BINARY_METADATA:
+        hr = WcaReadStreamFromCaData(ppwzCustomActionData, &mr.pbMDData, reinterpret_cast<DWORD_PTR *>(&mr.dwMDDataLen));
+        fFreeData = TRUE;
+        break;
+    default:
+        hr = E_UNEXPECTED;
+        break;
+    }
+    ExitOnFailure(hr, "failed to parse CustomActionData into metabase record");
+
+    WcaLog(LOGMSG_VERBOSE, "Writing Metabase Value Under Key: %ls ID: %d", pwzKey, mr.dwMDIdentifier);
+
+    hr = piMetabase->OpenKey(METADATA_MASTER_ROOT_HANDLE, L"/LM", METADATA_PERMISSION_WRITE, 10, &mhKey);
+    for (i = 30; i > 0 && HRESULT_FROM_WIN32(ERROR_PATH_BUSY) == hr; i--)
+    {
+        ::Sleep(1000);
+        WcaLog(LOGMSG_STANDARD, "failed to open '%ls' key, retrying %d time(s)...", pwzKey, i);
+        hr = piMetabase->OpenKey(METADATA_MASTER_ROOT_HANDLE, L"/LM", METADATA_PERMISSION_WRITE, 10, &mhKey);
+    }
+    MessageExitOnFailure(hr, msierrIISFailedOpenKey, "failed to open metabase key: %ls", pwzKey);
+
+    if (lstrlenW(pwzKey) < 3)
+    {
+        ExitOnFailure(hr = E_INVALIDARG, "Key didn't begin with \"/LM\" as expected - key value: %ls", pwzKey);
+    }
+
+    hr = piMetabase->SetData(mhKey, pwzKey + 3, &mr); // pwzKey + 3 to skip "/LM" that was used to open the key.
+
+    // This means we're trying to write to a secure key without the secure flag set - let's try again with the secure flag set
+    if (MD_ERROR_CANNOT_REMOVE_SECURE_ATTRIBUTE == hr)
+    {
+        mr.dwMDAttributes |= METADATA_SECURE;
+        hr = piMetabase->SetData(mhKey, pwzKey + 3, &mr);
+    }
+
+    // If IIS6 returned failure, let's check if the correct value exists in the metabase before actually failing the CA
+    if (FAILED(hr))
+    {
+        // Backup the original failure error, so we can log it below if necessary
+        HRESULT hrOldValue = hr;
+
+        mrGet.dwMDIdentifier = mr.dwMDIdentifier;
+        mrGet.dwMDAttributes = METADATA_NO_ATTRIBUTES;
+        mrGet.dwMDUserType = mr.dwMDUserType;
+        mrGet.dwMDDataType = mr.dwMDDataType;
+        mrGet.dwMDDataLen = mr.dwMDDataLen;
+        mrGet.pbMDData = static_cast<BYTE*>(MemAlloc(mr.dwMDDataLen, TRUE));
+
+        hr = piMetabase->GetData(mhKey, pwzKey + 3, &mrGet, &dwTemp);
+        if (SUCCEEDED(hr))
+        {
+            if (mrGet.dwMDDataType == mr.dwMDDataType && mrGet.dwMDDataLen == mr.dwMDDataLen && 0 == memcmp(mrGet.pbMDData, mr.pbMDData, mr.dwMDDataLen))
+            {
+                WcaLog(LOGMSG_VERBOSE, "Received error while writing metabase value under key: %ls ID: %d with error 0x%x, but the correct value is in the metabase - continuing", pwzKey, mr.dwMDIdentifier, hrOldValue);
+                hr = S_OK;
+            }
+            else
+            {
+                WcaLog(LOGMSG_VERBOSE, "Succeeded in checking metabase value after write value, but the values didn't match");
+                hr = hrOldValue;
+            }
+        }
+        else
+        {
+            WcaLog(LOGMSG_VERBOSE, "Failed to check value after metabase write failure (error code 0x%x)", hr);
+            hr = hrOldValue;
+        }
+    }
+    MessageExitOnFailure(hr, msierrIISFailedWriteData, "failed to write data to metabase key: %ls", pwzKey);
+
+    hr = WcaProgressMessage(COST_IIS_WRITEVALUE, FALSE);
+
+LExit:
+    ReleaseStr(pwzTemp);
+    ReleaseStr(pwzKey);
+
+    if (mhKey)
+    {
+        piMetabase->CloseKey(mhKey);
+    }
+
+    if (fFreeData && mr.pbMDData)
+    {
+        MemFree(mr.pbMDData);
+    }
+
+    return hr;
+}
+
+
+/********************************************************************
+ DeleteMetabaseValue -Installs metabase values
+
+  Input:  deferred CustomActionData - Key\tIdentifier\tAttributes\tUserType\tDataType\tData
+ * *****************************************************************/
+static HRESULT DeleteMetabaseValue(__in LPWSTR* ppwzCustomActionData, __in IMSAdminBase* piMetabase)
+{
+    //AssertSz(FALSE, "debug DeleteMetabaseValue here");
+    HRESULT hr = S_OK;
+
+    METADATA_HANDLE mhKey = 0;
+
+    LPWSTR pwzKey = NULL;
+    DWORD dwIdentifier = 0;
+    DWORD dwDataType = 0;
+
+    int i;
+
+    // get the key first
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzKey);
+    ExitOnFailure(hr, "failed to read key");
+    hr = WcaReadIntegerFromCaData(ppwzCustomActionData, reinterpret_cast<int *>(&dwIdentifier));
+    ExitOnFailure(hr, "failed to read identifier");
+    hr = WcaReadIntegerFromCaData(ppwzCustomActionData, reinterpret_cast<int *>(&dwDataType));
+    ExitOnFailure(hr, "failed to read data type");
+
+    WcaLog(LOGMSG_VERBOSE, "Deleting Metabase Value Under Key: %ls ID: %d", pwzKey, dwIdentifier);
+
+    hr = piMetabase->OpenKey(METADATA_MASTER_ROOT_HANDLE, L"/LM", METADATA_PERMISSION_WRITE, 10, &mhKey);
+    for (i = 30; i > 0 && HRESULT_FROM_WIN32(ERROR_PATH_BUSY) == hr; i--)
+    {
+        ::Sleep(1000);
+        WcaLog(LOGMSG_STANDARD, "failed to open '%ls' key, retrying %d time(s)...", pwzKey, i);
+        hr = piMetabase->OpenKey(METADATA_MASTER_ROOT_HANDLE, L"/LM", METADATA_PERMISSION_WRITE, 10, &mhKey);
+    }
+    MessageExitOnFailure(hr, msierrIISFailedOpenKey, "failed to open metabase key: %ls", pwzKey);
+
+    if (lstrlenW(pwzKey) < 3)
+    {
+        ExitOnFailure(hr = E_INVALIDARG, "Key didn't begin with \"/LM\" as expected - key value: %ls", pwzKey);
+    }
+
+    hr = piMetabase->DeleteData(mhKey, pwzKey + 3, dwIdentifier, dwDataType); // pwzKey + 3 to skip "/LM" that was used to open the key.
+    if (MD_ERROR_DATA_NOT_FOUND == hr || HRESULT_FROM_WIN32(ERROR_PATH_NOT_FOUND) == hr)
+    {
+        hr = S_OK;
+    }
+    MessageExitOnFailure(hr, msierrIISFailedDeleteValue, "failed to delete value %d from metabase key: %ls", dwIdentifier, pwzKey);
+
+    hr = WcaProgressMessage(COST_IIS_DELETEVALUE, FALSE);
+LExit:
+    ReleaseStr(pwzKey);
+
+    if (mhKey)
+        piMetabase->CloseKey(mhKey);
+
+    return hr;
+}
+
+
+/********************************************************************
+ DeleteAspApp - Deletes applications in IIS
+
+  Input:  deferred CustomActionData - MetabaseRoot\tRecursive
+ * *****************************************************************/
+static HRESULT DeleteAspApp(__in LPWSTR* ppwzCustomActionData, __in IMSAdminBase* piMetabase, __in ICatalogCollection* pApplicationCollection, __in IWamAdmin* piWam)
+{
+    const int BUFFER_BYTES = 512;
+    const BSTR bstrPropName = SysAllocString(L"Deleteable");
+
+    HRESULT hr = S_OK;
+    ICatalogObject* pApplication = NULL;
+
+    LPWSTR pwzRoot = NULL;
+    DWORD dwActualBufferSize = 0;
+    long lSize = 0;
+    long lIndex = 0;
+    long lChanges = 0;
+
+    VARIANT keyValue;
+    ::VariantInit(&keyValue);
+    VARIANT propValue;
+    propValue.vt = VT_BOOL;
+    propValue.boolVal = TRUE;
+
+    METADATA_RECORD mr;
+    // Get current set of web service extensions.
+    ::ZeroMemory(&mr, sizeof(mr));
+    mr.dwMDIdentifier = MD_APP_PACKAGE_ID;
+    mr.dwMDAttributes = 0;
+    mr.dwMDUserType  = ASP_MD_UT_APP;
+    mr.dwMDDataType = STRING_METADATA;
+    mr.pbMDData = new unsigned char[BUFFER_BYTES];
+    mr.dwMDDataLen = BUFFER_BYTES;
+
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzRoot); // MetabaseRoot
+    ExitOnFailure(hr, "failed to get metabase root");
+
+    hr = piMetabase->GetData(METADATA_MASTER_ROOT_HANDLE, pwzRoot, &mr, &dwActualBufferSize);
+    if (HRESULT_FROM_WIN32(MD_ERROR_DATA_NOT_FOUND) == hr || HRESULT_FROM_WIN32(ERROR_PATH_NOT_FOUND) == hr || HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND) == hr)
+    {
+        // This one doesn't have an independent app GUID associated with it - it may have been already partially deleted, or a low isolation app
+        WcaLog(LOGMSG_VERBOSE, "No independent COM+ application found associated with %ls. It either doesn't exist, or was already removed - continuing", pwzRoot);
+        ExitFunction1(hr = S_OK);
+    }
+    MessageExitOnFailure(hr, msierrIISFailedDeleteApp, "failed to get GUID for application at path: %ls", pwzRoot);
+
+    WcaLog(LOGMSG_VERBOSE, "Deleting ASP App (used query: %ls) with GUID: %ls", pwzRoot, (LPWSTR)(mr.pbMDData));
+
+    // Delete the application association from IIS's point of view before it's obliterated from the application collection
+    hr = piWam->AppDelete(pwzRoot, FALSE);
+    if (FAILED(hr))
+    {
+        // This isn't necessarily an error if we fail here, but let's log a failure if it happens
+        WcaLog(LOGMSG_VERBOSE, "error 0x%x: failed to call IWamAdmin::AppDelete() while removing web application - continuing");
+        hr = S_OK;
+    }
+
+    if (!pApplicationCollection)
+    {
+        WcaLog(LOGMSG_STANDARD, "Could not remove application with GUID %ls because the application collection could not be found", (LPWSTR)(mr.pbMDData));
+        ExitFunction1(hr = S_OK);
+    }
+
+    hr = pApplicationCollection->Populate();
+    MessageExitOnFailure(hr, msierrIISFailedDeleteApp, "failed to populate Application collection");
+
+    hr = pApplicationCollection->get_Count(&lSize);
+    MessageExitOnFailure(hr, msierrIISFailedDeleteApp, "failed to get size of Application collection");
+    WcaLog(LOGMSG_TRACEONLY, "Found %u items in application collection", lSize);
+
+    // No need to check this too early, as we may not even need this to have successfully allocated
+    ExitOnNull(bstrPropName, hr, E_OUTOFMEMORY, "failed to allocate memory for \"Deleteable\" string");
+
+    for (lIndex = 0; lIndex < lSize; ++lIndex)
+    {
+        hr = pApplicationCollection->get_Item(lIndex, reinterpret_cast<IDispatch**>(&pApplication));
+        MessageExitOnFailure(hr, msierrIISFailedDeleteApp, "failed to get COM+ application while enumerating through COM+ applications");
+
+        hr = pApplication->get_Key(&keyValue);
+        MessageExitOnFailure(hr, msierrIISFailedDeleteApp, "failed to get key of COM+ application while enumerating through COM+ applications");
+
+        WcaLog(LOGMSG_TRACEONLY, "While enumerating through COM+ applications, found an application with GUID: %ls", (LPWSTR)keyValue.bstrVal);
+
+        if (VT_BSTR == keyValue.vt && 0 == lstrcmpW((LPWSTR)keyValue.bstrVal, (LPWSTR)(mr.pbMDData)))
+        {
+            hr = pApplication->put_Value(bstrPropName, propValue);
+            if (FAILED(hr))
+            {
+                // This isn't necessarily a critical error unless we fail to actually delete it in the next step
+                WcaLog(LOGMSG_VERBOSE, "error 0x%x: failed to ensure COM+ application with guid %ls is deletable - continuing", hr, (LPWSTR)(mr.pbMDData));
+            }
+
+            hr = pApplicationCollection->SaveChanges(&lChanges);
+            if (FAILED(hr))
+            {
+                // This isn't necessarily a critical error unless we fail to actually delete it in the next step
+                WcaLog(LOGMSG_VERBOSE, "error 0x%x: failed to save changes while ensuring COM+ application with guid %ls is deletable - continuing", hr, (LPWSTR)(mr.pbMDData));
+            }
+
+            hr = pApplicationCollection->Remove(lIndex);
+            if (FAILED(hr))
+            {
+                WcaLog(LOGMSG_STANDARD, "error 0x%x: failed to remove COM+ application with guid %ls. The COM application will not be removed", hr, (LPWSTR)(mr.pbMDData));
+            }
+            else
+            {
+                hr = pApplicationCollection->SaveChanges(&lChanges);
+                if (FAILED(hr))
+                {
+                    WcaLog(LOGMSG_STANDARD, "error 0x%x: failed to save changes when removing COM+ application with guid %ls. The COM application will not be removed - continuing", hr, (LPWSTR)(mr.pbMDData));
+                }
+                else
+                {
+                    WcaLog(LOGMSG_VERBOSE, "Found and removed application with GUID %ls", (LPWSTR)(mr.pbMDData));
+                }
+            }
+
+            // We've found the right key and successfully deleted the app - let's exit the loop now
+            lIndex = lSize;
+        }
+    }
+    // If we didn't find it, it isn't an error, because the application we want to delete doesn't seem to exist!
+
+    hr = WcaProgressMessage(COST_IIS_DELETEAPP, FALSE);
+LExit:
+    ReleaseBSTR(bstrPropName);
+
+    ReleaseStr(pwzRoot);
+    // Don't release pApplication, because it points to an object within the collection
+
+    delete [] mr.pbMDData;
+
+    return hr;
+}
+
+
+/********************************************************************
+ CreateAspApp - Creates applications in IIS
+
+  Input:  deferred CustomActionData - MetabaseRoot\tInProc
+ * ****************************************************************/
+static HRESULT CreateAspApp(__in LPWSTR* ppwzCustomActionData, __in IWamAdmin* piWam)
+{
+    HRESULT hr = S_OK;
+
+    LPWSTR pwzRoot = NULL;
+    BOOL fInProc;
+
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzRoot); // MetabaseRoot
+    ExitOnFailure(hr, "failed to get metabase root");
+    hr = WcaReadIntegerFromCaData(ppwzCustomActionData, reinterpret_cast<int *>(&fInProc)); // InProc
+    ExitOnFailure(hr, "failed to get in proc flag");
+
+    WcaLog(LOGMSG_VERBOSE, "Creating ASP App: %ls", pwzRoot);
+
+    hr = piWam->AppCreate(pwzRoot, fInProc);
+    MessageExitOnFailure(hr, msierrIISFailedCreateApp, "failed to create web application: %ls", pwzRoot);
+
+    hr = WcaProgressMessage(COST_IIS_CREATEAPP, FALSE);
+LExit:
+    return hr;
+}
+
+
+/********************************************************************
+ DeleteMetabaseKey - Deletes metabase keys
+
+  Input:  deferred CustomActionData - Key
+ ******************************************************************/
+static HRESULT DeleteMetabaseKey(__in LPWSTR *ppwzCustomActionData, __in IMSAdminBase* piMetabase)
+{
+    HRESULT hr = S_OK;
+
+    METADATA_HANDLE mhRoot = 0;
+
+    LPWSTR pwzData = NULL;
+
+    LPCWSTR pwzKey;
+    int i;
+
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzData);
+    ExitOnFailure(hr, "failed to read key to be deleted");
+
+    hr = piMetabase->OpenKey(METADATA_MASTER_ROOT_HANDLE, L"/LM", METADATA_PERMISSION_WRITE, 10, &mhRoot);
+    for (i = 30; i > 0 && HRESULT_FROM_WIN32(ERROR_PATH_BUSY) == hr; i--)
+    {
+        ::Sleep(1000);
+        WcaLog(LOGMSG_STANDARD, "failed to open root key, retrying %d time(s)...", i);
+        hr = piMetabase->OpenKey(METADATA_MASTER_ROOT_HANDLE, L"/LM", METADATA_PERMISSION_WRITE, 10, &mhRoot);
+    }
+    MessageExitOnFailure(hr, msierrIISFailedOpenKey, "failed to open metabase key: %ls", L"/LM");
+
+    pwzKey = pwzData + 3;
+
+    WcaLog(LOGMSG_VERBOSE, "Deleting Metabase Key: %ls", pwzKey);
+
+    hr = piMetabase->DeleteKey(mhRoot, pwzKey);
+    if (HRESULT_FROM_WIN32(ERROR_PATH_NOT_FOUND) == hr)
+    {
+        WcaLog(LOGMSG_STANDARD, "Key `%ls` did not exist, continuing.", pwzData);
+        hr = S_OK;
+    }
+    MessageExitOnFailure(hr, msierrIISFailedDeleteKey, "failed to delete metabase key: %ls", pwzData);
+
+    hr = WcaProgressMessage(COST_IIS_DELETEKEY, FALSE);
+LExit:
+    if (mhRoot)
+    {
+        piMetabase->CloseKey(mhRoot);
+    }
+
+    return hr;
+}
+
+
+/********************************************************************
+ WriteMetabaseChanges - CUSTOM ACTION ENTRY POINT for IIS Metabase changes
+
+ *******************************************************************/
+extern "C" UINT __stdcall WriteMetabaseChanges(MSIHANDLE hInstall)
+{
+//AssertSz(FALSE, "debug WriteMetabaseChanges here");
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+    IMSAdminBase* piMetabase = NULL;
+    IWamAdmin* piWam = NULL;
+    ICOMAdminCatalog* pCatalog = NULL;
+    ICatalogCollection* pApplicationCollection = NULL;
+    WCA_CASCRIPT_HANDLE hWriteMetabaseScript = NULL;
+    BSTR bstrApplications = SysAllocString(L"Applications");
+    BOOL fInitializedCom = FALSE;
+
+    LPWSTR pwzData = NULL;
+    LPWSTR pwz = NULL;
+    LPWSTR pwzScriptKey = NULL;
+    METABASE_ACTION maAction = MBA_UNKNOWNACTION;
+
+    hr = WcaInitialize(hInstall, "WriteMetabaseChanges");
+    ExitOnFailure(hr, "failed to initialize");
+
+    hr = ::CoInitialize(NULL);
+    ExitOnFailure(hr, "failed to initialize COM");
+    fInitializedCom = TRUE;
+
+    hr = WcaGetProperty( L"CustomActionData", &pwzData);
+    ExitOnFailure(hr, "failed to get CustomActionData");
+
+    WcaLog(LOGMSG_TRACEONLY, "CustomActionData: %ls", pwzData);
+
+    // Get the CaScript key
+    hr = WcaReadStringFromCaData(&pwzData, &pwzScriptKey);
+    ExitOnFailure(hr, "Failed to get CaScript key from custom action data");
+
+    hr = WcaCaScriptOpen(WCA_ACTION_INSTALL, WCA_CASCRIPT_SCHEDULED, FALSE, pwzScriptKey, &hWriteMetabaseScript);
+    ExitOnFailure(hr, "Failed to open CaScript file");
+
+    // The rest of our existing custom action data string should be empty - go ahead and overwrite it
+    ReleaseNullStr(pwzData);
+    hr = WcaCaScriptReadAsCustomActionData(hWriteMetabaseScript, &pwzData);
+    ExitOnFailure(hr, "Failed to read script into CustomAction data.");
+
+    pwz = pwzData;
+
+    while (S_OK == (hr = WcaReadIntegerFromCaData(&pwz, (int *)&maAction)))
+    {
+        switch (maAction)
+        {
+        case MBA_CREATEAPP:
+            if (NULL == piWam)
+            {
+                hr = ::CoCreateInstance(CLSID_WamAdmin, NULL, CLSCTX_ALL, IID_IWamAdmin, reinterpret_cast<void**>(&piWam));
+                MessageExitOnFailure(hr, msierrIISCannotConnect, "failed to get IID_IWamAdmin object");
+            }
+
+            hr = CreateAspApp(&pwz, piWam);
+            ExitOnFailure(hr, "failed to create ASP App");
+            break;
+        case MBA_DELETEAPP:
+            if (NULL == piMetabase)
+            {
+                hr = ::CoCreateInstance(CLSID_MSAdminBase, NULL, CLSCTX_ALL, IID_IMSAdminBase, reinterpret_cast<void**>(&piMetabase));
+                MessageExitOnFailure(hr, msierrIISCannotConnect, "failed to get IID_IIMSAdminBase object");
+            }
+
+            if (NULL == pCatalog)
+            {
+                hr = CoCreateInstance(CLSID_COMAdminCatalog, NULL, CLSCTX_INPROC_SERVER, IID_IUnknown, (void**)&pCatalog);
+                MessageExitOnFailure(hr, msierrIISCannotConnect, "failed to get IID_ICOMAdmin object");
+
+                hr = pCatalog->GetCollection(bstrApplications, reinterpret_cast<IDispatch**>(&pApplicationCollection));
+                if (FAILED(hr))
+                {
+                    hr = S_OK;
+                    WcaLog(LOGMSG_STANDARD, "error 0x%x: failed to get ApplicationCollection object for list of COM+ applications - COM+ applications will not be able to be uninstalled - continuing", hr);
+                }
+            }
+
+            if (NULL == piWam)
+            {
+                hr = ::CoCreateInstance(CLSID_WamAdmin, NULL, CLSCTX_ALL, IID_IWamAdmin, reinterpret_cast<void**>(&piWam));
+                MessageExitOnFailure(hr, msierrIISCannotConnect, "failed to get IID_IWamAdmin object");
+            }
+
+            hr = DeleteAspApp(&pwz, piMetabase, pApplicationCollection, piWam);
+            ExitOnFailure(hr, "failed to delete ASP App");
+            break;
+        case MBA_CREATEKEY:
+            if (NULL == piMetabase)
+            {
+                hr = ::CoCreateInstance(CLSID_MSAdminBase, NULL, CLSCTX_ALL, IID_IMSAdminBase, reinterpret_cast<void**>(&piMetabase));
+                MessageExitOnFailure(hr, msierrIISCannotConnect, "failed to get IID_IIMSAdminBase object");
+            }
+
+            hr = CreateMetabaseKey(&pwz, piMetabase);
+            ExitOnFailure(hr, "failed to create metabase key");
+            break;
+        case MBA_DELETEKEY:
+            if (NULL == piMetabase)
+            {
+                hr = ::CoCreateInstance(CLSID_MSAdminBase, NULL, CLSCTX_ALL, IID_IMSAdminBase, reinterpret_cast<void**>(&piMetabase));
+                MessageExitOnFailure(hr, msierrIISCannotConnect, "failed to get IID_IIMSAdminBase object");
+            }
+
+            hr = DeleteMetabaseKey(&pwz, piMetabase);
+            ExitOnFailure(hr, "failed to delete metabase key");
+            break;
+        case MBA_WRITEVALUE:
+            if (NULL == piMetabase)
+            {
+                hr = ::CoCreateInstance(CLSID_MSAdminBase, NULL, CLSCTX_ALL, IID_IMSAdminBase, reinterpret_cast<void**>(&piMetabase));
+                MessageExitOnFailure(hr, msierrIISCannotConnect, "failed to get IID_IIMSAdminBase object");
+            }
+
+            hr = WriteMetabaseValue(&pwz, piMetabase);
+            ExitOnFailure(hr, "failed to write metabase value");
+            break;
+        case MBA_DELETEVALUE:
+            if (NULL == piMetabase)
+            {
+                hr = ::CoCreateInstance(CLSID_MSAdminBase, NULL, CLSCTX_ALL, IID_IMSAdminBase, reinterpret_cast<void**>(&piMetabase));
+                MessageExitOnFailure(hr, msierrIISCannotConnect, "failed to get IID_IIMSAdminBase object");
+            }
+
+            hr = DeleteMetabaseValue(&pwz, piMetabase);
+            ExitOnFailure(hr, "failed to delete metabase value");
+            break;
+        default:
+            ExitOnFailure(hr = E_UNEXPECTED, "Unexpected metabase action specified: %d", maAction);
+            break;
+        }
+    }
+    if (E_NOMOREITEMS == hr) // If there are no more items, all is well
+    {
+        if (NULL != piMetabase)
+        {
+            hr = piMetabase->SaveData();
+            for (int i = 30; i > 0 && HRESULT_FROM_WIN32(ERROR_PATH_BUSY) == hr; i--)
+            {
+                ::Sleep(1000);
+                WcaLog(LOGMSG_VERBOSE, "Failed to force save of metabase data, retrying %d time(s)...", i);
+                hr = piMetabase->SaveData();
+            }
+            if (FAILED(hr))
+            {
+                WcaLog(LOGMSG_VERBOSE, "Failed to force save of metabase data: 0x%x - continuing", hr);
+            }
+            hr = S_OK;
+        }
+        else
+        {
+            hr = S_OK;
+        }
+    }
+
+LExit:
+    WcaCaScriptClose(hWriteMetabaseScript, WCA_CASCRIPT_CLOSE_DELETE);
+
+    ReleaseBSTR(bstrApplications);
+    ReleaseStr(pwzScriptKey);
+    ReleaseStr(pwzData);
+    ReleaseObject(piMetabase);
+    ReleaseObject(piWam);
+    ReleaseObject(pCatalog);
+    ReleaseObject(pApplicationCollection);
+
+    if (fInitializedCom)
+    {
+        ::CoUninitialize();
+    }
+
+    if (FAILED(hr))
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+    return WcaFinalize(er);
+}
+/********************************************************************
+ WriteIIS7ConfigChanges - CUSTOM ACTION ENTRY POINT for IIS7 config changes
+
+ *******************************************************************/
+extern "C" UINT __stdcall WriteIIS7ConfigChanges(MSIHANDLE hInstall)
+{
+    //AssertSz(FALSE, "debug WriteIIS7ConfigChanges here");
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+    LPWSTR pwzData = NULL;
+    LPWSTR pwzScriptKey = NULL;
+    LPWSTR pwzHashString = NULL;
+    BYTE rgbActualHash[SHA1_HASH_LEN] = { };
+    DWORD dwHashedBytes = SHA1_HASH_LEN;
+
+    WCA_CASCRIPT_HANDLE hWriteIis7Script = NULL;
+
+    hr = WcaInitialize(hInstall, "WriteIIS7ConfigChanges");
+    ExitOnFailure(hr, "Failed to initialize");
+
+    hr = WcaGetProperty( L"CustomActionData", &pwzScriptKey);
+    ExitOnFailure(hr, "Failed to get CustomActionData");
+    WcaLog(LOGMSG_TRACEONLY, "Script WriteIIS7ConfigChanges: %ls", pwzScriptKey);
+
+    hr = WcaCaScriptOpen(WCA_ACTION_INSTALL, WCA_CASCRIPT_SCHEDULED, FALSE, pwzScriptKey, &hWriteIis7Script);
+    ExitOnFailure(hr, "Failed to open CaScript file");
+
+    hr = WcaCaScriptReadAsCustomActionData(hWriteIis7Script, &pwzData);
+    ExitOnFailure(hr, "Failed to read script into CustomAction data.");
+
+    hr = CrypHashBuffer((BYTE*)pwzData, sizeof(pwzData) * sizeof(WCHAR), PROV_RSA_AES, CALG_SHA1, rgbActualHash, dwHashedBytes);
+    ExitOnFailure(hr, "Failed to calculate hash of CustomAction data.");
+
+    hr = StrAlloc(&pwzHashString, ((dwHashedBytes * 2) + 1));
+    ExitOnFailure(hr, "Failed to allocate string for script hash");
+
+    hr = StrHexEncode(rgbActualHash, dwHashedBytes, pwzHashString, ((dwHashedBytes * 2) + 1));
+    ExitOnFailure(hr, "Failed to convert hash bytes to string.");
+
+    WcaLog(LOGMSG_TRACEONLY, "CustomActionData WriteIIS7ConfigChanges: %ls", pwzData);
+    WcaLog(LOGMSG_VERBOSE,  "Custom action data hash: %ls", pwzHashString);
+    WcaLog(LOGMSG_VERBOSE, "CustomActionData WriteIIS7ConfigChanges length: %d", wcslen(pwzData));
+
+    hr = IIS7ConfigChanges(hInstall, pwzData);
+    ExitOnFailure(hr, "WriteIIS7ConfigChanges Failed.");
+
+LExit:
+    WcaCaScriptClose(hWriteIis7Script, WCA_CASCRIPT_CLOSE_DELETE);
+    ReleaseStr(pwzScriptKey);
+    ReleaseStr(pwzData);
+    ReleaseStr(pwzHashString);
+
+    if (FAILED(hr))
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+
+    return WcaFinalize(er);
+}
+
+
+/********************************************************************
+ CommitIIS7ConfigTransaction - CUSTOM ACTION ENTRY POINT for unbacking up config
+
+  Input:  deferred CustomActionData - BackupName
+ * *****************************************************************/
+extern "C" UINT __stdcall CommitIIS7ConfigTransaction(MSIHANDLE hInstall)
+{
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+    LPWSTR pwzData = NULL;
+    WCHAR wzConfigCopy[MAX_PATH];
+    DWORD dwSize = 0;
+
+    BOOL fIsWow64Process = FALSE;
+    BOOL fIsFSRedirectDisabled = FALSE;
+
+    hr = WcaInitialize(hInstall, "CommitIIS7ConfigTransaction");
+    ExitOnFailure(hr, "failed to initialize IIS7 commit transaction");
+
+    WcaInitializeWow64();
+    fIsWow64Process = WcaIsWow64Process();
+    if (fIsWow64Process)
+    {
+        hr = WcaDisableWow64FSRedirection();
+        if(FAILED(hr))
+        {
+            //eat this error
+            hr = S_OK;
+        }
+        else
+        {
+            fIsFSRedirectDisabled = TRUE;
+        }
+    }
+
+    hr = WcaGetProperty( L"CustomActionData", &pwzData);
+    ExitOnFailure(hr, "failed to get CustomActionData");
+
+    // Config AdminMgr changes already committed, just
+    // delete backup config file.
+
+    dwSize = ExpandEnvironmentStringsW(L"%windir%\\system32\\inetsrv\\config\\applicationHost.config",
+                                      wzConfigCopy,
+                                      MAX_PATH
+                                      );
+    if ( dwSize == 0 )
+    {
+        ExitWithLastError(hr, "failed to get ExpandEnvironmentStrings");
+    }
+
+    hr = ::StringCchCatW(wzConfigCopy, MAX_PATH, L".");
+    ExitOnFailure(hr, "Commit IIS7 failed StringCchCatW of .");
+
+    hr = ::StringCchCatW(wzConfigCopy, MAX_PATH, pwzData);
+    ExitOnFailure(hr, "Commit IIS7 failed StringCchCatW of extension");
+
+    if (!::DeleteFileW(wzConfigCopy))
+    {
+        hr = HRESULT_FROM_WIN32(GetLastError());
+        if (HRESULT_FROM_WIN32(ERROR_PATH_NOT_FOUND) == hr ||
+            HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND) == hr)
+        {
+            WcaLog(LOGMSG_STANDARD, "Failed to delete backup applicationHost, not found - continuing");
+            hr = S_OK;
+        }
+        else
+        {
+            ExitOnFailure(hr, "failed to delete config backup");
+        }
+    }
+
+LExit:
+    ReleaseStr(pwzData);
+
+    // Make sure we revert FS Redirection if necessary before exiting
+    if (fIsFSRedirectDisabled)
+    {
+        fIsFSRedirectDisabled = FALSE;
+        WcaRevertWow64FSRedirection();
+    }
+    WcaFinalizeWow64();
+
+
+    if (FAILED(hr))
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+    return WcaFinalize(er);
+}
+/********************************************************************
+ StartIIS7Config Transaction - CUSTOM ACTION ENTRY POINT for backing up config
+
+  Input:  deferred CustomActionData - BackupName
+********************************************************************/
+extern "C" UINT __stdcall StartIIS7ConfigTransaction(MSIHANDLE hInstall)
+{
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+    LPWSTR pwzData = NULL;
+    WCHAR wzConfigSource[MAX_PATH];
+    WCHAR wzConfigCopy[MAX_PATH];
+    DWORD dwSize = 0;
+
+
+    BOOL fIsWow64Process = FALSE;
+    BOOL fIsFSRedirectDisabled = FALSE;
+
+    // initialize
+    hr = WcaInitialize(hInstall, "StartIIS7ConfigTransaction");
+    ExitOnFailure(hr, "failed to initialize StartIIS7ConfigTransaction");
+
+    WcaInitializeWow64();
+    fIsWow64Process = WcaIsWow64Process();
+    if (fIsWow64Process)
+    {
+        hr = WcaDisableWow64FSRedirection();
+        if(FAILED(hr))
+        {
+            //eat this error
+            hr = S_OK;
+        }
+        else
+        {
+            fIsFSRedirectDisabled = TRUE;
+        }
+    }
+
+    hr = WcaGetProperty(L"CustomActionData", &pwzData);
+    ExitOnFailure(hr, "failed to get CustomActionData");
+
+
+    dwSize = ExpandEnvironmentStringsW(L"%windir%\\system32\\inetsrv\\config\\applicationHost.config",
+                                      wzConfigSource,
+                                      MAX_PATH
+                                      );
+    if ( dwSize == 0 )
+    {
+        ExitWithLastError(hr, "failed to get ExpandEnvironmentStrings");
+    }
+    hr = ::StringCchCopyW(wzConfigCopy, MAX_PATH, wzConfigSource);
+    ExitOnFailure(hr, "Commit IIS7 failed StringCchCopyW");
+
+    //add ca action as extension
+
+    hr = ::StringCchCatW(wzConfigCopy, MAX_PATH, L".");
+    ExitOnFailure(hr, "Commit IIS7 failed StringCchCatW of .");
+
+    hr = ::StringCchCatW(wzConfigCopy, MAX_PATH, pwzData);
+    ExitOnFailure(hr, "Commit IIS7 failed StringCchCatW of extension");
+
+    if ( !::CopyFileW(wzConfigSource, wzConfigCopy, FALSE) )
+    {
+        hr = HRESULT_FROM_WIN32(GetLastError());
+        if (HRESULT_FROM_WIN32(ERROR_PATH_NOT_FOUND) == hr ||
+            HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND) == hr)
+        {
+            // IIS may not be installed on the machine, we'll fail later if we try to install anything
+            WcaLog(LOGMSG_STANDARD, "Failed to back up applicationHost, not found - continuing");
+            hr = S_OK;
+        }
+        else
+        {
+            ExitOnFailure(hr, "Failed to copy config backup %ls -> %ls", wzConfigSource, wzConfigCopy);
+        }
+    }
+
+
+    hr = WcaProgressMessage(COST_IIS_TRANSACTIONS, FALSE);
+
+
+LExit:
+
+    ReleaseStr(pwzData);
+
+    // Make sure we revert FS Redirection if necessary before exiting
+    if (fIsFSRedirectDisabled)
+    {
+        fIsFSRedirectDisabled = FALSE;
+        WcaRevertWow64FSRedirection();
+    }
+    WcaFinalizeWow64();
+
+    if (FAILED(hr))
+        er = ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+
+/********************************************************************
+ RollbackIIS7ConfigTransaction - CUSTOM ACTION ENTRY POINT for unbacking up config
+
+  Input:  deferred CustomActionData - BackupName
+********************************************************************/
+extern "C" UINT __stdcall RollbackIIS7ConfigTransaction(MSIHANDLE hInstall)
+{
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+    LPWSTR pwzData = NULL;
+    WCHAR wzConfigSource[MAX_PATH];
+    WCHAR wzConfigCopy[MAX_PATH];
+    DWORD dwSize = 0;
+
+    BOOL fIsWow64Process = FALSE;
+    BOOL fIsFSRedirectDisabled = FALSE;
+
+    hr = WcaInitialize(hInstall, "RollbackIIS7ConfigTransaction");
+    ExitOnFailure(hr, "failed to initialize");
+
+    WcaInitializeWow64();
+    fIsWow64Process = WcaIsWow64Process();
+    if (fIsWow64Process)
+    {
+        hr = WcaDisableWow64FSRedirection();
+        if(FAILED(hr))
+        {
+            //eat this error
+            hr = S_OK;
+        }
+        else
+        {
+            fIsFSRedirectDisabled = TRUE;
+        }
+    }
+
+    hr = WcaGetProperty( L"CustomActionData", &pwzData);
+    ExitOnFailure(hr, "failed to get CustomActionData");
+
+    dwSize = ExpandEnvironmentStringsW(L"%windir%\\system32\\inetsrv\\config\\applicationHost.config",
+                                      wzConfigSource,
+                                      MAX_PATH
+                                      );
+    if ( dwSize == 0 )
+    {
+        ExitWithLastError(hr, "failed to get ExpandEnvironmentStrings");
+    }
+    hr = ::StringCchCopyW(wzConfigCopy, MAX_PATH, wzConfigSource);
+    ExitOnFailure(hr, "Commit IIS7 failed StringCchCopyW");
+
+    //add ca action as extension
+
+    hr = ::StringCchCatW(wzConfigCopy, MAX_PATH, L".");
+    ExitOnFailure(hr, "Commit IIS7 failed StringCchCatW of .");
+
+    hr = ::StringCchCatW(wzConfigCopy, MAX_PATH, pwzData);
+    ExitOnFailure(hr, "Commit IIS7 failed StringCchCatW of extension");
+
+    //copy is reverse of start transaction
+    if (!::CopyFileW(wzConfigCopy, wzConfigSource, FALSE))
+    {
+        hr = HRESULT_FROM_WIN32(GetLastError());
+        if (HRESULT_FROM_WIN32(ERROR_PATH_NOT_FOUND) == hr ||
+            HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND) == hr)
+        {
+            WcaLog(LOGMSG_STANDARD, "Failed to restore applicationHost, not found - continuing");
+            hr = S_OK;
+        }
+        else
+        {
+            ExitOnFailure(hr, "failed to restore config backup");
+        }
+    }
+
+    if (!::DeleteFileW(wzConfigCopy))
+    {
+        ExitWithLastError(hr, "failed to delete config backup");
+    }
+
+    hr = WcaProgressMessage(COST_IIS_TRANSACTIONS, FALSE);
+
+LExit:
+    ReleaseStr(pwzData);
+
+    // Make sure we revert FS Redirection if necessary before exiting
+    if (fIsFSRedirectDisabled)
+    {
+        fIsFSRedirectDisabled = FALSE;
+        WcaRevertWow64FSRedirection();
+    }
+    WcaFinalizeWow64();
+
+    if (FAILED(hr))
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+    return WcaFinalize(er);
+}
diff --git a/src/ca/scaexecIIS7.cpp b/src/ca/scaexecIIS7.cpp
new file mode 100644
index 00000000..108007a1
--- /dev/null
+++ b/src/ca/scaexecIIS7.cpp
@@ -0,0 +1,4205 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+#include "precomp.h"
+
+//local CAData action functions
+HRESULT IIS7Site(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    );
+
+HRESULT IIS7Application(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    );
+HRESULT IIS7VDir(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    );
+HRESULT IIS7Binding(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    );
+HRESULT IIS7AppPool(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    );
+HRESULT IIS7AppExtension(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    );
+HRESULT IIS7MimeMap(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    );
+HRESULT IIS7DirProperties(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    );
+HRESULT IIS7WebLog(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    );
+HRESULT IIS7FilterGlobal(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    );
+HRESULT IIS7FilterSite(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    );
+HRESULT IIS7HttpHeader(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    );
+HRESULT IIS7WebError(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    );
+HRESULT IIS7WebSvcExt(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    );
+HRESULT IIS7WebProperty(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    );
+HRESULT IIS7WebDir(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    );
+HRESULT IIS7AspProperty(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    );
+HRESULT IIS7SslBinding(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    );
+//local helper functions
+
+static HRESULT GetNextAvailableSiteId(
+    IAppHostWritableAdminManager *pAdminMgr,
+    DWORD *plSiteId
+    );
+static HRESULT GetSiteElement(
+    IAppHostWritableAdminManager *pAdminMgr,
+    LPCWSTR swSiteName,
+    IAppHostElement **pSiteElement,
+    BOOL* fFound
+    );
+static HRESULT GetApplicationElement(
+    IAppHostElement *pSiteElement,
+    LPCWSTR swAppPath,
+    IAppHostElement **pAppElement,
+    BOOL* fFound
+    );
+static HRESULT GetApplicationElementForVDir(
+    IAppHostElement *pSiteElement,
+    LPCWSTR swVDirPath,
+    IAppHostElement **ppAppElement,
+    LPCWSTR *ppwzVDirSubPath,
+    BOOL* fFound
+    );
+
+static HRESULT CreateApplication(
+    IAppHostElement *pSiteElement,
+    LPCWSTR swAppPath,
+    IAppHostElement **pAppElement
+    );
+static HRESULT DeleteApplication(
+    IAppHostElement *pSiteElement,
+    LPCWSTR swAppPath
+    );
+
+static HRESULT SetAppPool(
+    IAppHostElement *pAppElementpAppElement,
+    LPCWSTR pwzAppPool
+    );
+static HRESULT CreateVdir(
+    IAppHostElement *pAppElement,
+    LPCWSTR pwzVDirPath,
+    LPCWSTR pwzVDirPhyDir
+    );
+static HRESULT DeleteVdir(
+    IAppHostElement *pAppElement,
+    LPCWSTR pwzVDirPath
+    );
+
+static HRESULT CreateBinding(
+    IAppHostElement *pSiteElem,
+    LPCWSTR pwzProtocol,
+    LPCWSTR pwzInfo
+    );
+static HRESULT DeleteBinding(
+    IAppHostElement *pSiteElem,
+    LPCWSTR pwzProtocol,
+    LPCWSTR pwzInfo
+    );
+
+static HRESULT CreateSslBinding(
+    IAppHostElement *pSiteElem,
+    LPCWSTR pwzStoreName,
+    LPCWSTR pwzEncodedCertificateHash
+    );
+static HRESULT DeleteSslBinding(
+    IAppHostElement *pSiteElem,
+    LPCWSTR pwzStoreName,
+    LPCWSTR pwzEncodedCertificateHash
+    );
+
+static HRESULT CreateSite(
+    IAppHostElementCollection *pAdminMgr,
+    LPCWSTR swSiteName,
+    IAppHostElement **pSiteElement
+    );
+
+static HRESULT DeleteAppPool(
+    IAppHostWritableAdminManager *pAdminMgr,
+    LPCWSTR swAppPoolName
+    );
+static HRESULT CreateAppPool(
+    __inout LPWSTR *ppwzCustomActionData,
+    IAppHostWritableAdminManager *pAdminMgr,
+    LPCWSTR swAppPoolName
+    );
+
+static HRESULT SetDirPropAuthentications(
+    IAppHostWritableAdminManager *pAdminMgr,
+    LPCWSTR wcConfigPath,
+    DWORD dwData
+    );
+static HRESULT SetDirPropAuthProvider(
+    IAppHostWritableAdminManager *pAdminMgr,
+    LPCWSTR wszConfigPath,
+    __in LPWSTR wszData
+    );
+static HRESULT SetDirPropDefDoc(
+    IAppHostWritableAdminManager *pAdminMgr,
+    LPCWSTR wszConfigPath,
+    __in LPWSTR wszData
+    );
+
+static HRESULT ClearLocationTag(
+    IAppHostWritableAdminManager *pAdminMgr,
+    LPCWSTR swLocationPath
+    );
+
+static HRESULT CreateWebLog(
+    IAppHostElement *pSiteElem,
+    LPCWSTR pwzFormat
+    );
+
+static HRESULT CreateGlobalFilter(
+    __inout LPWSTR *ppwzCustomActionData,
+    IAppHostElement *pSection
+    );
+static HRESULT DeleteGlobalFilter(
+    __inout LPWSTR *ppwzCustomActionData,
+    IAppHostElement *pSection
+    );
+
+static HRESULT CreateSiteFilter(
+    __inout LPWSTR *ppwzCustomActionData,
+    IAppHostWritableAdminManager *pAdminMgr
+    );
+static HRESULT DeleteSiteFilter(
+    __inout LPWSTR *ppwzCustomActionData,
+    IAppHostWritableAdminManager *pAdminMgr
+    );
+
+static HRESULT DeleteCollectionElement(
+    __in IAppHostElementCollection *pCollection,
+    __in LPCWSTR pwzElementName,
+    __in LPCWSTR pwzAttributeName,
+    __in LPCWSTR pwzAttributeValue
+    );
+
+struct SCA_WEB_ERROR_SERVER
+{
+    int iErrorCode;
+    int iSubCode;
+    WCHAR wzFile[MAX_PATH];
+    WCHAR wzLangPath[MAX_PATH];
+    int iResponseMode;
+    SCA_WEB_ERROR_SERVER *psweNext;
+};
+static HRESULT AddWebErrorToList(
+    SCA_WEB_ERROR_SERVER** ppsweList
+    );
+static void ScaWebErrorFreeList7(
+    SCA_WEB_ERROR_SERVER *psweList
+    );
+static HRESULT PopulateHttpErrors(
+    IAppHostElement *pSection,
+    SCA_WEB_ERROR_SERVER **psweList
+    );
+static HRESULT GetErrorFromList(
+    const SCA_WEB_ERROR_SERVER & we,
+    SCA_WEB_ERROR_SERVER **ppsweList,
+    SCA_WEB_ERROR_SERVER **pswe,
+    BOOL *fFound
+    );
+
+static void ConvSecToHMS(
+    int Sec,
+    __out_ecount(cchDest) LPWSTR wcTime,
+    size_t cchDest
+    );
+static void ConvSecToDHMS(
+    unsigned int Sec,
+    __out_ecount(cchDest) LPWSTR wcTime,
+    size_t cchDest
+    );
+
+////////////////////////////////////////////////////////////////////
+// ScopeBSTR: Local helper class to construct & free BSTR from LPWSTR
+//
+/////////////////////////////////////////////////////////////////////
+class ScopeBSTR
+{
+public:
+    BSTR m_str;
+
+    ScopeBSTR()
+    {
+        m_str = NULL;
+    }
+
+    ScopeBSTR( __in LPCWSTR pSrc)
+    {
+        if (pSrc == NULL)
+        {
+            m_str = NULL;
+        }
+        else
+        {
+            m_str = ::SysAllocString(pSrc);
+
+        }
+    }
+
+    ~ScopeBSTR()
+    {
+        ::SysFreeString(m_str);
+    }
+
+    operator BSTR()
+    {
+        return m_str;
+    }
+};
+
+
+/********************************************************************
+ IIS7ConfigChanges - Start of IIS7 config changes
+
+ *******************************************************************/
+HRESULT IIS7ConfigChanges(MSIHANDLE /*hInstall*/, __inout LPWSTR pwzData)
+{
+    HRESULT hr = S_OK;
+    BOOL fInitializedCom = FALSE;
+
+    IAppHostWritableAdminManager *pAdminMgr = NULL;
+
+    LPWSTR pwz = NULL;
+    LPWSTR pwzLast = NULL;
+    LPWSTR pwzBackup = NULL;
+    DWORD cchData = lstrlenW(pwzData);
+    int iAction = -1;
+
+    int iRetryCount = 0;
+
+    hr = ::CoInitialize(NULL);
+    ExitOnFailure(hr, "Failed to initialize COM");
+    fInitializedCom = TRUE;
+
+    pwz = pwzLast = pwzData;
+
+    hr = StrAllocString(&pwzBackup, pwz, 0);
+    ExitOnFailure(hr, "Failed to backup custom action data");
+
+    while (S_OK == (hr = WcaReadIntegerFromCaData(&pwz, &iAction)))
+    {
+        if (NULL == pAdminMgr)
+        {
+            hr = ::CoCreateInstance( __uuidof(AppHostWritableAdminManager),
+                                    NULL,
+                                    CLSCTX_INPROC_SERVER,
+                                    __uuidof(IAppHostWritableAdminManager),
+                                    reinterpret_cast<void**> (&pAdminMgr));
+            ExitOnFailure(hr , "Failed to open AppHostWritableAdminManager to configure IIS7");
+        }
+
+        switch (iAction)
+        {
+        case IIS_SITE:
+            {
+#pragma prefast(suppress:26010, "This is a prefast issue - pAdminMgr is correctly allocated")
+                hr = IIS7Site(&pwz, pAdminMgr);
+                ExitOnFailure(hr, "Failed to configure IIS site.");
+                break;
+            }
+        case IIS_APPLICATION:
+            {
+#pragma prefast(suppress:26010, "This is a prefast issue - pAdminMgr is correctly allocated")
+                hr = IIS7Application(&pwz, pAdminMgr);
+                ExitOnFailure(hr, "Failed to configure IIS application.");
+                break;
+            }
+        case IIS_VDIR:
+            {
+#pragma prefast(suppress:26010, "This is a prefast issue - pAdminMgr is correctly allocated")
+                hr = IIS7VDir(&pwz, pAdminMgr);
+                ExitOnFailure(hr, "Failed to configure IIS VDir.");
+                break;
+            }
+        case IIS_BINDING:
+            {
+#pragma prefast(suppress:26010, "This is a prefast issue - pAdminMgr is correctly allocated")
+                hr = IIS7Binding(&pwz, pAdminMgr);
+                ExitOnFailure(hr, "Failed to configure IIS site binding.");
+                break;
+            }
+        case IIS_APPPOOL:
+            {
+#pragma prefast(suppress:26010, "This is a prefast issue - pAdminMgr is correctly allocated")
+                hr = IIS7AppPool(&pwz, pAdminMgr);
+                ExitOnFailure(hr, "Failed to configure IIS appPool.");
+                break;
+            }
+        case IIS_APPEXT_BEGIN:
+            {
+#pragma prefast(suppress:26010, "This is a prefast issue - pAdminMgr is correctly allocated")
+                hr = IIS7AppExtension(&pwz, pAdminMgr);
+                ExitOnFailure(hr, "Failed to configure IIS AppExtension.");
+                break;
+            }
+        case IIS_MIMEMAP_BEGIN:
+            {
+#pragma prefast(suppress:26010, "This is a prefast issue - pAdminMgr is correctly allocated")
+                hr = IIS7MimeMap(&pwz, pAdminMgr);
+                ExitOnFailure(hr, "Failed to configure IIS MimeMap.");
+                break;
+            }
+        case IIS_DIRPROP_BEGIN:
+            {
+#pragma prefast(suppress:26010, "This is a prefast issue - pAdminMgr is correctly allocated")
+                hr = IIS7DirProperties(&pwz, pAdminMgr);
+                ExitOnFailure(hr, "Failed to configure IIS DirProperties.");
+                break;
+            }
+        case IIS_WEBLOG:
+            {
+#pragma prefast(suppress:26010, "This is a prefast issue - pAdminMgr is correctly allocated")
+                hr = IIS7WebLog(&pwz, pAdminMgr);
+                ExitOnFailure(hr, "Failed to configure IIS WebLog.");
+                break;
+            }
+        case IIS_FILTER_GLOBAL_BEGIN:
+            {
+#pragma prefast(suppress:26010, "This is a prefast issue - pAdminMgr is correctly allocated")
+                hr = IIS7FilterGlobal(&pwz, pAdminMgr);
+                ExitOnFailure(hr, "Failed to configure IIS filter global.");
+                break;
+            }
+        case IIS_FILTER_BEGIN:
+            {
+#pragma prefast(suppress:26010, "This is a prefast issue - pAdminMgr is correctly allocated")
+                hr = IIS7FilterSite(&pwz, pAdminMgr);
+                ExitOnFailure(hr, "Failed to configure IIS Filter.");
+                break;
+            }
+        case IIS_HTTP_HEADER_BEGIN:
+            {
+#pragma prefast(suppress:26010, "This is a prefast issue - pAdminMgr is correctly allocated")
+                hr = IIS7HttpHeader(&pwz, pAdminMgr);
+                ExitOnFailure(hr, "Failed to configure IIS http Header.");
+                break;
+            }
+        case IIS_WEBERROR_BEGIN:
+            {
+#pragma prefast(suppress:26010, "This is a prefast issue - pAdminMgr is correctly allocated")
+                hr = IIS7WebError(&pwz, pAdminMgr);
+                ExitOnFailure(hr, "Failed to configure IIS http Errors.");
+                break;
+            }
+        case IIS_WEB_SVC_EXT:
+            {
+#pragma prefast(suppress:26010, "This is a prefast issue - pAdminMgr is correctly allocated")
+                hr = IIS7WebSvcExt(&pwz, pAdminMgr);
+                ExitOnFailure(hr, "Failed to configure IIS web svc ext.");
+                break;
+            }
+        case IIS_PROPERTY:
+            {
+#pragma prefast(suppress:26010, "This is a prefast issue - pAdminMgr is correctly allocated")
+                hr = IIS7WebProperty(&pwz, pAdminMgr);
+                ExitOnFailure(hr, "Failed to configure IIS web property.");
+                break;
+            }
+        case IIS_WEBDIR:
+            {
+#pragma prefast(suppress:26010, "This is a prefast issue - pAdminMgr is correctly allocated")
+                hr = IIS7WebDir(&pwz, pAdminMgr);
+                ExitOnFailure(hr, "Failed to configure IIS web directory.");
+                break;
+            }
+        case IIS_ASP_BEGIN:
+            {
+#pragma prefast(suppress:26010, "This is a prefast issue - pAdminMgr is correctly allocated")
+                hr = IIS7AspProperty(&pwz, pAdminMgr);
+                ExitOnFailure(hr, "Failed to configure IIS Asp property.");
+                break;
+            }
+        case IIS_SSL_BINDING:
+#pragma prefast(suppress:26010, "This is a prefast issue - pAdminMgr is correctly allocated")
+                hr = IIS7SslBinding(&pwz, pAdminMgr);
+                ExitOnFailure(hr, "Failed to configure IIS SSL binding.");
+                break;
+
+        default:
+            ExitOnFailure(hr = E_UNEXPECTED, "IIS7ConfigChanges: Unexpected IIS Config action specified: %d", iAction);
+            break;
+        }
+        if (S_OK == hr)
+        {
+            // commit config changes now to close out IIS Admin changes,
+            // the Rollback or Commit defered CAs will determine final commit status.
+            hr = pAdminMgr->CommitChanges();
+
+            // Our transaction may have been interrupted.
+            if (hr == HRESULT_FROM_WIN32(ERROR_SHARING_VIOLATION) || hr == HRESULT_FROM_WIN32(ERROR_TRANSACTIONAL_CONFLICT))
+            {
+                WcaLog(LOGMSG_VERBOSE, "Sharing violation or transactional conflict during attempt to save changes to applicationHost.config");
+                if (++iRetryCount > 30)
+                {
+                    if (IDRETRY == WcaErrorMessage(msierrIISFailedCommitInUse, hr, INSTALLMESSAGE_ERROR | MB_RETRYCANCEL, 0))
+                    {
+                        iRetryCount = 0;
+                    }
+                    else
+                    {
+                        ExitOnFailure(hr, "Failed to Commit IIS Config Changes, in silent mode or user has chosen to cancel");
+                    }
+                }
+
+                // Throw away the changes since IIS has no way to remove uncommited changes from an AdminManager.
+                ReleaseNullObject(pAdminMgr);
+
+                // Restore our CA data backup
+                pwz = pwzLast;
+                hr = ::StringCchCopyW(pwz, cchData - (pwz - pwzData) + 1, pwzBackup);
+                ExitOnFailure(hr , "Failed to restore custom action data backup");
+
+            }
+            else if (FAILED(hr))
+            {
+                ExitOnFailure(hr , "Failed to Commit IIS Config Changes");
+            }
+            else
+            {
+                // store a backup of CA data @ the last place that we successfully commited changes unless we are done.
+                if(NULL != pwz)
+                {
+                    pwzLast = pwz;
+                    hr = StrAllocString(&pwzBackup, pwz, 0);
+                    ExitOnFailure(hr, "Failed to backup custom action data");
+                }
+            }
+        }
+    }
+    if (E_NOMOREITEMS == hr) // If there are no more items, all is well
+    {
+        hr = S_OK;
+    }
+LExit:
+    ReleaseObject(pAdminMgr);
+    ReleaseStr(pwzBackup);
+
+    if (fInitializedCom)
+    {
+        ::CoUninitialize();
+    }
+
+    return hr;
+}
+//-------------------------------------------------------------------------------------------------
+// IIS7AspProperty
+// Called by WriteIIS7ConfigChanges
+// Processes asp properties for WebApplication
+//
+//-------------------------------------------------------------------------------------------------
+
+HRESULT IIS7AspProperty(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    )
+{
+    HRESULT hr = S_OK;
+
+    int iAction = -1;
+    int iData   =  0;
+
+    LPWSTR pwzData = NULL;
+    LPWSTR pwzSiteName = NULL;
+    LPWSTR pwzPathName = NULL;
+    LPWSTR pwzLocationPath = NULL;
+    WCHAR wcTime[60];
+
+    IAppHostElement *pSection = NULL;
+    IAppHostElement *pElement = NULL;
+
+    //read web site key
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzSiteName);
+    ExitOnFailure(hr, "Failed read webDir webkey");
+
+    //read path key
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzPathName);
+    ExitOnFailure(hr, "Failed read webDir path");
+
+    //Construct Location path
+    hr = StrAllocFormatted(&pwzLocationPath, L"%s/%s", IIS_CONFIG_APPHOST_ROOT, pwzSiteName);
+    ExitOnFailure(hr, "failed to format webDir location");
+    //
+    //Do not append trailing '/' for default vDir
+    //
+    if (CSTR_EQUAL != ::CompareStringW(LOCALE_INVARIANT, NORM_IGNORECASE, pwzPathName, -1, L"/", -1))
+    {
+        hr = StrAllocConcat(&pwzLocationPath, L"/", 0);
+        ExitOnFailure(hr, "failed to copy location WebDir '/'");
+        hr = StrAllocConcat(&pwzLocationPath, pwzPathName, 0);
+        ExitOnFailure(hr, "failed to copy location WebDir path");
+    }
+
+    //get asp section at config path location tag
+    hr = pAdminMgr->GetAdminSection( ScopeBSTR(IIS_CONFIG_ASP_SECTION), pwzLocationPath, &pSection);
+    ExitOnFailure(hr, "Failed get httpErrors section");
+
+    // Get  action
+    hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iAction);
+    ExitOnFailure(hr, "Failed to read property action");
+
+    while (IIS_ASP_END != iAction)
+    {
+        switch (iAction)
+        {
+            case IIS_ASP_SESSIONSTATE:
+            {
+                //system.webServer/asp /session | allowSessionState
+                hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+                ExitOnFailure(hr, "Failed to read asp session state");
+                hr = pSection->GetElementByName(ScopeBSTR(IIS_CONFIG_SESSION), &pElement);
+                ExitOnFailure(hr, "Failed to get asp session element");
+                hr = Iis7PutPropertyBool( pElement, IIS_CONFIG_ALLOWSTATE, iData);
+                ExitOnFailure(hr, "Failed to put asp session value");
+                ReleaseNullObject(pElement);
+                break;
+            }
+            case IIS_ASP_SESSIONTIMEOUT:
+            {
+                //system.webServer/asp /session | timeout
+                hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+                ExitOnFailure(hr, "Failed to read asp session timeout");
+                hr = pSection->GetElementByName(ScopeBSTR(IIS_CONFIG_SESSION), &pElement);
+                ExitOnFailure(hr, "Failed to get asp session timeout");
+                *wcTime = '\0';
+                ConvSecToHMS(iData * 60, wcTime, countof( wcTime));
+                hr = Iis7PutPropertyString( pElement, IIS_CONFIG_TIMEOUT, wcTime);
+                ExitOnFailure(hr, "Failed to put asp timeout value");
+                ReleaseNullObject(pElement);
+                break;
+            }
+            case IIS_ASP_BUFFER:
+            {
+                //system.webServer/asp | bufferingOn
+                hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+                ExitOnFailure(hr, "Failed to read asp bufferingOn");
+                hr = Iis7PutPropertyBool( pSection, IIS_CONFIG_BUFFERING, iData);
+                ExitOnFailure(hr, "Failed to put asp bufferingOn value");
+                break;
+            }
+            case IIS_ASP_PARENTPATHS:
+            {
+                //system.webServer/asp | enableParentPaths
+                hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+                ExitOnFailure(hr, "Failed to read asp ParentPaths");
+                hr = Iis7PutPropertyBool( pSection, IIS_CONFIG_PARENTPATHS, iData);
+                ExitOnFailure(hr, "Failed to put asp ParentPaths value");
+                break;
+            }
+            case IIS_ASP_SCRIPTLANG:
+            {
+                //system.webServer/asp | scriptLanguage
+                hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzData);
+                ExitOnFailure(hr, "Failed to read asp scriptLanguage");
+                hr = Iis7PutPropertyString( pSection, IIS_CONFIG_SCRIPTLANG, pwzData);
+                ExitOnFailure(hr, "Failed to put asp scriptLanguage value");
+                break;
+            }
+            case IIS_ASP_SCRIPTTIMEOUT:
+            {
+                //system.webServer/asp /limits | scriptTimeout
+                hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+                ExitOnFailure(hr, "Failed to read asp scriptTimeout");
+                hr = pSection->GetElementByName(ScopeBSTR(IIS_CONFIG_LIMITS), &pElement);
+                ExitOnFailure(hr, "Failed to get asp session element");
+                *wcTime = '\0';
+                ConvSecToHMS(iData, wcTime, countof( wcTime));
+                hr = Iis7PutPropertyString( pElement, IIS_CONFIG_SCRIPTTIMEOUT, wcTime);
+                ExitOnFailure(hr, "Failed to put asp scriptTimeout value");
+                ReleaseNullObject(pElement);
+                break;
+
+            }
+            case IIS_ASP_SCRIPTSERVERDEBUG:
+            {
+                //system.webServer/asp | appAllowDebugging
+                hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+                ExitOnFailure(hr, "Failed to read asp appAllowDebugging");
+                hr = Iis7PutPropertyBool( pSection, IIS_CONFIG_ALLOWDEBUG, iData);
+                ExitOnFailure(hr, "Failed to put asp appAllowDebugging value");
+                break;
+            }
+            case IIS_ASP_SCRIPTCLIENTDEBUG:
+            {
+                //system.webServer/asp | appAllowClientDebug
+                hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+                ExitOnFailure(hr, "Failed to read asp appAllowClientDebug");
+                hr = Iis7PutPropertyBool( pSection, IIS_CONFIG_ALLOWCLIENTDEBUG, iData);
+                ExitOnFailure(hr, "Failed to put asp appAllowClientDebug value");
+                break;
+            }
+            default:
+            {
+                ExitOnFailure(hr = E_UNEXPECTED, "Unexpected IIS Config action specified for asp properties");
+                break;
+            }
+        }
+        // Get next action
+        hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iAction);
+        ExitOnFailure(hr, "Failed to read asp prop action");
+    }
+
+LExit:
+    ReleaseStr(pwzData);
+    ReleaseStr(pwzSiteName);
+    ReleaseStr(pwzPathName);
+    ReleaseStr(pwzLocationPath);
+    ReleaseObject(pSection);
+    ReleaseObject(pElement);
+
+    return hr;
+}
+
+//-------------------------------------------------------------------------------------------------
+// IIS7WebDir
+// Called by WriteIIS7ConfigChanges
+// Processes WebDir
+//
+//-------------------------------------------------------------------------------------------------
+HRESULT IIS7WebDir(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    )
+{
+    HRESULT hr = S_OK;
+
+    int iAction = -1;
+
+    LPWSTR pwzSiteName = NULL;
+    LPWSTR pwzPathName = NULL;
+    LPWSTR pwzLocationPath = NULL;
+
+    // Get  action
+    hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iAction);
+    ExitOnFailure(hr, "Failed to read property action");
+
+    //read web site key
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzSiteName);
+    ExitOnFailure(hr, "Failed read webDir webkey");
+
+    //read path key
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzPathName);
+    ExitOnFailure(hr, "Failed read webDir path");
+
+    switch (iAction)
+    {
+        case IIS_CREATE:
+        {
+            //no action needed for create since WebDir has a
+            //WebDirProperties element that will create and populate
+            //location tag
+            break;
+        }
+        case IIS_DELETE:
+        {
+            //Construct Location path
+            hr = StrAllocString(&pwzLocationPath, pwzSiteName, 0);
+            ExitOnFailure(hr, "failed to copy location WebDir web name");
+            //
+            //Do not append trailing '/' for default vDir
+            //
+            if (CSTR_EQUAL != ::CompareStringW(LOCALE_INVARIANT, NORM_IGNORECASE, pwzPathName, -1, L"/", -1))
+            {
+                hr = StrAllocConcat(&pwzLocationPath, L"/", 0);
+                ExitOnFailure(hr, "failed to copy location WebDir '/'");
+                hr = StrAllocConcat(&pwzLocationPath, pwzPathName, 0);
+                ExitOnFailure(hr, "failed to copy location WebDir path");
+            }
+            // and delete location tag for this application
+            hr = ClearLocationTag(pAdminMgr, pwzLocationPath);
+            ExitOnFailure(hr, "failed to clear location tag for %ls", pwzLocationPath)
+            break;
+        }
+        default:
+        {
+            ExitOnFailure(hr = E_UNEXPECTED, "Unexpected IIS Config action specified for WebDir");
+            break;
+        }
+    }
+LExit:
+    ReleaseStr(pwzSiteName);
+    ReleaseStr(pwzPathName);
+    ReleaseStr(pwzLocationPath);
+
+    return hr;
+}
+
+//-------------------------------------------------------------------------------------------------
+// IIS7WebProperty
+// Called by WriteIIS7ConfigChanges
+// Processes isapiCgiRestriction
+//
+//-------------------------------------------------------------------------------------------------
+HRESULT IIS7WebProperty(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    )
+{
+    HRESULT hr = S_OK;
+
+    int iAction = -1;
+    int iData   =  0;
+
+    IAppHostElement *pSection = NULL;
+
+    // Get  action
+    hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iAction);
+    ExitOnFailure(hr, "Failed to read property action");
+
+    switch (iAction)
+    {
+        case IIS_PROPERTY_MAXBAND:
+        {
+            hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+            ExitOnFailure(hr, "Failed to read property max band");
+            //set value at system.applicationHost/webLimits | maxGlobalBandwidth
+            //Get IIS config section
+            hr = pAdminMgr->GetAdminSection(ScopeBSTR(IIS_CONFIG_WEBLIMITS_SECTION), ScopeBSTR(IIS_CONFIG_APPHOST_ROOT), &pSection);
+            ExitOnFailure(hr, "Failed get isapiCgiRestriction section");
+            if (!pSection)
+            {
+                hr = HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND);
+                ExitOnFailure(hr, "Failed get isapiCgiRestriction section object");
+            }
+            hr = Iis7PutPropertyInteger(pSection, IIS_CONFIG_WEBLIMITS_MAXBAND, iData);
+
+            break;
+        }
+        case IIS_PROPERTY_LOGUTF8:
+        {
+            hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+            ExitOnFailure(hr, "Failed to read property log");
+            //set value at system.applicationHost/log | logInUTF8
+            //Get IIS config section
+            hr = pAdminMgr->GetAdminSection(ScopeBSTR(IIS_CONFIG_LOG_SECTION), ScopeBSTR(IIS_CONFIG_APPHOST_ROOT), &pSection);
+            ExitOnFailure(hr, "Failed get isapiCgiRestriction section");
+            if (!pSection)
+            {
+                hr = HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND);
+                ExitOnFailure(hr, "Failed get isapiCgiRestriction section object");
+            }
+            hr = Iis7PutPropertyBool(pSection, IIS_CONFIG_LOG_UTF8, iData);
+
+            break;
+        }
+        default:
+        {
+            ExitOnFailure(hr = E_UNEXPECTED, "Unexpected IIS Config action specified for Web Property");
+            break;
+        }
+    }
+
+LExit:
+    ReleaseObject(pSection);
+
+    return hr;
+}
+
+//-------------------------------------------------------------------------------------------------
+// IIS7WebSvcExt
+// Called by WriteIIS7ConfigChanges
+// Processes isapiCgiRestriction
+//
+//-------------------------------------------------------------------------------------------------
+HRESULT IIS7WebSvcExt(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    )
+{
+    HRESULT hr = S_OK;
+
+    int iAction = -1;
+    int iData   =  0;
+    BOOL fFound = FALSE;
+    LPWSTR pwzData = NULL;
+    LPWSTR pwzPath = NULL;
+
+    IAppHostElement *pSection = NULL;
+    IAppHostElement *pElement = NULL;
+    IAppHostElementCollection *pCollection = NULL;
+
+    // Get  action
+    hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iAction);
+    ExitOnFailure(hr, "Failed to read WebSvcExt action");
+
+    //get path
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzPath);
+    ExitOnFailure(hr, "Failed to read WebSvcExt key");
+
+    //Get IIS config section
+    hr = pAdminMgr->GetAdminSection(ScopeBSTR(IIS_CONFIG_RESTRICTION_SECTION), ScopeBSTR(IIS_CONFIG_APPHOST_ROOT), &pSection);
+    ExitOnFailure(hr, "Failed get isapiCgiRestriction section");
+    if (!pSection)
+    {
+        hr = HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND);
+        ExitOnFailure(hr, "Failed get isapiCgiRestriction section object");
+    }
+    //get collection
+    hr = pSection->get_Collection(&pCollection);
+    ExitOnFailure(hr, "Failed get isapiCgiRestriction collection");
+
+    //find element
+    hr = Iis7FindAppHostElementPath(pCollection, IIS_CONFIG_ADD, IIS_CONFIG_PATH, pwzPath, &pElement, NULL);
+    ExitOnFailure(hr, "Failed get isapiCgiRestriction element");
+    fFound = (NULL != pElement);
+
+    switch (iAction)
+    {
+        case IIS_CREATE:
+        {
+            if (!fFound)
+            {
+                //create a restriction element
+                hr = pCollection->CreateNewElement(ScopeBSTR(IIS_CONFIG_ADD), &pElement);
+                ExitOnFailure(hr, "Failed create isapiCgiRestriction element");
+                //put path
+                hr = Iis7PutPropertyString(pElement, IIS_CONFIG_PATH, pwzPath);
+                ExitOnFailure(hr, "Failed set isapiCgiRestriction path property");
+            }
+            //update common properties
+
+            //update allowed
+            hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+            ExitOnFailure(hr, "Failed to read WebSvcExt allowed");
+            hr = Iis7PutPropertyBool(pElement, IIS_CONFIG_ALLOWED, iData);
+            ExitOnFailure(hr, "Failed set isapiCgiRestriction allowed property");
+
+            //update groupId
+            hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzData);
+            ExitOnFailure(hr, "Failed to read WebSvcExt group ID");
+            if (*pwzData)
+            {
+                hr = Iis7PutPropertyString(pElement, IIS_CONFIG_GROUPID, pwzData);
+                ExitOnFailure(hr, "Failed set isapiCgiRestriction groupId property");
+            }
+            //update description
+            hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzData);
+            ExitOnFailure(hr, "Failed to read WebSvcExt description");
+            if (*pwzData)
+            {
+                hr = Iis7PutPropertyString(pElement, IIS_CONFIG_DESC, pwzData);
+                ExitOnFailure(hr, "Failed set isapiCgiRestriction description property");
+            }
+            // add element if new
+            if (!fFound)
+            {
+                hr = pCollection->AddElement(pElement);
+                ExitOnFailure(hr, "Failed add isapiCgiRestriction element");
+            }
+
+            break;
+        }
+        case IIS_DELETE:
+        {
+            hr = DeleteCollectionElement(pCollection, IIS_CONFIG_ADD, IIS_CONFIG_PATH, pwzPath);
+            ExitOnFailure(hr, "Failed delete isapiCgiRestriction element");
+            break;
+        }
+        default:
+        {
+            ExitOnFailure(hr = E_UNEXPECTED, "Unexpected IIS Config action specified for WebSvcExt");
+            break;
+        }
+    }
+
+LExit:
+    ReleaseStr(pwzPath);
+    ReleaseStr(pwzData);
+    ReleaseObject(pSection);
+    ReleaseObject(pElement);
+    ReleaseObject(pCollection);
+
+    return hr;
+
+}
+
+//-------------------------------------------------------------------------------------------------
+// IIS7WebError
+// Called by WriteIIS7ConfigChanges
+// Processes http header CA Data
+//
+//-------------------------------------------------------------------------------------------------
+
+HRESULT IIS7WebError(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    )
+{
+    HRESULT hr = S_OK;
+    LPWSTR pwzConfigPath = NULL;
+    LPWSTR pwzSiteName = NULL;
+    LPWSTR pwzAppName = NULL;
+
+    IAppHostElement *pElement = NULL;
+    IAppHostElement *pSection = NULL;
+    IAppHostElementCollection *pCollection = NULL;
+
+    SCA_WEB_ERROR_SERVER *psweList = NULL;
+    SCA_WEB_ERROR_SERVER* pswe = NULL;
+    SCA_WEB_ERROR_SERVER we;
+    BOOL fFound = FALSE;
+
+    int iAction = -1;
+    LPWSTR pwzData = NULL;
+
+    //read web site key
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzSiteName);
+    ExitOnFailure(hr, "Failed read web error site name");
+
+    //read app key
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzAppName);
+    ExitOnFailure(hr, "Failed read web error app name");
+
+    //Construct config root path
+    hr = StrAllocFormatted(&pwzConfigPath, L"%s/%s", IIS_CONFIG_APPHOST_ROOT, pwzSiteName);
+    ExitOnFailure(hr, "failed to format web error config path");
+
+    if (CSTR_EQUAL != ::CompareStringW(LOCALE_INVARIANT, NORM_IGNORECASE, pwzAppName, -1, L"/", -1))
+    {
+        hr = StrAllocConcat(&pwzConfigPath, L"/", 0);
+        ExitOnFailure(hr, "failed to copy web error config path delim");
+        hr = StrAllocConcat(&pwzConfigPath, pwzAppName, 0);
+        ExitOnFailure(hr, "failed to app name to web error config path");
+    }
+
+    //get httpErrors section at config path location tag
+    hr = pAdminMgr->GetAdminSection(ScopeBSTR(IIS_CONFIG_HTTPERRORS_SECTION), pwzConfigPath, &pSection);
+    ExitOnFailure(hr, "Failed get httpErrors section");
+
+    //get existing httpErrors list & clear collection
+    hr = PopulateHttpErrors(pSection, &psweList);
+    ExitOnFailure(hr, "Failed to read httpErrors list");
+
+    //get collection
+    hr = pSection->get_Collection(&pCollection);
+    ExitOnFailure(hr, "Failed get httpErrors collection");
+
+    DWORD cErrors = 0;
+    hr = pCollection->get_Count(&cErrors);
+
+   // Get web error action
+    hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iAction);
+    ExitOnFailure(hr, "Failed to read filter action");
+    while (IIS_WEBERROR_END != iAction)
+    {
+        //Process property action
+        if (IIS_WEBERROR == iAction)
+        {
+            hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &(we.iErrorCode));
+            ExitOnFailure(hr, "failed to get httpErrors ErrorCode");
+
+            hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &(we.iSubCode));
+            ExitOnFailure(hr, "failed to get httpErrors SubCode");
+            //0 is the sub error code wild card for IIS6, change to -1 for IIS7
+            if (we.iSubCode == 0)
+            {
+                we.iSubCode = -1;
+            }
+            hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzData);
+            ExitOnFailure(hr, "Failed to get httpErrors File");
+            hr = ::StringCchCopyW(we.wzFile, countof(we.wzFile), pwzData);
+            ExitOnFailure(hr, "Failed to copy httpErrors File");
+
+            hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &(we.iResponseMode));
+            ExitOnFailure(hr, "Failed to get httpErrors File code");
+
+            fFound = FALSE;
+            hr = GetErrorFromList( we, &psweList, &pswe, &fFound);
+            if (!fFound)
+            {
+                hr = AddWebErrorToList(&psweList);
+                ExitOnFailure(hr, "failed to add web error to list");
+                pswe = psweList;
+            }
+            else
+            {
+                //if overwriting existing http errors element then clear lang path
+                hr = ::StringCchCopyW(pswe->wzLangPath, countof(pswe->wzLangPath), L"");
+                ExitOnFailure(hr, "Failed to copy httpErrors lang path value");
+            }
+            pswe->iErrorCode = we.iErrorCode;
+            pswe->iSubCode   = we.iSubCode;
+            hr = ::StringCchCopyW(pswe->wzFile, countof(pswe->wzFile), we.wzFile);
+            ExitOnFailure(hr, "Failed to copy httpErrors File value");
+            pswe->iResponseMode = we.iResponseMode;
+
+        }
+        else
+        {
+            ExitOnFailure(hr = E_UNEXPECTED, "Unexpected IIS Config action specified for http header");
+        }
+
+        // Get AppExt action
+        hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iAction);
+        ExitOnFailure(hr, "Failed to read filter action");
+    }
+
+    //No inheritance - put a clear in at this loc tag
+    hr = pCollection->CreateNewElement(ScopeBSTR(IIS_CONFIG_CLEAR), &pElement);
+    ExitOnFailure(hr, "Failed create httpErrors clear");
+    hr = pCollection->AddElement(pElement);
+    ExitOnFailure(hr, "Failed add httpErrors clear");
+
+    //now we have merged new, from MSI, http errors with global list
+    //write this back out at location tag.
+    // Loop through the HTTP headers
+    for ( pswe = psweList; pswe; pswe = pswe->psweNext)
+    {
+        hr = pCollection->CreateNewElement(ScopeBSTR(IIS_CONFIG_ERROR), &pElement);
+        ExitOnFailure(hr, "Failed create httpErrors element");
+
+        // status code
+        hr = Iis7PutPropertyInteger(pElement, IIS_CONFIG_STATUSCODE, pswe->iErrorCode);
+        ExitOnFailure(hr, "Failed set httpErrors code value");
+
+        //sub status
+        hr = Iis7PutPropertyInteger(pElement, IIS_CONFIG_SUBSTATUS, pswe->iSubCode);
+        ExitOnFailure(hr, "Failed set httpErrors sub code value");
+
+        //lang path
+        hr = Iis7PutPropertyString(pElement, IIS_CONFIG_LANGPATH, pswe->wzLangPath);
+        ExitOnFailure(hr, "Failed set httpErrors lang path value");
+
+        //path
+        hr = Iis7PutPropertyString(pElement, IIS_CONFIG_PATH, pswe->wzFile);
+        ExitOnFailure(hr, "Failed set httpErrors path value");
+
+        //response mode
+        hr = Iis7PutPropertyInteger(pElement, IIS_CONFIG_RESPMODE, pswe->iResponseMode);
+        ExitOnFailure(hr, "Failed set httpErrors resp mode value");
+
+        //add the element
+        hr = pCollection->AddElement(pElement);
+        ExitOnFailure(hr, "Failed add httpErrors element");
+        ReleaseNullObject(pElement);
+    }
+
+LExit:
+    ScaWebErrorFreeList7(psweList);
+
+    ReleaseStr(pwzConfigPath);
+    ReleaseStr(pwzSiteName);
+    ReleaseStr(pwzAppName);
+    ReleaseStr(pwzData);
+    ReleaseObject(pElement);
+    ReleaseObject(pSection);
+    ReleaseObject(pCollection);
+
+    return hr;
+}
+
+static HRESULT PopulateHttpErrors(IAppHostElement *pSection, SCA_WEB_ERROR_SERVER **ppsweList)
+{
+    HRESULT hr = S_OK;
+
+    IAppHostElement *pElement = NULL;
+    IAppHostElementCollection *pCollection = NULL;
+    IAppHostProperty *pProperty = NULL;
+
+    DWORD cErrors = 0;
+    SCA_WEB_ERROR_SERVER *pswe = NULL;
+
+    VARIANT vPropValue;
+    VARIANT vtIndex;
+
+    VariantInit(&vPropValue);
+    VariantInit(&vtIndex);
+
+    hr = pSection->get_Collection(&pCollection);
+    ExitOnFailure(hr, "Failed get httpErrors collection");
+
+    hr = pCollection->get_Count(&cErrors);
+    ExitOnFailure(hr, "Failed get sites collection count");
+
+    vtIndex.vt = VT_UI4;
+    for (DWORD i = 0; i < cErrors; ++i)
+    {
+        vtIndex.ulVal = i;
+        hr = pCollection->get_Item(vtIndex , &pElement);
+        ExitOnFailure(hr, "Failed get httpErrors collection item");
+
+        hr = AddWebErrorToList(ppsweList);
+        ExitOnFailure(hr, "Failed add web error list item");
+        pswe = *ppsweList;
+
+        //get all properties
+        //
+        // statusCode UINT
+        // subStatusCode INT
+        // prefixLanguageFilePath type="string"
+        // path type="string"
+        // responseMode type="enum" defaultValue="File">
+        //  <enum name="File" value="0" />
+        //  <enum name="ExecuteURL" value="1" />
+        //  <enum name="Redirect" value="2" />
+
+        // status code
+        hr = pElement->GetPropertyByName(ScopeBSTR(IIS_CONFIG_STATUSCODE), &pProperty);
+        ExitOnFailure(hr, "Failed get httpErrors code property");
+        hr = pProperty->get_Value(&vPropValue);
+        ExitOnFailure(hr, "Failed get httpErrors code value");
+        pswe->iErrorCode = vPropValue.uintVal;
+        ReleaseVariant(vPropValue);
+
+        //sub status
+        hr = pElement->GetPropertyByName(ScopeBSTR(IIS_CONFIG_SUBSTATUS), &pProperty);
+        ExitOnFailure(hr, "Failed get httpErrors sub code property");
+        hr = pProperty->get_Value(&vPropValue);
+        ExitOnFailure(hr, "Failed get httpErrors sub code value");
+        pswe->iSubCode = vPropValue.intVal;
+        ReleaseVariant(vPropValue);
+
+        //lang path
+        hr = pElement->GetPropertyByName(ScopeBSTR(IIS_CONFIG_LANGPATH), &pProperty);
+        ExitOnFailure(hr, "Failed get httpErrors lang path property");
+        hr = pProperty->get_Value(&vPropValue);
+        ExitOnFailure(hr, "Failed get httpErrors lang path value");
+        hr = ::StringCchCopyW(pswe->wzLangPath, countof(pswe->wzLangPath), vPropValue.bstrVal);
+        ExitOnFailure(hr, "Failed to copy httpErrors lang path");
+        ReleaseVariant(vPropValue);
+
+        //path
+        hr = pElement->GetPropertyByName(ScopeBSTR(IIS_CONFIG_PATH), &pProperty);
+        ExitOnFailure(hr, "Failed get httpErrors path property");
+        hr = pProperty->get_Value(&vPropValue);
+        ExitOnFailure(hr, "Failed get httpErrors path value");
+        hr = ::StringCchCopyW(pswe->wzFile, countof(pswe->wzFile), vPropValue.bstrVal);
+        ExitOnFailure(hr, "Failed to copy httpErrors File");
+        ReleaseVariant(vPropValue);
+
+        //response mode
+        hr = pElement->GetPropertyByName(ScopeBSTR(IIS_CONFIG_RESPMODE), &pProperty);
+        ExitOnFailure(hr, "Failed get httpErrors resp mode property");
+        hr = pProperty->get_Value(&vPropValue);
+        ExitOnFailure(hr, "Failed get httpErrors resp mode value");
+        pswe->iResponseMode = vPropValue.intVal;
+        ReleaseVariant(vPropValue);
+
+        ReleaseNullObject(pElement);
+        ReleaseNullObject(pProperty);
+    }
+
+    //remove the elements from connection so we can add back later
+    hr = pCollection->Clear();
+    ExitOnFailure(hr, "Failed clear httpErrors collection");
+
+LExit:
+    ReleaseVariant(vPropValue);
+    ReleaseObject(pProperty);
+    ReleaseObject(pElement);
+    ReleaseObject(pCollection);
+
+    return hr;
+}
+
+static void ScaWebErrorFreeList7(SCA_WEB_ERROR_SERVER *psweList)
+{
+    SCA_WEB_ERROR_SERVER *psweDelete = psweList;
+    while (psweList)
+    {
+        psweDelete = psweList;
+        psweList = psweList->psweNext;
+
+        MemFree(psweDelete);
+    }
+}
+static HRESULT AddWebErrorToList(SCA_WEB_ERROR_SERVER **ppsweList)
+{
+    HRESULT hr = S_OK;
+
+    SCA_WEB_ERROR_SERVER* pswe = static_cast<SCA_WEB_ERROR_SERVER*>(MemAlloc(sizeof(SCA_WEB_ERROR_SERVER), TRUE));
+
+    ExitOnNull(pswe, hr, E_OUTOFMEMORY, "failed to allocate memory for new web error list element");
+
+    pswe->psweNext = *ppsweList;
+    *ppsweList = pswe;
+
+LExit:
+    return hr;
+}
+static HRESULT GetErrorFromList( const SCA_WEB_ERROR_SERVER& we,
+                                    SCA_WEB_ERROR_SERVER **ppsweList,
+                                    SCA_WEB_ERROR_SERVER **ppswe,
+                                    BOOL *fFound)
+{
+    HRESULT hr = S_OK;
+
+    *fFound = FALSE;
+
+    SCA_WEB_ERROR_SERVER *pswe;
+
+    for ( pswe = *ppsweList; pswe; pswe = pswe->psweNext)
+    {
+        if ((pswe->iErrorCode == we.iErrorCode) && (pswe->iSubCode == we.iSubCode))
+        {
+            *fFound = TRUE;
+            *ppswe = pswe;
+            break;
+        }
+    }
+
+    return hr;
+}
+
+//-------------------------------------------------------------------------------------------------
+// IIS7HttpHeader
+// Called by WriteIIS7ConfigChanges
+// Processes http header CA Data
+//
+//-------------------------------------------------------------------------------------------------
+
+HRESULT IIS7HttpHeader(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    )
+{
+    HRESULT hr = S_OK;
+    LPWSTR pwzConfigPath = NULL;
+    LPWSTR pwzSiteName = NULL;
+    LPWSTR pwzAppName = NULL;
+
+    LPWSTR pwzHeaderName = NULL;
+    LPWSTR pwzHeaderValue = NULL;
+
+    IAppHostElement *pElement = NULL;
+    IAppHostElement *pSection = NULL;
+    IAppHostElementCollection *pCollection = NULL;
+    IAppHostElement *pElementHeaders = NULL;
+
+    int iAction = -1;
+    BOOL fFound = FALSE;
+
+    //read web site key
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzSiteName);
+    ExitOnFailure(hr, "Failed read header web site name");
+
+    //read app key
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzAppName);
+    ExitOnFailure(hr, "Failed read header appkey");
+
+    //Construct config root path
+    hr = StrAllocFormatted(&pwzConfigPath, L"%s/%s", IIS_CONFIG_APPHOST_ROOT, pwzSiteName);
+    ExitOnFailure(hr, "failed to format web error config path");
+
+    if (CSTR_EQUAL != ::CompareStringW(LOCALE_INVARIANT, NORM_IGNORECASE, pwzAppName, -1, L"/", -1))
+    {
+        hr = StrAllocConcat(&pwzConfigPath, L"/", 0);
+        ExitOnFailure(hr, "failed to copy web error config path delim");
+        hr = StrAllocConcat(&pwzConfigPath, pwzAppName, 0);
+        ExitOnFailure(hr, "failed to app name to web error config path");
+    }
+
+    //get admin handlers section at config path location tag
+    hr = pAdminMgr->GetAdminSection(ScopeBSTR(IIS_CONFIG_HTTPPROTO_SECTION), pwzConfigPath, &pSection);
+    ExitOnFailure(hr, "Failed get http protocol section");
+
+    hr = pSection->GetElementByName(ScopeBSTR(IIS_CONFIG_HEADERS), &pElementHeaders);
+    ExitOnFailure(hr, "Failed get http customHeaders section");
+
+    hr = pElementHeaders->get_Collection(&pCollection);
+    ExitOnFailure(hr, "Failed get http customHeaders collection");
+
+   // Get filter action
+    hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iAction);
+    ExitOnFailure(hr, "Failed to read filter action");
+    while (IIS_HTTP_HEADER_END != iAction)
+    {
+        //Process property action
+        if (IIS_HTTP_HEADER == iAction)
+        {
+            hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzHeaderName);
+            ExitOnFailure(hr, "Fail to read httpHeader name");
+
+            hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzHeaderValue);
+            ExitOnFailure(hr, "Fail to read httpHeader value");
+
+            hr = Iis7FindAppHostElementString(pCollection, IIS_CONFIG_ADD, IIS_CONFIG_NAME, pwzHeaderName, &pElement, NULL);
+            ExitOnFailure(hr, "Failed get isapiCgiRestriction element");
+            fFound = (NULL != pElement);
+
+            if (!fFound)
+            {
+                //make a new element
+                hr = pCollection->CreateNewElement(ScopeBSTR(IIS_CONFIG_ADD), &pElement);
+                ExitOnFailure(hr, "Failed to create filter config element");
+
+                hr = Iis7PutPropertyString(pElement, IIS_CONFIG_NAME, pwzHeaderName);
+                ExitOnFailure(hr, "Failed to set header name");
+            }
+
+            hr = Iis7PutPropertyString(pElement, IIS_CONFIG_VALUE, pwzHeaderValue);
+            ExitOnFailure(hr, "Failed to set header Value");
+
+            if (!fFound)
+            {
+                hr = pCollection->AddElement(pElement);
+                ExitOnFailure(hr, "Failed add http header");
+            }
+
+        }
+        else
+        {
+            ExitOnFailure(hr = E_UNEXPECTED, "Unexpected IIS Config action specified for http header");
+        }
+
+        // Get AppExt action
+        hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iAction);
+        ExitOnFailure(hr, "Failed to read filter action");
+    }
+
+LExit:
+    ReleaseStr(pwzConfigPath);
+    ReleaseStr(pwzSiteName);
+    ReleaseStr(pwzAppName);
+    ReleaseStr(pwzHeaderName);
+    ReleaseStr(pwzHeaderValue);
+    ReleaseObject(pElementHeaders);
+    ReleaseObject(pElement);
+    ReleaseObject(pSection);
+    ReleaseObject(pCollection);
+
+    return hr;
+}
+
+//-------------------------------------------------------------------------------------------------
+// IIS7FilterGlobal
+// Called by WriteIIS7ConfigChanges
+// Processes Filter CA Data
+//
+//-------------------------------------------------------------------------------------------------
+HRESULT IIS7FilterGlobal(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    )
+{
+    HRESULT hr = S_OK;
+    int iAction = 0;
+
+    IAppHostElement *pSection = NULL;
+
+    hr = pAdminMgr->GetAdminSection(ScopeBSTR(IIS_CONFIG_ISAPI_SECTION), ScopeBSTR(IIS_CONFIG_APPHOST_ROOT), &pSection);
+    ExitOnFailure(hr, "Failed get sites section");
+
+    if (!pSection)
+    {
+        hr = HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND);
+        ExitOnFailure(hr, "Failed get isapiFilters section object");
+    }
+
+   // Get filter action
+    hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iAction);
+    ExitOnFailure(hr, "Failed to read filter action");
+
+    while (IIS_FILTER_END != iAction)
+    {
+        //Process property action
+        switch (iAction)
+        {
+            case IIS_FILTER :
+            {
+                hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iAction);
+                ExitOnFailure(hr, "Failed to read filter action");
+
+                if (iAction == IIS_CREATE)
+                {
+                    hr = CreateGlobalFilter(ppwzCustomActionData, pSection);
+                }
+                else
+                {
+                    hr = DeleteGlobalFilter(ppwzCustomActionData, pSection);
+                }
+                break;
+            }
+            default:
+            {
+                ExitOnFailure(hr = E_UNEXPECTED, "Unexpected IIS Config action specified for global filter");
+                break;
+            }
+        }
+        // Get AppExt action
+        hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iAction);
+        ExitOnFailure(hr, "Failed to read filter action");
+
+    }
+
+LExit:
+    ReleaseObject(pSection);
+
+    return hr;
+}
+
+static HRESULT CreateGlobalFilter( __inout LPWSTR *ppwzCustomActionData, IAppHostElement *pSection)
+{
+    HRESULT hr = S_OK;
+
+    LPWSTR pwzFilterName = NULL;
+    LPWSTR pwzSiteName = NULL;
+    LPWSTR pwzFilterPath = NULL;
+    int iLoadOrder = 0;
+    DWORD cFilters = 0;
+
+    IAppHostElement *pElement = NULL;
+    IAppHostElementCollection *pCollection = NULL;
+
+    hr = pSection->get_Collection(&pCollection);
+    ExitOnFailure(hr, "Failed get filter collection");
+
+    hr = pCollection->get_Count(&cFilters);
+    ExitOnFailure(hr, "Failed get filter collection count");
+
+    // Attempt to delete, we will we recreate with desired property values and order
+    hr = DeleteCollectionElement(pCollection, IIS_CONFIG_FILTER, IIS_CONFIG_NAME, pwzFilterName);
+    ExitOnFailure(hr, "Failed to delete filter");
+
+    //make a new element
+    hr = pCollection->CreateNewElement(ScopeBSTR(IIS_CONFIG_FILTER), &pElement);
+    ExitOnFailure(hr, "Failed to create filter config element");
+
+    //filter Name key
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzFilterName);
+    ExitOnFailure(hr, "Failed to read filter name");
+    hr = Iis7PutPropertyString(pElement, IIS_CONFIG_NAME, pwzFilterName);
+    ExitOnFailure(hr, "Failed to set filter name");
+
+    //web site name
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzSiteName);
+    ExitOnFailure(hr, "Failed to read filter site name");
+
+    // filter path
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzFilterPath);
+    ExitOnFailure(hr, "Failed to read filter path");
+    hr = Iis7PutPropertyString(pElement,IIS_CONFIG_PATH, pwzFilterPath);
+    ExitOnFailure(hr, "Failed to set filter path");
+
+    //filter load order
+    hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iLoadOrder);
+    ExitOnFailure(hr, "Failed to read filter load order");
+
+    //  put element in order in list
+    int iPosition = -1;
+    int icFilters = cFilters;
+    switch (iLoadOrder)
+    {
+        case 0 :
+        {
+            iPosition = -1;
+            break;
+        }
+        case -1 :
+        {
+            iPosition = icFilters;
+            break;
+        }
+        case MSI_NULL_INTEGER :
+        {
+             iPosition = icFilters;
+             break;
+        }
+        default:
+        {
+            if (iLoadOrder > icFilters)
+            {
+                iPosition = icFilters;
+            }
+            else
+            {
+                iPosition = iLoadOrder;
+            }
+            break;
+        }
+    }
+    hr = pCollection->AddElement(pElement, iPosition);
+    ExitOnFailure(hr, "Failed to add filter element");
+
+LExit:
+    ReleaseStr(pwzFilterName);
+    ReleaseStr(pwzSiteName);
+    ReleaseStr(pwzFilterPath);
+    ReleaseObject(pCollection);
+    ReleaseObject(pElement);
+
+    return hr;
+}
+
+static HRESULT DeleteGlobalFilter( __inout LPWSTR *ppwzCustomActionData, IAppHostElement *pSection)
+{
+    HRESULT hr = S_OK;
+
+    LPWSTR pwzFilterName = NULL;
+    LPWSTR pwzSiteName = NULL;
+
+    IAppHostElementCollection *pCollection = NULL;
+
+    hr = pSection->get_Collection(&pCollection);
+    ExitOnFailure(hr, "Failed get filter collection");
+
+    //filter Name key
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzFilterName);
+    ExitOnFailure(hr, "Failed to read filter name");
+
+    //web site name
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzSiteName); // TODO: unused?
+    ExitOnFailure(hr, "Failed to read filter site name");
+
+    DeleteCollectionElement(pCollection, IIS_CONFIG_FILTER, IIS_CONFIG_NAME, pwzFilterName);
+    ExitOnFailure(hr, "Failed to delete filter %ls", pwzFilterName);
+
+LExit:
+    ReleaseStr(pwzFilterName);
+    ReleaseStr(pwzSiteName);
+    ReleaseObject(pCollection);
+
+    return hr;
+}
+
+//-------------------------------------------------------------------------------------------------
+// IIS7FilterSite
+// Called by WriteIIS7ConfigChanges
+// Processes Filter CA Data
+//
+//-------------------------------------------------------------------------------------------------
+HRESULT IIS7FilterSite(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    )
+{
+    HRESULT hr = S_OK;
+    int iAction = 0;
+
+   // Get filter action
+    hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iAction);
+    ExitOnFailure(hr, "Failed to read filter action");
+
+    while (IIS_FILTER_END != iAction)
+    {
+        //Process property action
+        switch (iAction)
+        {
+            case IIS_FILTER :
+            {
+                hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iAction);
+                ExitOnFailure(hr, "Failed to read filter action");
+
+                if (iAction == IIS_CREATE)
+                {
+                    hr = CreateSiteFilter(ppwzCustomActionData, pAdminMgr);
+                }
+                else
+                {
+                    hr = DeleteSiteFilter(ppwzCustomActionData, pAdminMgr);
+                }
+                break;
+            }
+            default:
+            {
+                ExitOnFailure(hr = E_UNEXPECTED, "Unexpected IIS Config action specified for global filter");
+                break;
+            }
+        }
+
+        // Get AppExt action
+        hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iAction);
+        ExitOnFailure(hr, "Failed to read filter action");
+    }
+
+LExit:
+    return hr;
+
+}
+
+static HRESULT CreateSiteFilter(__inout LPWSTR *ppwzCustomActionData, IAppHostWritableAdminManager *pAdminMgr)
+{
+    HRESULT hr = S_OK;
+    LPWSTR pwzFilterName = NULL;
+    LPWSTR pwzSiteName = NULL;
+    LPWSTR pwzFilterPath = NULL;
+    LPWSTR pwzConfigPath = NULL;
+    int iLoadOrder = 0;
+    DWORD cFilters;
+
+    IAppHostElement *pElement = NULL;
+    IAppHostElement *pSection = NULL;
+    IAppHostElementCollection *pCollection = NULL;
+
+    //filter Name key
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzFilterName);
+    ExitOnFailure(hr, "Failed to read filter name");
+
+    //web site name
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzSiteName);
+    ExitOnFailure(hr, "Failed to read filter site name");
+
+     //Construct config root
+    hr = StrAllocFormatted(&pwzConfigPath, L"%s/%s", IIS_CONFIG_APPHOST_ROOT, pwzSiteName);
+    ExitOnFailure(hr, "failed to format filter config path");
+
+    //get admin isapiFilters section at config path location tag
+    hr = pAdminMgr->GetAdminSection(ScopeBSTR(IIS_CONFIG_ISAPI_SECTION), pwzConfigPath, &pSection);
+    ExitOnFailure(hr, "Failed get isapiFilters section");
+
+    hr = pSection->get_Collection(&pCollection);
+    ExitOnFailure(hr, "Failed get filter collection");
+
+    hr = pCollection->get_Count(&cFilters);
+    ExitOnFailure(hr, "Failed get filter collection count");
+
+    // Attempt to delete, we will we recreate with desired property values and order
+    hr = DeleteCollectionElement(pCollection, IIS_CONFIG_FILTER, IIS_CONFIG_NAME, pwzFilterName);
+    ExitOnFailure(hr, "Failed to delete filter");
+
+     //make a new element
+    hr = pCollection->CreateNewElement(ScopeBSTR(IIS_CONFIG_FILTER), &pElement);
+    ExitOnFailure(hr, "Failed to create filter config element");
+
+    hr = Iis7PutPropertyString(pElement,IIS_CONFIG_NAME, pwzFilterName);
+    ExitOnFailure(hr, "Failed to set filter name");
+
+    // filter path
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzFilterPath);
+    ExitOnFailure(hr, "Failed to read filter path");
+
+    hr = Iis7PutPropertyString(pElement, IIS_CONFIG_PATH, pwzFilterPath);
+    ExitOnFailure(hr, "Failed to set filter path");
+
+    //filter load order
+    hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iLoadOrder);
+    ExitOnFailure(hr, "Failed to read filter load order");
+
+    //  put element in order in list
+    int iPosition = -1;
+    int icFilters = cFilters;
+    switch (iLoadOrder)
+    {
+        case 0 :
+        {
+            iPosition = -1;
+            break;
+        }
+        case -1 :
+        {
+            iPosition = icFilters;
+            break;
+        }
+        case MSI_NULL_INTEGER :
+        {
+            iPosition = icFilters;
+            break;
+        }
+        default:
+        {
+            if (iLoadOrder > icFilters)
+            {
+                iPosition = icFilters;
+            }
+            else
+            {
+                iPosition = iLoadOrder;
+            }
+            break;
+        }
+    }
+
+    hr = pCollection->AddElement(pElement, iPosition);
+    ExitOnFailure(hr, "Failed to add filter element");
+
+LExit:
+    ReleaseStr(pwzFilterName);
+    ReleaseStr(pwzSiteName);
+    ReleaseStr(pwzFilterPath);
+    ReleaseStr(pwzConfigPath);
+    ReleaseObject(pElement);
+    ReleaseObject(pSection);
+    ReleaseObject(pCollection);
+
+    return hr;
+}
+
+static HRESULT DeleteSiteFilter(__inout LPWSTR *ppwzCustomActionData, IAppHostWritableAdminManager *pAdminMgr)
+{
+    HRESULT hr = S_OK;
+    LPWSTR pwzFilterName = NULL;
+    LPWSTR pwzSiteName = NULL;
+    LPWSTR pwzConfigPath = NULL;
+
+    IAppHostElement *pSection = NULL;
+    IAppHostElementCollection *pCollection = NULL;
+
+    //filter Name key
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzFilterName);
+    ExitOnFailure(hr, "Failed to read filter name");
+
+    //web site name
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzSiteName);
+    ExitOnFailure(hr, "Failed to read filter site name");
+
+     //Construct config root
+    hr = StrAllocFormatted(&pwzConfigPath, L"%s/%s", IIS_CONFIG_APPHOST_ROOT, pwzSiteName);
+    ExitOnFailure(hr, "failed to format filter config path");
+
+    //get admin isapiFilters section at config path location tag
+    hr = pAdminMgr->GetAdminSection(ScopeBSTR(IIS_CONFIG_ISAPI_SECTION), pwzConfigPath, &pSection);
+    ExitOnFailure(hr, "Failed get isapiFilters section");
+
+    hr = pSection->get_Collection(&pCollection);
+    ExitOnFailure(hr, "Failed get filter collection");
+
+    DeleteCollectionElement(pCollection, IIS_CONFIG_FILTER, IIS_CONFIG_NAME, pwzFilterName);
+    ExitOnFailure(hr, "Failed to delete filter %ls", pwzFilterName);
+
+LExit:
+    ReleaseStr(pwzFilterName);
+    ReleaseStr(pwzSiteName);
+    ReleaseStr(pwzConfigPath);
+    ReleaseObject(pSection);
+    ReleaseObject(pCollection);
+
+    return hr;
+}
+
+//-------------------------------------------------------------------------------------------------
+// IIS7Site
+// Called by WriteIIS7ConfigChanges
+// Processes WebSite CA Data
+//
+//-------------------------------------------------------------------------------------------------
+HRESULT IIS7Site(
+    __inout LPWSTR *ppwzCustomActionData,
+    __in    IAppHostWritableAdminManager *pAdminMgr)
+{
+    HRESULT hr  = S_OK;
+    int iAction = -1;
+    int iData   =  0;
+    BOOL fFound = FALSE;
+
+    LPWSTR pwzSiteName = NULL;
+    IAppHostElement *pSites = NULL;
+    IAppHostElementCollection *pCollection = NULL;
+    IAppHostElement *pSiteElem = NULL;
+    IAppHostElement *pElement = NULL;
+
+    // Get site action
+    hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iAction);
+    ExitOnFailure(hr, "Failed to read site action");
+
+    //get site name
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzSiteName);
+    ExitOnFailure(hr, "Failed to read site key");
+
+    //Get site if it exists
+    hr = GetSiteElement(pAdminMgr, pwzSiteName, &pSiteElem, &fFound);
+    ExitOnFailure(hr, "Failed to read sites from config");
+
+    hr = pAdminMgr->GetAdminSection(ScopeBSTR(IIS_CONFIG_SITES_SECTION), ScopeBSTR(IIS_CONFIG_APPHOST_ROOT), &pSites);
+    ExitOnFailure(hr, "Failed get sites section");
+    ExitOnNull(pSites, hr, ERROR_FILE_NOT_FOUND, "Failed get sites section object");
+
+    hr = pSites->get_Collection( &pCollection);
+    ExitOnFailure(hr, "Failed get site collection");
+    switch (iAction)
+    {
+        case IIS_DELETE :
+        {
+            if (fFound)
+            {
+                hr = DeleteCollectionElement(pCollection, IIS_CONFIG_SITE, IIS_CONFIG_NAME, pwzSiteName);
+                ExitOnFailure(hr, "Failed to delete website");
+            }
+            ExitFunction();
+            break;
+        }
+        case IIS_CREATE :
+        {
+            if (!fFound)
+            {
+                //Create the site
+                hr = CreateSite(pCollection, pwzSiteName, &pSiteElem);
+                ExitOnFailure(hr, "Failed to create site");
+
+            }
+        }
+    }
+    //
+    //Set other Site properties
+    //
+    //set site Id
+    hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+    ExitOnFailure(hr, "Failed to read site Id");
+    if (iData != MSI_NULL_INTEGER && -1 != iData)
+    {
+        hr = Iis7PutPropertyInteger(pSiteElem, IIS_CONFIG_SITE_ID, iData);
+        ExitOnFailure(hr, "Failed set site Id data");
+    }
+    //Set Site AutoStart
+    hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+    ExitOnFailure(hr, "Failed to read site autostart");
+    if (MSI_NULL_INTEGER != iData)
+    {
+        hr = Iis7PutPropertyBool(pSiteElem, IIS_CONFIG_AUTOSTART, iData);
+        ExitOnFailure(hr, "Failed set site config data");
+    }
+
+    //Set Site Connection timeout
+    hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+    ExitOnFailure(hr, "Failed to read site connection tomeout data");
+    if (MSI_NULL_INTEGER != iData)
+    {
+        // get limits element, get connectionTimeout property
+        hr = pSiteElem->GetElementByName(ScopeBSTR(IIS_CONFIG_LIMITS), &pElement);
+        ExitOnFailure(hr, "Failed to read limits from config");
+        //convert iData in seconds to timeSpan hh:mm:ss
+        WCHAR wcTime[60];
+        *wcTime = '\0';
+        ConvSecToHMS( iData, wcTime, countof( wcTime));
+
+        hr = Iis7PutPropertyString(pElement, IIS_CONFIG_CONNECTTIMEOUT, wcTime);
+        ExitOnFailure(hr, "IIS: failed set connection timeout config data");
+   }
+
+LExit:
+    ReleaseStr(pwzSiteName);
+    ReleaseObject(pSites);
+    ReleaseObject(pCollection);
+    ReleaseObject(pSiteElem);
+    ReleaseObject(pElement);
+
+    return hr;
+}
+//-------------------------------------------------------------------------------------------------
+// IIS7Application
+//  Processes Application CA Data
+//
+//
+//-------------------------------------------------------------------------------------------------
+
+HRESULT IIS7Application(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr)
+{
+    HRESULT hr = S_OK;
+
+    int iAction = -1;
+    BOOL fSiteFound = FALSE;
+    BOOL fAppFound = FALSE;
+
+    LPWSTR pwzSiteName = NULL;
+    LPWSTR pwzAppPath = NULL;
+    LPWSTR pwzAppPool = NULL;
+    LPWSTR pwzLocationPath = NULL;
+    IAppHostElement *pSiteElem = NULL;
+    IAppHostElement *pAppElement = NULL;
+    // Get Application action
+    hr = WcaReadIntegerFromCaData( ppwzCustomActionData, &iAction);
+    ExitOnFailure(hr, "Failed to read application action")
+    //get site key name
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzSiteName);
+    ExitOnFailure(hr, "Failed to read app site key");
+    //get application path
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzAppPath);
+    ExitOnFailure(hr, "Failed to read app path key");
+    //get application Pool
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzAppPool);
+    ExitOnFailure(hr, "Failed to read app pool key");
+
+    //Get site if it exists
+    hr = GetSiteElement(pAdminMgr, pwzSiteName, &pSiteElem, &fSiteFound);
+    ExitOnFailure(hr, "Failed to read sites from config");
+
+    switch (iAction)
+    {
+        case IIS_CREATE :
+        {
+            if (fSiteFound)
+            {
+                //have site get application collection
+                hr = GetApplicationElement(pSiteElem,
+                                            pwzAppPath,
+                                            &pAppElement,
+                                            &fAppFound);
+                ExitOnFailure(hr, "Error reading application from config");
+
+                if (!fAppFound)
+                {
+                    //Create Application
+                    hr = CreateApplication(pSiteElem, pwzAppPath, &pAppElement);
+                    ExitOnFailure(hr, "Error creating application in config");
+                }
+                //Update application properties:
+                //
+                //Set appPool
+                hr = SetAppPool(pAppElement, pwzAppPool);
+                ExitOnFailure(hr, "Unable to set appPool for application");
+            }
+            else
+            {
+                hr = HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND);
+                ExitOnFailure(hr, "Site not found for create application");
+            }
+            break;
+        }
+        case IIS_DELETE :
+        {
+            if (fSiteFound)
+            {
+                //have site get application collection
+                hr = GetApplicationElement( pSiteElem,
+                                            pwzAppPath,
+                                            &pAppElement,
+                                            &fAppFound);
+                ExitOnFailure(hr, "Error reading application from config")
+                if (fAppFound)
+                {
+                    //delete Application
+                    hr = DeleteApplication(pSiteElem, pwzAppPath);
+                    ExitOnFailure(hr, "Error deleating application from config")
+                    //Construct Location path
+                    // TODO: it seems odd that these are just
+                    // jammed together, need to determine if this requires a '\'
+                    hr = StrAllocString(&pwzLocationPath, pwzSiteName, 0);
+                    ExitOnFailure(hr, "failed to copy location config path web name");
+                    hr = StrAllocConcat(&pwzLocationPath, pwzAppPath, 0);
+                    ExitOnFailure(hr, "failed to copy location config path appPath ");
+
+                    // and delete location tag for this application
+                    hr = ClearLocationTag(pAdminMgr, pwzLocationPath);
+                    ExitOnFailure(hr, "failed to clear location tag for %ls", pwzLocationPath);
+                }
+            }
+            break;
+        }
+        default:
+            ExitOnFailure(hr = E_UNEXPECTED, "Unexpected IIS Config action specified for Application");
+            break;
+    }
+
+LExit:
+    ReleaseStr(pwzSiteName);
+    ReleaseStr(pwzAppPath);
+    ReleaseStr(pwzAppPool);
+    ReleaseStr(pwzLocationPath);
+    ReleaseObject(pSiteElem);
+    ReleaseObject(pAppElement);
+
+    return hr;
+}
+//-------------------------------------------------------------------------------------------------
+// IIS7VDir
+//  Processes VDir CA Data
+//
+//
+//-------------------------------------------------------------------------------------------------
+HRESULT IIS7VDir(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr)
+{
+    HRESULT hr = S_OK;
+
+    int iAction = -1;
+    BOOL fSiteFound = FALSE;
+    BOOL fAppFound = FALSE;
+
+    LPWSTR pwzSiteName = NULL;
+    LPWSTR pwzVDirPath = NULL;
+    LPWSTR pwzVDirPhyDir = NULL;
+    LPCWSTR pwzVDirSubPath = NULL;
+
+    IAppHostElement *pSiteElem = NULL;
+    IAppHostElement *pAppElement = NULL;
+    IAppHostElementCollection *pElement = NULL;
+
+    // Get Application action
+    hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iAction);
+    ExitOnFailure(hr, "Failed to read VDir action");
+
+    //get site key name
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzSiteName);
+    ExitOnFailure(hr, "Failed to read site key");
+    //get VDir path
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzVDirPath);
+    ExitOnFailure(hr, "Failed to read VDir key");
+    //get physical dir path
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzVDirPhyDir);
+    ExitOnFailure(hr, "Failed to read VDirPath key");
+
+    //Get site if it exists
+    hr = GetSiteElement(pAdminMgr, pwzSiteName, &pSiteElem, &fSiteFound);
+    ExitOnFailure(hr, "Failed to read sites from config");
+
+    if (IIS_CREATE == iAction)
+    {
+        if (fSiteFound)
+        {
+            //have site get application
+            hr = GetApplicationElementForVDir( pSiteElem,
+                                               pwzVDirPath,
+                                               &pAppElement,
+                                               &pwzVDirSubPath,
+                                               &fAppFound);
+            ExitOnFailure(hr, "Error reading application element from config");
+
+            if (!fAppFound)
+            {
+                // need application to add vDir
+                hr = E_FILENOTFOUND;
+                ExitOnFailure(hr, "Error application not found for create VDir");
+            }
+            //
+            // create the virDir
+            //
+            hr = CreateVdir(pAppElement, pwzVDirSubPath, pwzVDirPhyDir);
+            ExitOnFailure(hr, "Failed to create vdir for application");
+        }
+        else
+        {
+            hr = E_FILENOTFOUND;
+            ExitOnFailure(hr, "IIS: site not found for create VDir");
+        }
+    }
+    else if (IIS_DELETE == iAction)
+    {
+        if (fSiteFound)
+        {
+            //have site get application
+            hr = GetApplicationElementForVDir( pSiteElem,
+                                               pwzVDirPath,
+                                               &pAppElement,
+                                               &pwzVDirSubPath,
+                                               &fAppFound);
+            ExitOnFailure(hr, "Error reading application from config")
+            if (fAppFound)
+            {
+                //delete vdir
+                hr = DeleteVdir(pAppElement, pwzVDirSubPath);
+                ExitOnFailure(hr, "Unable to delete vdir for application");
+            }
+        }
+    }
+
+ LExit:
+    ReleaseStr(pwzSiteName);
+    ReleaseStr(pwzVDirPath);
+    ReleaseStr(pwzVDirPhyDir);
+    ReleaseObject(pSiteElem);
+    ReleaseObject(pAppElement);
+    ReleaseObject(pElement);
+
+    return hr;
+}
+
+//-------------------------------------------------------------------------------------------------
+// IIS7Binding
+//  Processes Bindings CA Data
+//
+//
+//-------------------------------------------------------------------------------------------------
+HRESULT IIS7Binding(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr)
+{
+    HRESULT hr = S_OK;
+
+    int iAction = -1;
+    BOOL fSiteFound = FALSE;
+
+    LPWSTR pwzSiteName = NULL;
+    LPWSTR pwzProtocol = NULL;
+    LPWSTR pwzInfo = NULL;
+
+    IAppHostElement *pSiteElem = NULL;
+
+    // Get Application action
+    hr = WcaReadIntegerFromCaData( ppwzCustomActionData, &iAction);
+    ExitOnFailure(hr, "Failed to read binding action");
+
+    //get site key name
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzSiteName);
+    ExitOnFailure(hr, "Failed to read binding site name key");
+
+    //get binding protocol
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzProtocol);
+    ExitOnFailure(hr, "Failed to read binding protocol");
+
+    //get binding info
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzInfo);
+    ExitOnFailure(hr, "Failed to read binding info");
+
+    //Get site if it exists
+    hr = GetSiteElement(pAdminMgr, pwzSiteName, &pSiteElem, &fSiteFound);
+    ExitOnFailure(hr, "Failed to read sites from config");
+
+    if (IIS_CREATE == iAction)
+    {
+        if (fSiteFound)
+        {
+            //add binding
+            hr = CreateBinding(pSiteElem, pwzProtocol, pwzInfo);
+            ExitOnFailure(hr, "Failed to create site binding");
+        }
+        else
+        {
+            hr = HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND);
+            ExitOnFailure(hr, "Site not found for create binding");
+        }
+    }
+    else if (IIS_DELETE == iAction)
+    {
+        if (fSiteFound)
+        {
+            //delete binding
+            hr = DeleteBinding(pSiteElem, pwzProtocol, pwzInfo);
+            ExitOnFailure(hr, "Failed to delete binding");
+        }
+    }
+
+ LExit:
+    ReleaseStr(pwzSiteName);
+    ReleaseStr(pwzProtocol);
+    ReleaseStr(pwzInfo);
+    ReleaseObject(pSiteElem);
+
+    return hr;
+}
+//-------------------------------------------------------------------------------------------------
+// IIS7Binding
+//  Processes WebLog CA Data
+//
+//
+//-------------------------------------------------------------------------------------------------
+HRESULT IIS7WebLog(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr)
+{
+    HRESULT hr = S_OK;
+
+    BOOL fSiteFound = FALSE;
+
+    LPWSTR pwzSiteName = NULL;
+    LPWSTR pwzLogFormat = NULL;
+
+    IAppHostElement *pSiteElem = NULL;
+
+    //get site key name
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzSiteName);
+    ExitOnFailure(hr, "Failed to read web log site name key");
+
+    //get log format
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzLogFormat);
+    ExitOnFailure(hr, "Failed to read web log protocol");
+
+    //Get site if it exists
+    hr = GetSiteElement(pAdminMgr, pwzSiteName, &pSiteElem, &fSiteFound);
+    ExitOnFailure(hr, "Failed to read web log sites from config");
+
+    if (fSiteFound)
+    {
+        //add log format
+        hr = CreateWebLog(pSiteElem, pwzLogFormat);
+        ExitOnFailure(hr, "Failed to create weblog file format");
+    }
+    else
+    {
+        hr = HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND);
+        ExitOnFailure(hr, "Site not found for create weblog file format");
+    }
+
+ LExit:
+    ReleaseStr(pwzSiteName);
+    ReleaseStr(pwzLogFormat);
+    ReleaseObject(pSiteElem);
+
+    return hr;
+}
+//-------------------------------------------------------------------------------------------------
+// IIS7AppPool
+//  Processes AppPool CA Data
+//
+//
+//-------------------------------------------------------------------------------------------------
+HRESULT IIS7AppPool(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    )
+{
+    HRESULT hr = S_OK;
+
+    int iAction = -1;
+
+    LPWSTR pwzAppPoolName = NULL;
+
+    // Get AppPool action
+    hr = WcaReadIntegerFromCaData( ppwzCustomActionData, &iAction);
+    ExitOnFailure(hr, "Failed to read AppPool action");
+
+    //get appPool name
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzAppPoolName);
+    ExitOnFailure(hr, "Failed to read AppPool name key");
+
+    switch (iAction)
+    {
+        case IIS_CREATE :
+        {
+            hr = CreateAppPool(ppwzCustomActionData, pAdminMgr, pwzAppPoolName);
+            break;
+        }
+        case IIS_DELETE:
+        {
+            hr = DeleteAppPool(pAdminMgr, pwzAppPoolName);
+            break;
+        }
+        default:
+            ExitOnFailure(hr = E_UNEXPECTED, "Unexpected IIS Config action specified for appPool");
+            break;
+    }
+
+LExit:
+    ReleaseStr(pwzAppPoolName);
+    return hr;
+}
+
+//-------------------------------------------------------------------------------------------------
+// IIS7AppExtension
+//  Processes AppExtension (config handlers) CA Data
+//
+//
+//-------------------------------------------------------------------------------------------------
+HRESULT IIS7AppExtension(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr)
+{
+   HRESULT hr = S_OK;
+
+   LPWSTR pwzWebName = NULL;
+   LPWSTR pwzWebRoot = NULL;
+   LPWSTR pwzData = NULL;
+   LPWSTR pwzConfigPath = NULL;
+   LPWSTR pwzHandlerName = NULL;
+   LPWSTR pwzPath = NULL;
+   int iAction = -1;
+
+   IAppHostElement *pSection = NULL;
+   IAppHostElement *pElement = NULL;
+   IAppHostElementCollection *pCollection = NULL;
+
+   BOOL fFound = FALSE;
+   DWORD cHandlers = 1000;
+
+    //get web name
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzWebName);
+    ExitOnFailure(hr, "Failed to read appExt Web name key");
+
+    //get root name
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzWebRoot);
+    ExitOnFailure(hr, "Failed to read appExt Web name key");
+
+    //Construct config root
+    hr = StrAllocFormatted(&pwzConfigPath, L"%s/%s", IIS_CONFIG_APPHOST_ROOT, pwzWebName);
+    ExitOnFailure(hr, "failed to format appext config path");
+    //
+    //Do not append trailing '/' for default vDir
+    //
+    if (CSTR_EQUAL != ::CompareStringW(LOCALE_INVARIANT, NORM_IGNORECASE, pwzWebRoot, -1, L"/", -1))
+    {
+        hr = StrAllocConcat(&pwzConfigPath, L"/", 0);
+        ExitOnFailure(hr, "failed to copy appext config path delim");
+        hr = StrAllocConcat(&pwzConfigPath, pwzWebRoot, 0);
+        ExitOnFailure(hr, "failed to copy appext config path root name");
+    }
+    //get admin handlers section at config path location tag
+    hr = pAdminMgr->GetAdminSection(ScopeBSTR(IIS_CONFIG_HANDLERS_SECTION), pwzConfigPath, &pSection);
+    ExitOnFailure(hr, "Failed get appext section");
+
+    if (!pSection)
+    {
+        hr = HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND);
+        ExitOnFailure(hr, "Failed get appext section object");
+    }
+
+    // Get AppExt action
+    hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iAction);
+    ExitOnFailure(hr, "Failed to read appExt action");
+
+    hr = pSection->get_Collection(&pCollection);
+    ExitOnFailure(hr, "Failed get handlers collection for appext");
+
+    while (IIS_APPEXT_END != iAction)
+    {
+        fFound = FALSE;
+
+        //Process property action
+        switch (iAction)
+        {
+            case IIS_APPEXT :
+            {
+                // These IDs aren't really stable but this is stable enough to support repair since the MSI won't change
+                hr = StrAllocFormatted(&pwzHandlerName, L"MsiCustom-%u", ++cHandlers);
+                ExitOnFailure(hr, "Failed increment handler name");
+
+                hr = Iis7FindAppHostElementString(pCollection, IIS_CONFIG_ADD, IIS_CONFIG_NAME, pwzHandlerName, &pElement, NULL);
+                ExitOnFailure(hr, "Failed to find mimemap extension");
+
+                fFound = (NULL != pElement);
+                if (!fFound)
+                {
+                    //create new handler element
+                    hr = pCollection->CreateNewElement(ScopeBSTR(IIS_CONFIG_ADD), &pElement);
+                    ExitOnFailure(hr, "Failed get create handler element for appext");
+
+                    hr = Iis7PutPropertyString(pElement, IIS_CONFIG_NAME, pwzHandlerName);
+                    ExitOnFailure(hr, "Failed set appext name property");
+                }
+
+                //BUGBUG: For compat we are assuming these are all ISAPI MODULES so we are
+                //setting the modules property to IsapiModule.
+                //Currently can't deal with handlers of different module types.
+                hr = Iis7PutPropertyString(pElement, IIS_CONFIG_MODULES, L"IsapiModule");
+                ExitOnFailure(hr, "Failed set site appExt path property");
+
+                //get extension (path)
+                hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzData);
+                ExitOnFailure(hr, "Failed to read appExt extension");
+                hr = StrAllocFormatted(&pwzPath, L"*.%s", pwzData);
+                ExitOnFailure(hr, "Failed decorate appExt path");
+                //put property
+                hr = Iis7PutPropertyString(pElement, IIS_CONFIG_PATH, pwzPath);
+                ExitOnFailure(hr, "Failed set site appExt path property");
+
+                //get executable
+                hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzData);
+                ExitOnFailure(hr, "Failed to read appExt executable");
+                //put property
+                hr = Iis7PutPropertyString(pElement, IIS_CONFIG_EXECUTABLE, pwzData);
+                ExitOnFailure(hr, "Failed set site appExt executable property");
+
+                //get verbs
+                hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzData);
+                ExitOnFailure(hr, "Failed to read appExt verbs");
+                //put property
+                hr = Iis7PutPropertyString(pElement, IIS_CONFIG_VERBS, pwzData);
+                ExitOnFailure(hr, "Failed set site appExt verbs property");
+
+                break;
+            }
+            default:
+            {
+                ExitOnFailure(hr = E_UNEXPECTED, "Unexpected IIS Config action specified for AppExt");
+                break;
+            }
+        }
+
+        if (!fFound)
+        {
+            //  put handler element at beginning of list
+            hr = pCollection->AddElement(pElement, 0);
+            ExitOnFailure(hr, "Failed add handler element for appext");
+        }
+
+        ReleaseNullObject(pElement);
+
+        // Get AppExt action
+        hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iAction);
+        ExitOnFailure(hr, "Failed to read AppPool Property action");
+    }
+
+LExit:
+    ReleaseStr(pwzWebName);
+    ReleaseStr(pwzWebRoot);
+    ReleaseStr(pwzData);
+    ReleaseStr(pwzConfigPath);
+    ReleaseStr(pwzHandlerName);
+    ReleaseStr(pwzPath);
+    ReleaseObject(pSection);
+    ReleaseObject(pElement);
+    ReleaseObject(pCollection);
+
+    return hr;
+}
+
+//-------------------------------------------------------------------------------------------------
+// IIS7MimeMap
+//  Processes Mime Map (config handlers) CA Data
+//
+//
+//-------------------------------------------------------------------------------------------------
+ HRESULT IIS7MimeMap(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    )
+{
+    HRESULT hr = S_OK;
+    LPWSTR pwzConfigPath = NULL;
+    LPWSTR pwzWebName = NULL;
+    LPWSTR pwzWebRoot = NULL;
+    LPWSTR pwzData = NULL;
+    int iAction = -1;
+
+    IAppHostElement *pSection = NULL;
+    IAppHostElement *pElement = NULL;
+    IAppHostElementCollection *pCollection = NULL;
+
+    BOOL fFound = FALSE;
+
+    //get web name
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzWebName);
+    ExitOnFailure(hr, "Failed to read mime map Web name key");
+
+    //get vdir root name
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzWebRoot);
+    ExitOnFailure(hr, "Failed to read vdir root name key");
+
+    //Construct config root
+    hr = StrAllocFormatted(&pwzConfigPath, L"%s/%s",  IIS_CONFIG_APPHOST_ROOT, pwzWebName);
+    ExitOnFailure(hr, "failed to format mime map config path web name");
+    //
+    //Do not append trailing '/' for default vDir
+    //
+    if (CSTR_EQUAL != ::CompareStringW(LOCALE_INVARIANT, NORM_IGNORECASE, pwzWebRoot, -1, L"/", -1))
+    {
+        hr = StrAllocConcat(&pwzConfigPath, L"/", 0);
+        ExitOnFailure(hr, "failed to copy appext config path delim");
+        hr = StrAllocConcat(&pwzConfigPath, pwzWebRoot, 0);
+        ExitOnFailure(hr, "failed to copy appext config path root name");
+    }
+
+    //get admin section <staticContent> at config path location tag
+    hr = pAdminMgr->GetAdminSection(ScopeBSTR(IIS_CONFIG_STATICCONTENT_SECTION), pwzConfigPath, &pSection);
+    ExitOnFailure(hr, "Failed get staticContent section for mimemap");
+
+    if (!pSection)
+    {
+        hr = HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND);
+        ExitOnFailure(hr, "Failed get staticContent section object");
+    }
+
+    // Get mimemap action
+    hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iAction);
+    ExitOnFailure(hr, "Failed to read mimemap action");
+
+    hr = pSection->get_Collection(&pCollection);
+    ExitOnFailure(hr, "Failed get staticContent collection for mimemap");
+
+    while (IIS_MIMEMAP_END != iAction)
+    {
+        //Process property action
+        switch (iAction)
+        {
+            case IIS_MIMEMAP :
+            {
+                //get extension
+                hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzData);
+                ExitOnFailure(hr, "Failed to read mimemap extension");
+
+                hr = Iis7FindAppHostElementString(pCollection, IIS_CONFIG_MIMEMAP, IIS_CONFIG_FILEEXT, pwzData, &pElement, NULL);
+                ExitOnFailure(hr, "Failed to find mimemap extension");
+                fFound = (NULL != pElement);
+
+                if (!fFound)
+                {
+                    //create new mimeMap element
+                    hr = pCollection->CreateNewElement(ScopeBSTR(IIS_CONFIG_MIMEMAP), &pElement);
+                    ExitOnFailure(hr, "Failed get create MimeMap element");
+                }
+
+                //put property
+                hr = Iis7PutPropertyString(pElement, IIS_CONFIG_FILEEXT, pwzData);
+                ExitOnFailure(hr, "Failed set mimemap extension property");
+
+                //get type
+                hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzData);
+                ExitOnFailure(hr, "Failed to read mimemap type");
+                //put property
+                hr = Iis7PutPropertyString(pElement, IIS_CONFIG_MIMETYPE, pwzData);
+                ExitOnFailure(hr, "Failed set mimemap type property");
+
+                break;
+            }
+            default:
+            {
+                ExitOnFailure(hr = E_UNEXPECTED, "Unexpected IIS Config action specified for mimeMap");
+                break;
+            }
+        }
+
+        if (!fFound)
+        {
+            //  put mimeMap element at beginning of list
+            hr = pCollection->AddElement(pElement, -1);
+            ExitOnFailure(hr, "Failed add mimemap");
+        }
+
+        // Get AppExt action
+        hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iAction);
+        ExitOnFailure(hr, "Failed to read mimemap action");
+
+        ReleaseNullObject(pElement);
+    }
+
+LExit:
+    ReleaseStr(pwzConfigPath);
+    ReleaseStr(pwzWebName);
+    ReleaseStr(pwzWebRoot);
+    ReleaseStr(pwzData);
+    ReleaseObject(pSection);
+    ReleaseObject(pElement);
+    ReleaseObject(pCollection);
+
+    return hr;
+}
+
+//-------------------------------------------------------------------------------------------------
+// IIS7DirProperties
+//  ProcessesVdir Properties  CA Data
+//
+//
+//-------------------------------------------------------------------------------------------------
+HRESULT IIS7DirProperties(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    )
+{
+    HRESULT hr = S_OK;
+    WCHAR wcTime[60];
+    LPWSTR pwzConfigPath = NULL;
+    LPWSTR pwzWebName = NULL;
+    LPWSTR pwzWebRoot = NULL;
+    LPWSTR pwzData = NULL;
+    int iAction = -1;
+    int iData   =  0;
+    DWORD dwData = 0;
+
+    IAppHostElement *pSection = NULL;
+    IAppHostElement *pElement = NULL;
+    IAppHostElementCollection *pCollection = NULL;
+
+    //get web name
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzWebName);
+    ExitOnFailure(hr, "Failed to read DirProp Web name key");
+
+    //get vdir root name
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzWebRoot);
+    ExitOnFailure(hr, "Failed to read DirProp Web name key");
+
+    //Construct config root
+    hr = StrAllocFormatted(&pwzConfigPath, L"%s/%s",  IIS_CONFIG_APPHOST_ROOT, pwzWebName);
+    ExitOnFailure(hr, "failed to format mime map config path web name");
+    //
+    //Do not append trailing '/' for default vDir
+    //
+    if (CSTR_EQUAL != ::CompareStringW(LOCALE_INVARIANT, NORM_IGNORECASE, pwzWebRoot, -1, L"/", -1))
+    {
+        hr = StrAllocConcat(&pwzConfigPath, L"/", 0);
+        ExitOnFailure(hr, "failed to copy appext config path delim");
+        hr = StrAllocConcat(&pwzConfigPath, pwzWebRoot, 0);
+        ExitOnFailure(hr, "failed to copy appext config path root name");
+    }
+
+    // Get DirProps action
+    hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iAction);
+    ExitOnFailure(hr, "Failed to read DirProps action");
+
+    while (IIS_DIRPROP_END != iAction)
+    {
+        //Process property action
+        switch (iAction)
+        {
+            case IIS_DIRPROP_ACCESS :
+            {
+                hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+                ExitOnFailure(hr, "Failed to read DirProps access");
+                //iData contains bit flags for <handlers accessPolicy="">
+                //no translation required
+                //get admin section at config path location tag
+                hr = pAdminMgr->GetAdminSection(ScopeBSTR(IIS_CONFIG_HANDLERS_SECTION), pwzConfigPath, &pSection);
+                ExitOnFailure(hr, "Failed get handlers section for DirProp");
+                if (!pSection)
+                {
+                    hr = HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND);
+                    ExitOnFailure(hr, "Failed get handlers section object for DirProps");
+                }
+                dwData = iData;
+                hr = Iis7PutPropertyInteger( pSection, L"accessPolicy", dwData);
+                ExitOnFailure(hr, "Failed set accessPolicy for DirProps");
+                ReleaseNullObject(pSection);
+                break;
+            }
+            case IIS_DIRPROP_USER :
+            {
+                hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzData);
+                ExitOnFailure(hr, "Failed to read DirProps user");
+                hr = pAdminMgr->GetAdminSection(ScopeBSTR(L"system.webServer/security/authentication/anonymousAuthentication"), pwzConfigPath, &pSection);
+                ExitOnFailure(hr, "Failed get AnonymousAuthentication section for DirProp");
+                hr = Iis7PutPropertyString( pSection, IIS_CONFIG_USERNAME, pwzData);
+                ExitOnFailure(hr, "Failed set accessPolicy for DirProps");
+                ReleaseNullObject(pSection);
+                break;
+            }
+            case IIS_DIRPROP_PWD :
+            {
+                hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzData);
+                ExitOnFailure(hr, "Failed to read DirProps pwd");
+                hr = pAdminMgr->GetAdminSection(ScopeBSTR(L"system.webServer/security/authentication/anonymousAuthentication"), pwzConfigPath, &pSection);
+                ExitOnFailure(hr, "Failed get AnonymousAuthentication section for DirProp");
+                hr = Iis7PutPropertyString( pSection, IIS_CONFIG_PASSWORD, pwzData);
+                ExitOnFailure(hr, "Failed set accessPolicy for DirProps");
+                ReleaseNullObject(pSection);
+                break;
+            }
+            case IIS_DIRPROP_DEFDOCS :
+            {
+                hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzData);
+                ExitOnFailure(hr, "Failed to read DirProps def doc");
+                hr = SetDirPropDefDoc(pAdminMgr, pwzConfigPath, pwzData);
+                ExitOnFailure(hr, "Failed to set DirProps Default Documents");
+                break;
+            }
+            case IIS_DIRPROP_AUTH :
+            {
+                hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+                ExitOnFailure(hr, "Failed to read DirProps auth");
+                //iData contains bit flags for /security/authentication/<...>
+                // Anonymous    = 1
+                // Basic        = 2
+                // Windows      = 4
+                // Digest       =16
+                // Passport     =64  *not supported
+                //translation required from bit map to section
+                // E.G security/authentication/windowsAuthentication [property enabled true|false]
+                dwData= iData;
+                hr = SetDirPropAuthentications(pAdminMgr, pwzConfigPath, dwData);
+                ExitOnFailure(hr, "Failed set Authentication for DirProps");
+                break;
+            }
+            case IIS_DIRPROP_SSLFLAGS :
+            {
+                hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+                ExitOnFailure(hr, "Failed to read DirProps sslFlags");
+                //iData contains bit flags for /security/access sslFlags
+                //no translation required
+                hr = pAdminMgr->GetAdminSection(ScopeBSTR(L"system.webServer/security/access"), pwzConfigPath, &pSection);
+                ExitOnFailure(hr, "Failed get security/access section for DirProp");
+                dwData = iData;
+                hr = Iis7PutPropertyInteger( pSection, L"sslFlags", dwData);
+                ExitOnFailure(hr, "Failed set security/access for DirProps");
+                ReleaseNullObject(pSection);
+                break;
+            }
+            case IIS_DIRPROP_AUTHPROVID :
+            {
+                hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzData);
+                ExitOnFailure(hr, "Failed to read DirProps auth provider");
+                hr = SetDirPropAuthProvider(pAdminMgr, pwzConfigPath, pwzData);
+                ExitOnFailure(hr, "Failed to set DirProps auth provider");
+                break;
+            }
+            case IIS_DIRPROP_ASPERROR:
+            {
+                hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+                ExitOnFailure(hr, "Failed to read DirProps aspDetailedError");
+                hr = pAdminMgr->GetAdminSection(ScopeBSTR(IIS_CONFIG_ASP_SECTION), pwzConfigPath, &pSection);
+                ExitOnFailure(hr, "Failed get asp section for DirProp");
+                hr = Iis7PutPropertyBool(pSection, IIS_CONFIG_SCRIPTERROR, iData);
+                ExitOnFailure(hr, "Failed to set DirProps aspDetailedError");
+                ReleaseNullObject(pSection);
+                break;
+            }
+            case IIS_DIRPROP_HTTPEXPIRES:
+            {
+                hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzData);
+                ExitOnFailure(hr, "Failed to read DirProps httpExpires provider");
+                hr = pAdminMgr->GetAdminSection(ScopeBSTR(IIS_CONFIG_STATICCONTENT_SECTION), pwzConfigPath, &pSection);
+                ExitOnFailure(hr, "Failed get staticContent section for DirProp");
+                hr = pSection->GetElementByName(ScopeBSTR(IIS_CONFIG_CLIENTCACHE), &pElement);
+                ExitOnFailure(hr, "Failed to get clientCache element");
+                hr = Iis7PutPropertyString(pElement, IIS_CONFIG_HTTPEXPIRES, pwzData);
+                ExitOnFailure(hr, "Failed to set clientCache httpExpires value");
+                hr = Iis7PutPropertyString(pElement, IIS_CONFIG_CACHECONTROLMODE, IIS_CONFIG_USEEXPIRES);
+                ExitOnFailure(hr, "Failed to set clientCache cacheControlMode value");
+                ReleaseNullObject(pSection);
+                ReleaseNullObject(pElement);
+                break;
+            }
+            case IIS_DIRPROP_MAXAGE:
+            {
+                hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+                ExitOnFailure(hr, "Failed to read DirProps httpExpires provider");
+                hr = pAdminMgr->GetAdminSection(ScopeBSTR(IIS_CONFIG_STATICCONTENT_SECTION), pwzConfigPath, &pSection);
+                ExitOnFailure(hr, "Failed get staticContent section for DirProp");
+                hr = pSection->GetElementByName(ScopeBSTR(IIS_CONFIG_CLIENTCACHE), &pElement);
+                ExitOnFailure(hr, "Failed to get clientCache element");
+                *wcTime = '\0';
+                ConvSecToDHMS(iData, wcTime, countof(wcTime));
+                hr = Iis7PutPropertyString(pElement, IIS_CONFIG_MAXAGE, wcTime);
+                ExitOnFailure(hr, "Failed to set clientCache maxAge value");
+                hr = Iis7PutPropertyString(pElement, IIS_CONFIG_CACHECONTROLMODE, IIS_CONFIG_USEMAXAGE);
+                ExitOnFailure(hr, "Failed to set clientCache cacheControlMode value");
+                ReleaseNullObject(pSection);
+                ReleaseNullObject(pElement);
+                break;
+            }
+            case IIS_DIRPROP_CACHECUST:
+            {
+                hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzData);
+                ExitOnFailure(hr, "Failed to read DirProps cacheControlCustom");
+                hr = pAdminMgr->GetAdminSection(ScopeBSTR(IIS_CONFIG_STATICCONTENT_SECTION), pwzConfigPath, &pSection);
+                ExitOnFailure(hr, "Failed get staticContent section for DirProp");
+                hr = pSection->GetElementByName(ScopeBSTR(IIS_CONFIG_CLIENTCACHE), &pElement);
+                ExitOnFailure(hr, "Failed to get clientCache element");
+                hr = Iis7PutPropertyString(pElement, IIS_CONFIG_CACHECUST, pwzData);
+                ExitOnFailure(hr, "Failed to set clientCache cacheControlCustom value");
+                ReleaseNullObject(pSection);
+                ReleaseNullObject(pElement);
+                break;
+            }
+            case IIS_DIRPROP_NOCUSTERROR:
+            {
+                //no value, if have ID tag write clear to system.webServer/httpErrors
+                //error collection
+                hr = pAdminMgr->GetAdminSection(ScopeBSTR(IIS_CONFIG_HTTPERRORS_SECTION), pwzConfigPath, &pSection);
+                ExitOnFailure(hr, "Failed get httperrors section for DirProp");
+                hr = pSection->get_Collection(&pCollection);
+                ExitOnFailure(hr, "Failed get error collection for DirProp");
+                hr = pCollection->CreateNewElement(ScopeBSTR(IIS_CONFIG_CLEAR), &pElement);
+                ExitOnFailure(hr, "Failed to create clear element for error collection for DirProp");
+                hr = pCollection->AddElement(pElement);
+                ExitOnFailure(hr, "Failed to add lear element for error collection for DirProp");
+                ReleaseNullObject(pSection);
+                ReleaseNullObject(pElement);
+                break;
+            }
+            case IIS_DIRPROP_LOGVISITS:
+            {
+                hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+                ExitOnFailure(hr, "Failed to read DirProps logVisits");
+                hr = pAdminMgr->GetAdminSection(ScopeBSTR(IIS_CONFIG_HTTPLOGGING_SECTION), pwzConfigPath, &pSection);
+                ExitOnFailure(hr, "Failed get httpLogging section for DirProp");
+                hr = Iis7PutPropertyBool(pSection, IIS_CONFIG_DONTLOG, iData);
+                ExitOnFailure(hr, "Failed to set DirProps aspDetailedError");
+                ReleaseNullObject(pSection);
+                break;
+            }
+            default:
+            {
+                ExitOnFailure(hr = E_UNEXPECTED, "Unexpected IIS Config action specified for WebDirProperties");
+                break;
+            }
+        }
+
+        // Get AppExt action
+        hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iAction);
+        ExitOnFailure(hr, "Failed to read DirProps Property action");
+    }
+LExit:
+    ReleaseStr(pwzConfigPath);
+    ReleaseStr(pwzWebName);
+    ReleaseStr(pwzWebRoot);
+    ReleaseStr(pwzData);
+    ReleaseObject(pSection);
+    ReleaseObject(pElement);
+    ReleaseObject(pCollection);
+
+    return hr;
+}
+
+//-------------------------------------------------------------------------------------------------
+// IIS7SslBinding
+//  ProcessesVdir Properties  CA Data
+//
+//
+//-------------------------------------------------------------------------------------------------
+HRESULT IIS7SslBinding(
+    __inout  LPWSTR *ppwzCustomActionData,
+    __in     IAppHostWritableAdminManager *pAdminMgr
+    )
+{
+    HRESULT hr = S_OK;
+    int iAction = -1;
+    BOOL fSiteFound = FALSE;
+
+    LPWSTR pwzSiteName = NULL;
+    LPWSTR pwzStoreName = NULL;
+    LPWSTR pwzEncodedCertificateHash = NULL;
+
+    IAppHostElement *pSiteElem = NULL;
+
+    // Get Application action
+    hr = WcaReadIntegerFromCaData( ppwzCustomActionData, &iAction);
+    ExitOnFailure(hr, "Failed to read binding action");
+
+    //get site key name
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzSiteName);
+    ExitOnFailure(hr, "Failed to read binding site name key");
+
+    //get binding protocol
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzStoreName);
+    ExitOnFailure(hr, "Failed to read binding protocol");
+
+    //get binding info
+    hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzEncodedCertificateHash);
+    ExitOnFailure(hr, "Failed to read binding info");
+
+    //Get site if it exists
+    hr = GetSiteElement(pAdminMgr, pwzSiteName, &pSiteElem, &fSiteFound);
+    ExitOnFailure(hr, "Failed to read sites from config");
+
+    if (IIS_CREATE == iAction)
+    {
+        if (fSiteFound)
+        {
+            //add SSL cert to binding
+            hr = CreateSslBinding(pSiteElem, pwzStoreName, pwzEncodedCertificateHash);
+            ExitOnFailure(hr, "Failed to create site binding");
+        }
+        else
+        {
+            hr = HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND);
+            ExitOnFailure(hr, "Site not found for create binding");
+        }
+    }
+    else if (IIS_DELETE == iAction)
+    {
+        if (fSiteFound)
+        {
+            //delete binding
+            hr = DeleteSslBinding(pSiteElem, pwzStoreName, pwzEncodedCertificateHash);
+            ExitOnFailure(hr, "Failed to delete binding");
+        }
+    }
+
+ LExit:
+    ReleaseStr(pwzSiteName);
+    ReleaseStr(pwzStoreName);
+    ReleaseStr(pwzEncodedCertificateHash);
+    ReleaseObject(pSiteElem);
+
+    return hr;
+}
+
+//-------------------------------------------------------------------------------------------------
+// Helper Functions
+//
+//
+//
+//-------------------------------------------------------------------------------------------------
+
+static HRESULT GetNextAvailableSiteId(
+    IAppHostElementCollection *pCollection,
+    DWORD *plSiteId
+    )
+{
+   HRESULT hr = S_OK;
+   IAppHostElement *pElement = NULL;
+   IAppHostProperty *pProperty = NULL;
+
+   DWORD cSites;
+   DWORD plNextAvailSite  = 0;
+   VARIANT vPropValue;
+   VARIANT vtIndex;
+
+   VariantInit(&vPropValue);
+   VariantInit(&vtIndex);
+
+   *plSiteId = 0;
+
+    hr = pCollection->get_Count(&cSites);
+    ExitOnFailure(hr, "Failed get sites collection count");
+
+    vtIndex.vt = VT_UI4;
+    for (DWORD i = 0; i < cSites; ++i)
+    {
+        vtIndex.ulVal = i;
+        hr = pCollection->get_Item(vtIndex , &pElement);
+        ExitOnFailure(hr, "Failed get sites collection item");
+
+        hr = pElement->GetPropertyByName(ScopeBSTR(IIS_CONFIG_ID), &pProperty);
+        ExitOnFailure(hr, "Failed get site property");
+
+        hr = pProperty->get_Value(&vPropValue);
+        ExitOnFailure(hr, "Failed get site property value");
+
+        *plSiteId = vPropValue.lVal;
+        if (*plSiteId > plNextAvailSite)
+        {
+            plNextAvailSite = *plSiteId;
+        }
+        ReleaseNullObject(pElement);
+        ReleaseNullObject(pProperty);
+    }
+    *plSiteId = ++plNextAvailSite;
+
+LExit:
+    ReleaseVariant(vPropValue);
+    ReleaseVariant(vtIndex);
+
+    ReleaseObject(pElement);
+    ReleaseObject(pProperty);
+
+    return hr;
+}
+
+static HRESULT GetSiteElement(
+    IAppHostWritableAdminManager *pAdminMgr,
+    LPCWSTR swSiteName,
+    IAppHostElement **ppSiteElement,
+    BOOL* fFound
+    )
+{
+   HRESULT hr = S_OK;
+   IAppHostElement *pSites = NULL;
+   IAppHostElementCollection *pCollection = NULL;
+
+   *fFound = FALSE;
+
+    hr = pAdminMgr->GetAdminSection(ScopeBSTR(IIS_CONFIG_SITES_SECTION), ScopeBSTR(IIS_CONFIG_APPHOST_ROOT), &pSites);
+    ExitOnFailure(hr, "Failed get sites section");
+    ExitOnNull(pSites, hr, ERROR_FILE_NOT_FOUND, "Failed get sites section object");
+
+    hr = pSites->get_Collection(&pCollection);
+    ExitOnFailure(hr, "Failed get sites collection");
+
+    hr = Iis7FindAppHostElementString(pCollection, IIS_CONFIG_SITE, IIS_CONFIG_NAME, swSiteName, ppSiteElement, NULL);
+    ExitOnFailure(hr, "Failed to find site %ls", swSiteName);
+
+    *fFound = ppSiteElement != NULL && *ppSiteElement != NULL;
+
+LExit:
+    ReleaseObject(pSites);
+    ReleaseObject(pCollection);
+
+    return hr;
+}
+
+static HRESULT GetApplicationElement( IAppHostElement *pSiteElement,
+                                      LPCWSTR swAppPath,
+                                      IAppHostElement **ppAppElement,
+                                      BOOL* fFound)
+{
+   HRESULT hr = S_OK;
+   IAppHostElementCollection *pCollection = NULL;
+
+   *fFound = FALSE;
+
+    hr = pSiteElement->get_Collection( &pCollection);
+    ExitOnFailure(hr, "Failed get site app collection");
+
+    hr = Iis7FindAppHostElementString(pCollection, IIS_CONFIG_APPLICATION, IIS_CONFIG_PATH, swAppPath, ppAppElement, NULL);
+    ExitOnFailure(hr, "Failed to find app %ls", swAppPath);
+
+    *fFound = ppAppElement != NULL && *ppAppElement != NULL;
+
+LExit:
+    ReleaseObject(pCollection);
+
+    return hr;
+}
+
+static HRESULT GetApplicationElementForVDir( IAppHostElement *pSiteElement,
+                                             LPCWSTR pwzVDirPath,
+                                             IAppHostElement **ppAppElement,
+                                             LPCWSTR *ppwzVDirSubPath,
+                                             BOOL* fFound)
+{
+    HRESULT hr = S_OK;
+    IAppHostElementCollection *pCollection = NULL;
+    LPWSTR pwzAppPath = NULL;
+    *fFound = FALSE;
+    *ppwzVDirSubPath = NULL;
+
+    hr = pSiteElement->get_Collection( &pCollection);
+    ExitOnFailure(hr, "Failed get site app collection");
+
+    // Start with full path
+    int iLastPathIndex = lstrlenW(pwzVDirPath) - 1;
+    hr = StrAllocString(&pwzAppPath, pwzVDirPath, 0);
+    ExitOnFailure(hr, "Failed allocate application path");
+
+    for (int iSubPathIndex = iLastPathIndex; (iSubPathIndex >= 0) && (!*fFound); --iSubPathIndex)
+    {
+        // We are looking at the full path, or at a directory boundary, or at the root
+        if (iSubPathIndex == iLastPathIndex ||
+            '/' == pwzAppPath[iSubPathIndex] ||
+            0 == iSubPathIndex)
+        {
+            // break the path if needed
+            if ('/' == pwzAppPath[iSubPathIndex])
+            {
+                pwzAppPath[iSubPathIndex] = '\0';
+            }
+
+            // Special case for root path, need an empty app path
+            LPCWSTR pwzAppSearchPath = 0 == iSubPathIndex ? L"/" : pwzAppPath;
+
+            // Try to find an app with the specified path
+            hr = Iis7FindAppHostElementString(pCollection, IIS_CONFIG_APPLICATION, IIS_CONFIG_PATH, pwzAppSearchPath, ppAppElement, NULL);
+            ExitOnFailure(hr, "Failed to search for app %ls", pwzAppSearchPath);
+            *fFound = ppAppElement != NULL && *ppAppElement != NULL;
+
+            if (*fFound)
+            {
+                // set return value for sub path
+                // special case for app path == vdir path, need an empty subpath.
+                *ppwzVDirSubPath = (iSubPathIndex == iLastPathIndex) ? L"/" : pwzVDirPath + iSubPathIndex;
+            }
+        }
+    }
+
+LExit:
+    ReleaseObject(pCollection);
+    ReleaseStr(pwzAppPath);
+
+    return hr;
+}
+
+static HRESULT CreateSite(
+    __in IAppHostElementCollection *pCollection,
+    __in LPCWSTR swSiteName,
+    __out IAppHostElement **pSiteElement
+    )
+{
+    HRESULT hr = S_OK;
+    IAppHostElement *pNewElement = NULL;
+
+    hr = pCollection->CreateNewElement(ScopeBSTR(IIS_CONFIG_SITE), &pNewElement);
+    ExitOnFailure(hr, "Failed create site element");
+
+    hr = Iis7PutPropertyString(pNewElement, IIS_CONFIG_NAME, swSiteName);
+    ExitOnFailure(hr, "Failed set site name property");
+
+    DWORD lSiteId = 0;
+    hr = GetNextAvailableSiteId(pCollection, &lSiteId);
+    ExitOnFailure(hr, "Failed get next site id");
+
+    Iis7PutPropertyInteger(pNewElement, IIS_CONFIG_ID, lSiteId);
+    ExitOnFailure(hr, "Failed set site id property");
+
+    hr = pCollection->AddElement(pNewElement);
+    ExitOnFailure(hr, "Failed add site element");
+
+    *pSiteElement = pNewElement;
+    pNewElement = NULL;
+
+LExit:
+    ReleaseObject(pNewElement);
+
+    return hr;
+}
+
+static HRESULT CreateApplication(
+    IAppHostElement *pSiteElement,
+    LPCWSTR swAppPath,
+    IAppHostElement **pAppElement
+    )
+{
+    HRESULT hr = S_OK;
+    IAppHostElement *pNewElement = NULL;
+    IAppHostElementCollection *pCollection = NULL;
+
+    hr = pSiteElement->get_Collection(&pCollection);
+    ExitOnFailure(hr, "Failed get application collection");
+
+    hr = pCollection->CreateNewElement(ScopeBSTR(IIS_CONFIG_APPLICATION), &pNewElement);
+    ExitOnFailure(hr, "Failed get application element");
+
+    hr = Iis7PutPropertyString(pNewElement, IIS_CONFIG_PATH, swAppPath);
+    ExitOnFailure(hr, "Failed set application path property");
+
+    hr = pCollection->AddElement(pNewElement);
+    ExitOnFailure(hr, "Failed add application to collection");
+
+    *pAppElement = pNewElement;
+    pNewElement = NULL;
+
+LExit:
+    ReleaseObject(pCollection);
+    ReleaseObject(pNewElement);
+
+    return hr;
+}
+
+static HRESULT DeleteApplication(
+    IAppHostElement *pSiteElement,
+    LPCWSTR swAppPath
+    )
+{
+    HRESULT hr = S_OK;
+    IAppHostElementCollection *pCollection = NULL;
+
+    hr = pSiteElement->get_Collection(&pCollection);
+    ExitOnFailure(hr, "Failed get application collection");
+
+    hr = DeleteCollectionElement(pCollection, IIS_CONFIG_APPLICATION, IIS_CONFIG_PATH, swAppPath);
+    ExitOnFailure(hr, "Failed to delete website");
+
+LExit:
+    ReleaseObject(pCollection);
+
+    return hr;
+}
+
+static HRESULT SetAppPool(
+    IAppHostElement *pAppElement,
+    LPCWSTR pwzAppPool
+    )
+{
+    HRESULT hr = S_OK;
+
+    if (*pwzAppPool != 0)
+    {
+        hr = Iis7PutPropertyString(pAppElement, IIS_CONFIG_APPPOOL, pwzAppPool);
+        ExitOnFailure(hr, "Failed set application appPool property");
+    }
+LExit:
+    return hr;
+}
+
+static HRESULT CreateVdir(
+    IAppHostElement *pAppElement,
+    LPCWSTR pwzVDirPath,
+    LPCWSTR pwzVDirPhyDir
+    )
+{
+    HRESULT hr = S_OK;
+    IAppHostElement *pElement = NULL;
+    IAppHostElementCollection *pCollection = NULL;
+    BOOL fFound;
+
+    hr = pAppElement->get_Collection(&pCollection);
+    ExitOnFailure(hr, "Failed get application VDir collection");
+
+    hr = Iis7FindAppHostElementString(pCollection, IIS_CONFIG_VDIR, IIS_CONFIG_PATH, pwzVDirPath, &pElement, NULL);
+    ExitOnFailure(hr, "Failed while finding virtualDir");
+    fFound = (NULL != pElement);
+
+    if (!fFound)
+    {
+        hr = pCollection->CreateNewElement(ScopeBSTR(IIS_CONFIG_VDIR), &pElement);
+        ExitOnFailure(hr, "Failed create application VDir collection");
+
+        hr = Iis7PutPropertyString(pElement, IIS_CONFIG_PATH, pwzVDirPath);
+        ExitOnFailure(hr, "Failed set VDir path property");
+    }
+
+    hr = Iis7PutPropertyString(pElement, IIS_CONFIG_PHYSPATH, pwzVDirPhyDir);
+    ExitOnFailure(hr, "Failed set VDir phys path property");
+
+    if (!fFound)
+    {
+        hr = pCollection->AddElement(pElement);
+        ExitOnFailure(hr, "Failed add application VDir element");
+    }
+
+LExit:
+    ReleaseObject(pCollection);
+    ReleaseObject(pElement);
+
+    return hr;
+}
+
+static HRESULT DeleteVdir(
+    IAppHostElement *pAppElement,
+    LPCWSTR pwzVDirPath
+    )
+{
+    HRESULT hr = S_OK;
+    IAppHostElementCollection *pCollection = NULL;
+
+    hr = pAppElement->get_Collection(&pCollection);
+    ExitOnFailure(hr, "Failed get application VDir collection");
+
+    hr = DeleteCollectionElement(pCollection, IIS_CONFIG_VDIR, IIS_CONFIG_PATH, pwzVDirPath);
+    ExitOnFailure(hr, "Failed to delete vdir");
+
+LExit:
+    ReleaseObject(pCollection);
+
+    return hr;
+}
+
+static HRESULT CreateBinding(
+    IAppHostElement *pSiteElem,
+    LPCWSTR pwzProtocol,
+    LPCWSTR pwzInfo
+    )
+{
+    HRESULT hr = S_OK;
+    IAppHostChildElementCollection *pChildElems = NULL;
+    IAppHostElement *pBindings = NULL;
+    IAppHostElement *pBindingElement = NULL;
+    IAppHostElementCollection *pCollection = NULL;
+
+    VARIANT vtProp;
+
+    VariantInit(&vtProp);
+
+    hr = pSiteElem->get_ChildElements(&pChildElems);
+    ExitOnFailure(hr, "Failed get site child elements collection");
+
+    vtProp.vt = VT_BSTR;
+    vtProp.bstrVal = ::SysAllocString(IIS_CONFIG_BINDINGS);
+    hr = pChildElems->get_Item(vtProp, &pBindings);
+    ExitOnFailure(hr, "Failed get bindings element");
+    ReleaseVariant(vtProp);
+
+    hr = pBindings->get_Collection(&pCollection);
+    ExitOnFailure(hr, "Failed get bindings collection");
+
+    hr = pCollection->CreateNewElement(ScopeBSTR(IIS_CONFIG_BINDING), &pBindingElement);
+    ExitOnFailure(hr, "Failed get binding element");
+
+    hr = Iis7PutPropertyString(pBindingElement, IIS_CONFIG_PROTOCOL, pwzProtocol);
+    ExitOnFailure(hr, "Failed set binding protocol property");
+
+    hr = Iis7PutPropertyString(pBindingElement, IIS_CONFIG_BINDINGINFO, pwzInfo);
+    ExitOnFailure(hr, "Failed set binding information property");
+
+    hr = pCollection->AddElement(pBindingElement);
+    if (hr == HRESULT_FROM_WIN32(ERROR_ALREADY_EXISTS))
+    {
+        //Eat this error. Binding is there and nothing to repair since
+        //identity == protocol + info so all is OK
+        hr = S_OK;
+    }
+    else
+    {
+        ExitOnFailure(hr, "Failed add binding to site");
+    }
+
+LExit:
+    ReleaseVariant(vtProp);
+
+    ReleaseObject(pCollection);
+    ReleaseObject(pChildElems);
+    ReleaseObject(pBindingElement);
+    ReleaseObject(pBindings);
+
+    return hr;
+}
+static HRESULT CreateWebLog(
+    IAppHostElement *pSiteElem,
+    LPCWSTR pwzFormat
+    )
+{
+    HRESULT hr = S_OK;
+    IAppHostChildElementCollection *pChildElems = NULL;
+    IAppHostElement *pLogFile = NULL;
+
+    VARIANT vtProp;
+
+    VariantInit(&vtProp);
+
+    hr = pSiteElem->get_ChildElements(&pChildElems);
+    ExitOnFailure(hr, "Failed get site child elements collection");
+
+    vtProp.vt = VT_BSTR;
+    vtProp.bstrVal = ::SysAllocString(IIS_CONFIG_WEBLOG);
+    hr = pChildElems->get_Item(vtProp, &pLogFile);
+    ExitOnFailure(hr, "Failed get logfile element");
+    ReleaseVariant(vtProp);
+
+    if (CSTR_EQUAL != ::CompareStringW(LOCALE_INVARIANT, NORM_IGNORECASE, pwzFormat, -1, L"none", -1))
+    {
+        hr = Iis7PutPropertyString(pLogFile, IIS_CONFIG_LOGFORMAT, pwzFormat);
+        ExitOnFailure(hr, "Failed set logfile format property");
+        hr = Iis7PutPropertyString(pLogFile, IIS_CONFIG_ENABLED, IIS_CONFIG_TRUE);
+        ExitOnFailure(hr, "Failed set logfile enabled property");
+    }
+    else
+    {
+        hr = Iis7PutPropertyString(pLogFile, IIS_CONFIG_ENABLED, IIS_CONFIG_FALSE);
+        ExitOnFailure(hr, "Failed set logfile enabled property");
+    }
+
+LExit:
+    ReleaseVariant(vtProp);
+
+    ReleaseObject(pLogFile);
+    ReleaseObject(pChildElems);
+
+    return hr;
+}
+
+static HRESULT DeleteBinding(
+    IAppHostElement* /*pSiteElem*/,
+    LPCWSTR /*pwzProtocol*/,
+    LPCWSTR /*pwzInfo*/
+    )
+{
+    HRESULT hr = S_OK;
+    //
+    //this isn't supported right now, we should support this for the SiteSearch scenario
+    return hr;
+}
+
+struct SCA_SSLBINDINGINFO
+{
+    IIS7_APPHOSTELEMENTCOMPARISON comparison;
+    LPCWSTR pwzStoreName;
+    LPCWSTR pwzEncodedCertificateHash;
+    HRESULT hr;
+};
+
+static BOOL AddSslCertificateToBindingCallback(IAppHostElement *pBindingElement, LPVOID pContext)
+{
+    HRESULT hr = S_OK;
+    VARIANT vtProp;
+    VariantInit(&vtProp);
+    SCA_SSLBINDINGINFO* pBindingInfo = (SCA_SSLBINDINGINFO*)pContext;
+    IAppHostMethodCollection *pAppHostMethodCollection = NULL;
+    IAppHostMethod *pAddSslMethod = NULL;
+    IAppHostMethodInstance *pAddSslMethodInstance = NULL;
+    IAppHostElement *pAddSslInput = NULL;
+    int iWsaError = 0;
+    WSADATA wsaData = {};
+    BOOL fWsaInitialized = FALSE;
+
+    // IIS's AddSslCertificate doesn't initialize WinSock on 2008 before using it to parse the IP
+    // Initialize before calling to workaround the failure.
+    iWsaError = WSAStartup(MAKEWORD(2, 2), &wsaData);
+    if (0 != iWsaError)
+    {
+        ExitOnWin32Error(iWsaError, hr, "Failed to initialize WinSock");
+    }
+
+    fWsaInitialized = TRUE;
+
+    if (Iis7IsMatchingAppHostElement(pBindingElement, &pBindingInfo->comparison))
+    {
+        hr = pBindingElement->get_Methods(&pAppHostMethodCollection);
+        ExitOnFailure(hr, "failed to get binding method collection");
+
+        hr = Iis7FindAppHostMethod(pAppHostMethodCollection, L"AddSslCertificate", &pAddSslMethod, NULL);
+        if (FAILED(hr))
+        {
+            WcaLog(LOGMSG_STANDARD, "The AddSslCertificate method is not supported by the binding element, SSL certificate will not be associated with the website");
+            ExitFunction();
+        }
+
+        pAddSslMethod->CreateInstance(&pAddSslMethodInstance);
+        ExitOnFailure(hr, "failed to create an instance of AddSslCertificate method");
+
+        pAddSslMethodInstance->get_Input(&pAddSslInput);
+        ExitOnFailure(hr, "failed to get input element of AddSslCertificate method");
+
+        Iis7PutPropertyString(pAddSslInput, IIS_CONFIG_CERTIFICATESTORENAME, pBindingInfo->pwzStoreName);
+        ExitOnFailure(hr, "failed to set certificateStoreName input parameter of AddSslCertificate method");
+
+        Iis7PutPropertyString(pAddSslInput, IIS_CONFIG_CERTIFICATEHASH, pBindingInfo->pwzEncodedCertificateHash);
+        ExitOnFailure(hr, "failed to set certificateHash input parameter of AddSslCertificate method");
+
+        hr = pAddSslMethodInstance->Execute();
+        ExitOnFailure(hr, "failed to execute AddSslCertificate method");
+    }
+LExit:
+    pBindingInfo->hr = hr;
+    ReleaseObject(pAppHostMethodCollection);
+    ReleaseObject(pAddSslMethod);
+    ReleaseObject(pAddSslMethodInstance);
+    ReleaseObject(pAddSslInput);
+    if (fWsaInitialized)
+    {
+        WSACleanup();
+    }
+
+    return FAILED(hr);
+}
+
+static HRESULT CreateSslBinding( IAppHostElement *pSiteElem, LPCWSTR pwzStoreName, LPCWSTR pwzEncodedCertificateHash)
+{
+    HRESULT hr = S_OK;
+    IAppHostChildElementCollection *pChildElems = NULL;
+    IAppHostElement *pBindingsElement = NULL;
+    IAppHostElementCollection *pBindingsCollection = NULL;
+    SCA_SSLBINDINGINFO bindingInfo = {};
+    VARIANT vtProp;
+    VariantInit(&vtProp);
+
+    hr = pSiteElem->get_ChildElements(&pChildElems);
+    ExitOnFailure(hr, "Failed get site child elements collection");
+
+    vtProp.vt = VT_BSTR;
+    vtProp.bstrVal = ::SysAllocString(IIS_CONFIG_BINDINGS);
+    hr = pChildElems->get_Item(vtProp, &pBindingsElement);
+    ExitOnFailure(hr, "Failed get bindings element");
+    ReleaseVariant(vtProp);
+
+    hr = pBindingsElement->get_Collection(&pBindingsCollection);
+    ExitOnFailure(hr, "Failed get bindings collection");
+
+    bindingInfo.comparison.sczElementName = IIS_CONFIG_BINDING;
+    bindingInfo.comparison.sczAttributeName = IIS_CONFIG_PROTOCOL;
+    vtProp.vt = VT_BSTR;
+    vtProp.bstrVal = ::SysAllocString(L"https");
+    bindingInfo.comparison.pvAttributeValue = &vtProp;
+    bindingInfo.pwzStoreName = pwzStoreName;
+    bindingInfo.pwzEncodedCertificateHash = pwzEncodedCertificateHash;
+
+    // Our current IISWebSiteCertificates schema does not allow specification of the website binding
+    // to associate the certificate with.  For now just associate it with all secure bindings.
+
+    hr = Iis7EnumAppHostElements(pBindingsCollection, AddSslCertificateToBindingCallback, &bindingInfo, NULL, NULL);
+    ExitOnFailure(hr, "Failed to enumerate bindings collection");
+    hr = bindingInfo.hr;
+    ExitOnFailure(hr, "Failed to add ssl binding");
+
+LExit:
+    ReleaseVariant(vtProp);
+
+    ReleaseObject(pChildElems);
+    ReleaseObject(pBindingsElement);
+    ReleaseObject(pBindingsCollection);
+
+    return hr;
+}
+
+static HRESULT DeleteSslBinding(
+    IAppHostElement * /*pSiteElem*/,
+    LPCWSTR /*pwzStoreName*/,
+    LPCWSTR /*pwzEncodedCertificateHash*/
+    )
+{
+    HRESULT hr = S_OK;
+    //
+    //this isn't supported right now, we should support this for the SiteSearch scenario
+    return hr;
+}
+
+static HRESULT DeleteAppPool( IAppHostWritableAdminManager *pAdminMgr,
+                            LPCWSTR swAppPoolName)
+{
+    HRESULT hr = S_OK;
+    IAppHostElement *pAppPools = NULL;
+    IAppHostElementCollection *pCollection = NULL;
+
+    hr = pAdminMgr->GetAdminSection(ScopeBSTR(IIS_CONFIG_APPPOOL_SECTION), ScopeBSTR(IIS_CONFIG_APPHOST_ROOT), &pAppPools);
+    ExitOnFailure(hr, "Failed get AppPools section");
+    ExitOnNull(pAppPools, hr, E_UNEXPECTED, "Failed get appPools section object");
+
+    hr = pAppPools->get_Collection( &pCollection);
+    ExitOnFailure(hr, "Failed get AppPools collection");
+
+    hr = DeleteCollectionElement(pCollection, IIS_CONFIG_ADD, IIS_CONFIG_NAME, swAppPoolName);
+    ExitOnFailure(hr, "Failed to delete app pool %ls", swAppPoolName);
+
+LExit:
+    ReleaseObject(pAppPools);
+    ReleaseObject(pCollection);
+
+    return hr;
+}
+
+static HRESULT CreateAppPool(
+    __inout LPWSTR *ppwzCustomActionData,
+    IAppHostWritableAdminManager *pAdminMgr,
+    LPCWSTR swAppPoolName
+    )
+{
+    HRESULT hr = S_OK;
+    IAppHostElement *pAppPools = NULL;
+    IAppHostElement *pAppPoolElement = NULL;
+    IAppHostElement *pElement = NULL;
+    IAppHostElement *pElement2 = NULL;
+    IAppHostElement *pElement3 = NULL;
+    IAppHostElementCollection *pCollection = NULL;
+    IAppHostElementCollection *pCollection2 = NULL;
+    int iAction = -1;
+    int iData   =  0;
+    LPWSTR pwzData = NULL;
+    WCHAR wcData[512];
+    WCHAR wcTime[60];
+    BOOL fFound = FALSE;
+
+    hr = pAdminMgr->GetAdminSection(ScopeBSTR(IIS_CONFIG_APPPOOL_SECTION), ScopeBSTR(IIS_CONFIG_APPHOST_ROOT), &pAppPools);
+    ExitOnFailure(hr, "Failed get AppPools section");
+    ExitOnNull(pAppPools, hr, ERROR_FILE_NOT_FOUND, "Failed get AppPools section object");
+
+    hr = pAppPools->get_Collection( &pCollection);
+    ExitOnFailure(hr, "Failed get AppPools collection");
+
+    hr = Iis7FindAppHostElementString(pCollection, IIS_CONFIG_ADD, IIS_CONFIG_NAME, swAppPoolName, &pAppPoolElement, NULL);
+    ExitOnFailure(hr, "Failed find AppPool element");
+    fFound = (NULL != pAppPoolElement);
+
+    if (!fFound)
+    {
+        hr = pCollection->CreateNewElement(ScopeBSTR(IIS_CONFIG_ADD), &pAppPoolElement);
+        ExitOnFailure(hr, "Failed create AppPool element");
+    }
+
+    hr = Iis7PutPropertyString(pAppPoolElement, IIS_CONFIG_NAME, swAppPoolName);
+    ExitOnFailure(hr, "Failed set AppPool name property");
+
+    //For WiX II6 /ABO compat we will default managedPipelineMode="Classic"
+    hr = Iis7PutPropertyString(pAppPoolElement, IIS_CONFIG_PIPELINEMODE, L"Classic");
+    ExitOnFailure(hr, "Failed set AppPool managedPipelineMode property");
+    //For WiX II6 /ABO compat we will be hardcoding autostart="true"
+    hr = Iis7PutPropertyString(pAppPoolElement, IIS_CONFIG_APPPOOL_AUTO, L"true");
+    ExitOnFailure(hr, "Failed set AppPool autoStart property");
+
+    if (!fFound)
+    {
+        hr = pCollection->AddElement(pAppPoolElement);
+        ExitOnFailure(hr, "Failed to add appPool element");
+    }
+
+    // Get AppPool Property action
+    hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iAction);
+    ExitOnFailure(hr, "Failed to read AppPool Property action");
+    while (IIS_APPPOOL_END != iAction)
+    {
+        //Process property action
+        switch (iAction)
+        {
+            case IIS_APPPOOL_RECYCLE_MIN :
+            {
+            // /recycling / periodicRestart | time
+                hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+                ExitOnFailure(hr, "Failed to read AppPool recycle min");
+                hr = pAppPoolElement->GetElementByName(ScopeBSTR(IIS_CONFIG_RECYCLING), &pElement);
+                ExitOnFailure(hr, "Failed to get AppPool recycling element");
+                hr = pElement->GetElementByName(ScopeBSTR(IIS_CONFIG_PEROIDRESTART), &pElement2);
+                ExitOnFailure(hr, "Failed to get AppPool periodicRestart element");
+                *wcTime = '\0';
+                ConvSecToHMS(iData * 60, wcTime, countof(wcTime));
+                hr = Iis7PutPropertyString(pElement2, IIS_CONFIG_TIME, wcTime);
+                ExitOnFailure(hr, "Failed to set AppPool periodicRestart time value");
+                ReleaseNullObject(pElement);
+                ReleaseNullObject(pElement2);
+                break;
+            }
+            case IIS_APPPOOL_RECYCLE_REQ :
+            {
+            // /recycling / periodicRestart | requests
+                hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+                ExitOnFailure(hr, "Failed to read AppPool recycle req");
+                hr = pAppPoolElement->GetElementByName(ScopeBSTR(IIS_CONFIG_RECYCLING), &pElement);
+                ExitOnFailure(hr, "Failed to get AppPool recycling element");
+                hr = pElement->GetElementByName(ScopeBSTR(IIS_CONFIG_PEROIDRESTART), &pElement2);
+                ExitOnFailure(hr, "Failed to get AppPool periodicRestart element");
+                hr = Iis7PutPropertyInteger(pElement2, IIS_CONFIG_REQUESTS, iData);
+                ExitOnFailure(hr, "Failed to set AppPool periodicRestart time value");
+                ReleaseNullObject(pElement);
+                ReleaseNullObject(pElement2);
+                break;
+            }
+            case IIS_APPPOOL_RECYCLE_TIMES :
+            {
+            // /recycling / periodicRestart | schedule
+                hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzData);
+                ExitOnFailure(hr, "Failed to read AppPool recycle times");
+                hr = pAppPoolElement->GetElementByName(ScopeBSTR(IIS_CONFIG_RECYCLING), &pElement);
+                ExitOnFailure(hr, "Failed to get AppPool recycling element");
+                hr = pElement->GetElementByName(ScopeBSTR(IIS_CONFIG_PEROIDRESTART), &pElement2);
+                ExitOnFailure(hr, "Failed to get AppPool periodicRestart element");
+                hr = pElement2->GetElementByName(ScopeBSTR(IIS_CONFIG_SCHEDULE), &pElement3);
+                ExitOnFailure(hr, "Failed to get AppPool schedule element");
+                hr = pElement3->get_Collection(&pCollection2);
+                ExitOnFailure(hr, "Failed to get AppPool schedule collection");
+
+                WCHAR wcDelim[] = L",";
+                const WCHAR *wszToken = NULL;
+                WCHAR *wszNextToken = NULL;
+                wszToken = wcstok_s( pwzData, wcDelim, &wszNextToken);
+
+                while (wszToken)
+                {
+                    *wcData = '\0';
+                    hr = ::StringCchCopyW(wcData, countof(wcData), wszToken);
+                    ExitOnFailure(hr, "failed to copy AppPool schedule");
+                    hr = ::StringCchCatW(wcData, countof(wcData), L":00");
+                    ExitOnFailure(hr, "failed to append AppPool schedule");
+
+                    hr = pCollection2->CreateNewElement(ScopeBSTR(IIS_CONFIG_ADD), &pElement3);
+                    ExitOnFailure(hr, "Failed to create AppPool schedule element");
+
+                    hr = Iis7PutPropertyString(pElement3, IIS_CONFIG_VALUE, wcData);
+                    ExitOnFailure(hr, "Failed to set AppPool schedule value");
+
+                    hr = pCollection2->AddElement(pElement3);
+                    if (hr == HRESULT_FROM_WIN32(ERROR_ALREADY_EXISTS))
+                    {
+                        //Eat this error, recycle time already exists NBD
+                        hr = S_OK;
+                    }
+                    ExitOnFailure(hr, "Failed to add win auth providers element");
+                    ReleaseNullObject(pElement3);
+                    wszToken = wcstok_s( NULL, wcDelim, &wszNextToken);
+                }
+                ReleaseNullObject(pElement);
+                ReleaseNullObject(pElement2);
+                ReleaseNullObject(pElement3);
+                ReleaseNullObject(pCollection2);
+                break;
+            }
+            case IIS_APPPOOL_RECYCLE_VIRMEM :
+            {
+            // /recycling / periodicRestart | memory
+                hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+                ExitOnFailure(hr, "Failed to read AppPool recycle vir memory");
+                hr = pAppPoolElement->GetElementByName(ScopeBSTR(IIS_CONFIG_RECYCLING), &pElement);
+                ExitOnFailure(hr, "Failed to get AppPool recycling element");
+                hr = pElement->GetElementByName(ScopeBSTR(IIS_CONFIG_PEROIDRESTART), &pElement2);
+                ExitOnFailure(hr, "Failed to get AppPool periodicRestart element");
+                hr = Iis7PutPropertyInteger(pElement2, IIS_CONFIG_MEMORY, iData);
+                ExitOnFailure(hr, "Failed to set AppPool periodicRestart memory");
+                ReleaseNullObject(pElement);
+                ReleaseNullObject(pElement2);
+                break;
+            }
+            case IIS_APPPOOL_RECYCLE_PRIVMEM :
+            {
+            // /recycling / periodicRestart | privateMemory
+                hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+                ExitOnFailure(hr, "Failed to read AppPool recycle priv mem");
+                hr = pAppPoolElement->GetElementByName(ScopeBSTR(IIS_CONFIG_RECYCLING), &pElement);
+                ExitOnFailure(hr, "Failed to get AppPool recycling element");
+                hr = pElement->GetElementByName(ScopeBSTR(IIS_CONFIG_PEROIDRESTART), &pElement2);
+                ExitOnFailure(hr, "Failed to get AppPool periodicRestart element");
+                hr = Iis7PutPropertyInteger(pElement2, IIS_CONFIG_PRIVMEMORY, iData);
+                ExitOnFailure(hr, "Failed to set AppPool periodicRestart private memory");
+                ReleaseNullObject(pElement);
+                ReleaseNullObject(pElement2);
+                break;
+            }
+            case IIS_APPPOOL_RECYCLE_IDLTIMEOUT :
+            {
+            //  /processModel | idleTimeout
+                hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+                ExitOnFailure(hr, "Failed to read AppPool idle timeout");
+                hr = pAppPoolElement->GetElementByName(ScopeBSTR(IIS_CONFIG_PROCESSMODEL), &pElement);
+                ExitOnFailure(hr, "Failed to get AppPool processModel element");
+                *wcTime = '\0';
+                ConvSecToHMS(iData * 60, wcTime, countof(wcTime));
+                hr = Iis7PutPropertyString(pElement, IIS_CONFIG_IDLETIMEOUT, wcTime);
+                ExitOnFailure(hr, "Failed to set AppPool processModel idle timeout value");
+                ReleaseNullObject(pElement);
+                break;
+            }
+            case IIS_APPPOOL_RECYCLE_QUEUELIMIT :
+            {
+            //  /applicationPools | queueLength
+                hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+                ExitOnFailure(hr, "Failed to read AppPool recycle queue limit");
+                hr = Iis7PutPropertyInteger(pAppPoolElement, IIS_CONFIG_QUEUELENGTH, iData);
+                ExitOnFailure(hr, "Failed to set AppPool recycle queue limit value");
+                break;
+            }
+            case IIS_APPPOOL_MAXPROCESS :
+            {
+            //  /processModel | maxProcesses
+                hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+                ExitOnFailure(hr, "Failed to read AppPool max processes");
+                hr = pAppPoolElement->GetElementByName(ScopeBSTR(IIS_CONFIG_PROCESSMODEL), &pElement);
+                ExitOnFailure(hr, "Failed to get AppPool processModel element");
+                hr = Iis7PutPropertyInteger(pElement, IIS_CONFIG_MAXWRKPROCESSES, iData);
+                ExitOnFailure(hr, "Failed to set AppPool processModel maxProcesses value");
+                ReleaseNullObject(pElement);
+                break;
+            }
+            case IIS_APPPOOL_IDENTITY :
+            {
+            //"LocalSystem" 0
+            //"LocalService" 1
+            //"NetworkService" 2
+            //"SpecificUser" 3
+            //"ApplicationPoolIdentity" 4
+            //  /processModel | identityType
+                hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+                ExitOnFailure(hr, "Failed to read AppPool identity");
+                hr = pAppPoolElement->GetElementByName(ScopeBSTR(IIS_CONFIG_PROCESSMODEL), &pElement);
+                ExitOnFailure(hr, "Failed to get AppPool processModel element");
+                if (iData == 0)
+                {
+                    hr = Iis7PutPropertyString(pElement, IIS_CONFIG_IDENITITYTYPE, IIS_CONFIG_LOCALSYSTEM);
+                }
+                else if (iData == 1)
+                {
+                    hr = Iis7PutPropertyString(pElement, IIS_CONFIG_IDENITITYTYPE, IIS_CONFIG_LOCALSERVICE);
+                }
+                else if (iData == 2)
+                {
+                    hr = Iis7PutPropertyString(pElement, IIS_CONFIG_IDENITITYTYPE, IIS_CONFIG_NETWORKSERVICE);
+                }
+                else if (iData == 3)
+                {
+                    hr = Iis7PutPropertyString(pElement, IIS_CONFIG_IDENITITYTYPE, IIS_CONFIG_SPECIFICUSER);
+                }
+                else if (iData == 4)
+                {
+                    hr = Iis7PutPropertyString(pElement, IIS_CONFIG_IDENITITYTYPE, IIS_CONFIG_APPLICATIONPOOLIDENTITY);
+                }
+                ExitOnFailure(hr, "Failed to set AppPool processModel identityType value");
+                ReleaseNullObject(pElement);
+                break;
+            }
+            case IIS_APPPOOL_USER :
+            {
+            //  /processModel | userName
+                hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzData);
+                ExitOnFailure(hr, "Failed to read AppPool user");
+                hr = pAppPoolElement->GetElementByName(ScopeBSTR(IIS_CONFIG_PROCESSMODEL), &pElement);
+                ExitOnFailure(hr, "Failed to get AppPool processModel element");
+                hr = Iis7PutPropertyString(pElement, IIS_CONFIG_USERNAME, pwzData);
+                ExitOnFailure(hr, "Failed to set AppPool processModel username value");
+                ReleaseNullObject(pElement);
+                break;
+            }
+            case IIS_APPPOOL_PWD :
+            {
+            //  /processModel | password
+                hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzData);
+                ExitOnFailure(hr, "Failed to read AppPool pwd");
+                hr = pAppPoolElement->GetElementByName(ScopeBSTR(IIS_CONFIG_PROCESSMODEL), &pElement);
+                ExitOnFailure(hr, "Failed to get AppPool processModel element");
+                hr = Iis7PutPropertyString(pElement, IIS_CONFIG_PASSWORD, pwzData);
+                ExitOnFailure(hr, "Failed to set AppPool processModel password value");
+                ReleaseNullObject(pElement);
+                break;
+            }
+            case  IIS_APPPOOL_RECYCLE_CPU_PCT:
+            {
+            // /cpu | limit
+                hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+                ExitOnFailure(hr, "Failed to read cpu pct");
+                hr = pAppPoolElement->GetElementByName(ScopeBSTR(IIS_CONFIG_CPU), &pElement);
+                ExitOnFailure(hr, "Failed to get AppPool cpu element");
+                // limit is maximum percentage of CPU time (in 1/1000ths of one percent)
+                hr = Iis7PutPropertyInteger(pElement, IIS_CONFIG_LIMIT, iData * 1000);
+                ExitOnFailure(hr, "Failed to set AppPool cpu limit");
+                ReleaseNullObject(pElement);
+                break;
+            }
+            case  IIS_APPPOOL_RECYCLE_CPU_REFRESH:
+            {
+            // /cpu | resetInterval
+                hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+                ExitOnFailure(hr, "Failed to read cpu refresh pwd");
+                hr = pAppPoolElement->GetElementByName(ScopeBSTR(IIS_CONFIG_CPU), &pElement);
+                ExitOnFailure(hr, "Failed to get AppPool cpu element");
+                *wcTime = '\0';
+                ConvSecToHMS(iData * 60, wcTime, countof(wcTime));
+                hr = Iis7PutPropertyString(pElement, IIS_CONFIG_RESETINTERVAL, wcTime);
+                ExitOnFailure(hr, "Failed to set AppPool cpu resetInterval value");
+                ReleaseNullObject(pElement);
+                break;
+            }
+            case  IIS_APPPOOL_RECYCLE_CPU_ACTION:
+            {
+            // /cpu | action
+            //"NoAction" 0
+            //"KillW3wp" 1
+                hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+                ExitOnFailure(hr, "Failed to read cpu action");
+                hr = pAppPoolElement->GetElementByName(ScopeBSTR(IIS_CONFIG_CPU), &pElement);
+                ExitOnFailure(hr, "Failed to get AppPool cpu element");
+                if (iData)
+                {
+                    hr = Iis7PutPropertyString(pElement, IIS_CONFIG_CPU_ACTION, IIS_CONFIG_KILLW3WP);
+                }
+                else
+                {
+                    hr = Iis7PutPropertyString(pElement, IIS_CONFIG_CPU_ACTION, IIS_CONFIG_NOACTION);
+                }
+                ExitOnFailure(hr, "Failed to set AppPool cpu action value");
+                ReleaseNullObject(pElement);
+                break;
+            }
+            case IIS_APPPOOL_32BIT:
+            {
+                hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iData);
+                ExitOnFailure(hr, "Failed to read enable32BitAppOnWin64 value");
+                //  enable32BitAppOnWin64
+                hr = Iis7PutPropertyBool(pAppPoolElement, IIS_CONFIG_ENABLE32, iData ? TRUE : FALSE);
+                ExitOnFailure(hr, "Failed to set AppPool enable32BitAppOnWin64 value");
+                break;
+            }
+            case IIS_APPPOOL_MANAGED_PIPELINE_MODE:
+            {
+                // managedPipelineMode
+                hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzData);
+                ExitOnFailure(hr, "Failed to read AppPool managedRuntimeVersion");
+                hr = Iis7PutPropertyString(pAppPoolElement, IIS_CONFIG_PIPELINEMODE, pwzData);
+                ExitOnFailure(hr, "Failed set AppPool managedPipelineMode property");
+                break;
+            }
+            case IIS_APPPOOL_MANAGED_RUNTIME_VERSION:
+            {
+                // managedRuntimeVersion
+                hr = WcaReadStringFromCaData(ppwzCustomActionData, &pwzData);
+                ExitOnFailure(hr, "Failed to read AppPool managedRuntimeVersion");
+                hr = Iis7PutPropertyString(pAppPoolElement, IIS_CONFIG_MANAGEDRUNTIMEVERSION, pwzData);
+                ExitOnFailure(hr, "Failed set AppPool managedRuntimeVersion property");
+                break;
+            }
+
+            default:
+            ExitOnFailure(hr = E_UNEXPECTED, "Unexpected IIS Config action specified for AppPool");
+            break;
+
+        }
+        // Get AppPool property action
+        hr = WcaReadIntegerFromCaData(ppwzCustomActionData, &iAction);
+        ExitOnFailure(hr, "Failed to read AppPool Property action");
+    }
+
+LExit:
+    ReleaseObject(pAppPools);
+    ReleaseObject(pCollection);
+    ReleaseObject(pCollection2);
+    ReleaseObject(pAppPoolElement);
+    ReleaseObject(pElement);
+    ReleaseObject(pElement2);
+    ReleaseObject(pElement3);
+
+    return hr;
+}
+
+static HRESULT SetDirPropAuthentications(IAppHostWritableAdminManager *pAdminMgr,
+                                         LPCWSTR wszConfigPath,
+                                         DWORD dwData)
+{
+    HRESULT hr = S_OK;
+    IAppHostElement *pSection = NULL;
+
+    //dwData contains bit flags for /security/authentication/<...>
+    // Anonymous    = 1
+    // Basic        = 2
+    // Windows      = 4
+    // Digest       =16
+    // Passport     =64  *not supported
+    //translation required from bit map to section name
+    // E.G security/authentication/windowsAuthentication [property enabled true|false]
+
+    // AnonymousAuthentication = 1
+    hr = pAdminMgr->GetAdminSection(ScopeBSTR(L"system.webServer/security/authentication/anonymousAuthentication"), ScopeBSTR(wszConfigPath), &pSection);
+    ExitOnFailure(hr, "Failed get AnonymousAuthentication section for DirProp");
+    if (!pSection)
+    {
+        hr = HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND);
+        ExitOnFailure(hr, "Failed get AnonymousAuthentication section object for DirProps");
+    }
+
+    hr = Iis7PutPropertyBool(pSection, L"enabled", (BOOL)(dwData & 0x1));
+    ExitOnFailure(hr, "Failed set AnonymousAuthentication enabled for DirProps");
+    ReleaseNullObject(pSection);
+
+    // basicAuthentication = 2
+    hr = pAdminMgr->GetAdminSection(ScopeBSTR(L"system.webServer/security/authentication/basicAuthentication"), ScopeBSTR(wszConfigPath), &pSection);
+    ExitOnFailure(hr, "Failed get basicAuthentication section for DirProp");
+    if (!pSection)
+    {
+        hr = HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND);
+        ExitOnFailure(hr, "Failed get basicAuthentication section object for DirProps");
+    }
+
+    hr = Iis7PutPropertyBool(pSection, L"enabled", (BOOL)(dwData & 0x2));
+    ExitOnFailure(hr, "Failed set basicAuthentication enabled for DirProps");
+    ReleaseNullObject(pSection);
+
+    // WindowsAuthentication = 4
+    hr = pAdminMgr->GetAdminSection(ScopeBSTR(L"system.webServer/security/authentication/windowsAuthentication"), ScopeBSTR(wszConfigPath), &pSection);
+    ExitOnFailure(hr, "Failed get windowsAuthentication section for DirProp");
+    if (!pSection)
+    {
+        hr = HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND);
+        ExitOnFailure(hr, "Failed get windowsAuthentication section object for DirProps");
+    }
+
+    hr = Iis7PutPropertyBool(pSection, L"enabled", (BOOL)(dwData & 0x4));
+    ExitOnFailure(hr, "Failed set windowsAuthentication enabled for DirProps");
+    ReleaseNullObject(pSection);
+
+    // digestAuthentication = 16
+    hr = pAdminMgr->GetAdminSection(ScopeBSTR(L"system.webServer/security/authentication/digestAuthentication"), ScopeBSTR(wszConfigPath), &pSection);
+    ExitOnFailure(hr, "Failed get digestAuthentication section for DirProp");
+    if (!pSection)
+    {
+        hr = HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND);
+        ExitOnFailure(hr, "Failed get digestAuthentication section object for DirProps");
+    }
+
+    hr = Iis7PutPropertyBool(pSection, L"enabled", (BOOL)(dwData & 0x10));
+    ExitOnFailure(hr, "Failed set digestAuthentication enabled for DirProps");
+    ReleaseNullObject(pSection);
+
+LExit:
+    ReleaseObject(pSection);
+
+    return hr;
+}
+
+static HRESULT SetDirPropAuthProvider(IAppHostWritableAdminManager *pAdminMgr,
+                                         LPCWSTR wszConfigPath,
+                                         __in LPWSTR wszData)
+{
+    HRESULT hr = S_OK;
+    IAppHostElement *pSection = NULL;
+    IAppHostElement *pElement = NULL;
+    IAppHostElement *pNewElement = NULL;
+    IAppHostElementCollection *pCollection = NULL;
+
+    WCHAR wcDelim[] = L",";
+    const WCHAR *wszToken = NULL;
+    WCHAR *wszNextToken = NULL;
+
+    hr = pAdminMgr->GetAdminSection(ScopeBSTR(L"system.webServer/security/authentication/windowsAuthentication"), ScopeBSTR(wszConfigPath), &pSection);
+    ExitOnFailure(hr, "Failed get windowsAuthentication section for DirProp providers");
+
+    hr = pSection->GetElementByName(ScopeBSTR(L"providers"), &pElement);
+    ExitOnFailure(hr, "Failed get win auth providers section");
+
+    hr = pElement->get_Collection(&pCollection);
+    ExitOnFailure(hr, "Failed get win auth providers collection");
+
+    hr = pCollection->Clear();
+    ExitOnFailure(hr, "Failed to clear win auth providers collection");
+
+    //Clear out inherited items - add clear
+    hr = pCollection->CreateNewElement(ScopeBSTR(IIS_CONFIG_CLEAR), &pNewElement);
+    ExitOnFailure(hr, "Failed to create win auth providers clear element");
+    hr = pCollection->AddElement(pNewElement);
+    ExitOnFailure(hr, "Failed to add win auth providers clear element");
+    ReleaseNullObject(pNewElement);
+
+    wszToken = wcstok_s( wszData, wcDelim, &wszNextToken);
+    for (int i = 0; (wszToken); ++i)
+    {
+        hr = pCollection->CreateNewElement(ScopeBSTR(IIS_CONFIG_ADD), &pNewElement);
+        ExitOnFailure(hr, "Failed to create win auth providers element");
+
+        hr = Iis7PutPropertyString( pNewElement, IIS_CONFIG_VALUE, wszToken);
+        ExitOnFailure(hr, "Failed to set win auth providers value");
+
+        hr = pCollection->AddElement(pNewElement, i);
+        ExitOnFailure(hr, "Failed to add win auth providers element");
+        ReleaseNullObject(pNewElement);
+
+        wszToken = wcstok_s( NULL, wcDelim, &wszNextToken);
+    }
+
+LExit:
+    ReleaseObject(pSection);
+    ReleaseObject(pCollection);
+    ReleaseObject(pElement);
+    ReleaseObject(pNewElement);
+
+    return hr;
+}
+
+static HRESULT SetDirPropDefDoc(
+    IAppHostWritableAdminManager *pAdminMgr,
+    LPCWSTR wszConfigPath,
+    __in LPWSTR wszData)
+{
+    HRESULT hr = S_OK;
+    IAppHostElement *pSection = NULL;
+    IAppHostElement *pElement = NULL;
+    IAppHostElement *pNewElement = NULL;
+    IAppHostElementCollection *pCollection = NULL;
+
+    WCHAR wcDelim[] = L",";
+    const WCHAR *wszToken = NULL;
+    WCHAR *wszNextToken = NULL;
+
+    hr = pAdminMgr->GetAdminSection(ScopeBSTR(IIS_CONFIG_DEFAULTDOC_SECTION), ScopeBSTR(wszConfigPath), &pSection);
+    ExitOnFailure(hr, "Failed get defaultDocument section for DirProp");
+
+    hr = pSection->GetElementByName(ScopeBSTR(L"files"), &pElement);
+    ExitOnFailure(hr, "Failed get win files section");
+
+    hr = pElement->get_Collection(&pCollection);
+    ExitOnFailure(hr, "Failed get files collection");
+
+    hr = pCollection->Clear();
+    ExitOnFailure(hr, "Failed clear files collection");
+
+    //Clear out inherited items - add clear
+    hr = pCollection->CreateNewElement(ScopeBSTR(IIS_CONFIG_CLEAR), &pNewElement);
+    ExitOnFailure(hr, "Failed to create files clear element");
+    hr = pCollection->AddElement(pNewElement);
+    ExitOnFailure(hr, "Failed to add files clear element");
+
+    wszToken = wcstok_s( wszData, wcDelim, &wszNextToken);
+    for (int i = 0; (wszToken); ++i)
+    {
+        hr = pCollection->CreateNewElement(ScopeBSTR(IIS_CONFIG_ADD), &pNewElement);
+        ExitOnFailure(hr, "Failed to create win auth providers element");
+
+        hr = Iis7PutPropertyString( pNewElement, IIS_CONFIG_VALUE, wszToken);
+        ExitOnFailure(hr, "Failed to set win auth providers value");
+
+        hr = pCollection->AddElement(pNewElement, i);
+        ExitOnFailure(hr, "Failed to add defaultDocument Files element");
+        ReleaseNullObject(pNewElement);
+
+        wszToken = wcstok_s( NULL, wcDelim, &wszNextToken);
+    }
+
+LExit:
+    ReleaseObject(pSection);
+    ReleaseObject(pCollection);
+    ReleaseObject(pNewElement);
+
+    return hr;
+}
+
+static HRESULT ClearLocationTag(
+    IAppHostWritableAdminManager *pAdminMgr,
+    LPCWSTR swLocationPath
+    )
+{
+    HRESULT hr = S_OK;
+    IAppHostConfigManager *pConfigMgr = NULL;
+    IAppHostConfigFile    *pConfigFile = NULL;
+    IAppHostConfigLocationCollection *pLocationCollection = NULL;
+    IAppHostConfigLocation *pLocation = NULL;
+
+    DWORD dwCount = 0;
+    BSTR bstrLocationPath = NULL;
+
+    hr = pAdminMgr->get_ConfigManager(&pConfigMgr);
+    ExitOnFailure(hr, "Failed to get IIS ConfigManager interface");
+
+    hr = pConfigMgr->GetConfigFile(ScopeBSTR(IIS_CONFIG_APPHOST_ROOT), &pConfigFile);
+    ExitOnFailure(hr, "Failed to get IIS ConfigFile interface");
+
+    hr = pConfigFile->get_Locations(&pLocationCollection);
+    ExitOnFailure(hr, "Failed to get IIS location tag collection");
+
+    hr = pLocationCollection->get_Count(&dwCount);
+    ExitOnFailure(hr, "Failed to get IIS location collection count");
+
+    VARIANT vtIndex;
+    vtIndex.vt = VT_UI4;
+    for (DWORD i = 0; i < dwCount; ++i)
+    {
+        vtIndex.ulVal = i;
+        hr = pLocationCollection->get_Item(vtIndex, &pLocation);
+        ExitOnFailure(hr, "Failed to get IIS location collection count");
+
+        hr = pLocation->get_Path(&bstrLocationPath);
+        if (CSTR_EQUAL == ::CompareStringW(LOCALE_INVARIANT, NORM_IGNORECASE, swLocationPath, -1, bstrLocationPath, -1))
+        {
+            hr = pLocationCollection->DeleteLocation(vtIndex);
+            ExitOnFailure(hr, "Failed to delete IIS location tag %ls",swLocationPath);
+            break;
+        }
+
+        ReleaseNullObject(pLocation);
+        ::SysFreeString(bstrLocationPath);
+        bstrLocationPath = NULL;
+    }
+LExit:
+    ReleaseObject(pConfigMgr);
+    ReleaseObject(pConfigFile);
+    ReleaseObject(pLocationCollection);
+    ReleaseObject(pLocation);
+    ReleaseBSTR(bstrLocationPath);
+
+    return hr;
+
+}
+
+static HRESULT DeleteCollectionElement(
+    __in IAppHostElementCollection *pCollection,
+    __in LPCWSTR pwzElementName,
+    __in LPCWSTR pwzAttributeName,
+    __in LPCWSTR pwzAttributeValue
+    )
+{
+    HRESULT hr = S_OK;
+
+    DWORD dwIndex;
+    VARIANT vtIndex;
+    VariantInit(&vtIndex);
+
+    hr = Iis7FindAppHostElementString(pCollection, pwzElementName, pwzAttributeName, pwzAttributeValue, NULL, &dwIndex);
+    ExitOnFailure(hr, "Failed while finding IAppHostElement %ls/@%ls=%ls", pwzElementName, pwzAttributeName, pwzAttributeValue);
+
+    if (MAXDWORD != dwIndex)
+    {
+        vtIndex.vt = VT_UI4;
+        vtIndex.ulVal = dwIndex;
+        hr = pCollection->DeleteElement(vtIndex);
+        ExitOnFailure(hr, "Failed to delete IAppHostElement %ls/@%ls=%ls", pwzElementName, pwzAttributeName, pwzAttributeValue);
+    }
+    // else : nothing to do, already deleted
+LExit:
+    ReleaseVariant(vtIndex);
+
+    return hr;
+}
+static void ConvSecToHMS( int Sec,  __out_ecount(cchDest) LPWSTR wcTime, size_t cchDest)
+{
+    int ZH, ZM, ZS = 0;
+
+    ZH = (Sec / 3600);
+    Sec = Sec - ZH * 3600;
+    ZM = (Sec / 60) ;
+    Sec = Sec - ZM * 60;
+    ZS = Sec ;
+
+    HRESULT hr = ::StringCchPrintfW(wcTime, cchDest, L"%02d:%02d:%02d", ZH, ZM, ZS);
+    if (S_OK != hr)
+    {
+        *wcTime = '\0';
+    }
+}
+static void ConvSecToDHMS( unsigned int Sec,  __out_ecount(cchDest) LPWSTR wcTime, size_t cchDest)
+{
+    int ZD, ZH, ZM, ZS = 0;
+
+    ZD = Sec / 86400;
+    Sec = Sec - ZD * 86400;
+    ZH = (Sec / 3600);
+    Sec = Sec - ZH * 3600;
+    ZM = (Sec / 60) ;
+    Sec = Sec - ZM * 60;
+    ZS = Sec ;
+
+    HRESULT hr = ::StringCchPrintfW(wcTime, cchDest, L"%d.%02d:%02d:%02d", ZD, ZH, ZM, ZS);
+    if (S_OK != hr)
+    {
+        *wcTime = '\0';
+    }
+}
diff --git a/src/ca/scaexecIIS7.h b/src/ca/scaexecIIS7.h
new file mode 100644
index 00000000..ec31f202
--- /dev/null
+++ b/src/ca/scaexecIIS7.h
@@ -0,0 +1,5 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+HRESULT IIS7ConfigChanges(MSIHANDLE hInstall, __inout LPWSTR pwzData);
diff --git a/src/ca/scafilter.cpp b/src/ca/scafilter.cpp
new file mode 100644
index 00000000..9d9014fd
--- /dev/null
+++ b/src/ca/scafilter.cpp
@@ -0,0 +1,510 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+// prototypes
+static HRESULT ReadFilterLoadOrder(
+    __in IMSAdminBase* piMetabase,
+    __in LPCWSTR wzFilterRoot,
+    __out LPWSTR *ppwzLoadOrder
+    );
+static HRESULT AddFilterToLoadOrder(
+    __in LPCWSTR wzFilter,
+    __in int iLoadOrder,
+    __inout LPWSTR *ppwzLoadOrder
+    );
+static HRESULT RemoveFilterFromLoadOrder(
+    __in LPCWSTR wzFilter,
+    __inout LPWSTR *ppwzLoadOrder
+    );
+
+
+UINT __stdcall ScaFiltersRead(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_WEB* pswList,
+    __in WCA_WRAPQUERY_HANDLE hWebBaseQuery,
+    __inout SCA_FILTER** ppsfList,
+    __inout LPWSTR *ppwzCustomActionData
+    )
+{
+    HRESULT hr = S_OK;
+    MSIHANDLE hRec;
+    INSTALLSTATE isInstalled = INSTALLSTATE_UNKNOWN;
+    INSTALLSTATE isAction = INSTALLSTATE_UNKNOWN;
+
+    LPWSTR pwzData = NULL;
+
+    SCA_FILTER* psf = NULL;
+    WCA_WRAPQUERY_HANDLE hWrapQuery = NULL;
+
+    hr = WcaBeginUnwrapQuery(&hWrapQuery, ppwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap query for ScaAppPoolRead");
+
+    if (0 == WcaGetQueryRecords(hWrapQuery))
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping ScaFiltersRead() - no IIsFilter table");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    // loop through all the filters
+    while (S_OK == (hr = WcaFetchWrappedRecord(hWrapQuery, &hRec)))
+    {
+        // Get the Component first.  If the component is not being modified during
+        // this transaction, skip processing this whole record.
+        hr = WcaGetRecordString(hRec, fqComponent, &pwzData);
+        ExitOnFailure(hr, "failed to get IIsFilter.Component");
+
+        hr = WcaGetRecordInteger(hRec, fqInstalled, (int *)&isInstalled);
+        ExitOnFailure(hr, "Failed to get Component installed state for IIs filter");
+
+        hr = WcaGetRecordInteger(hRec, fqAction, (int *)&isAction);
+        ExitOnFailure(hr, "Failed to get Component action state for IIs filter");
+
+        if (!WcaIsInstalling(isInstalled, isAction) &&
+            !WcaIsReInstalling(isInstalled, isAction) &&
+            !WcaIsUninstalling(isInstalled, isAction))
+        {
+            continue; // skip this record.
+        }
+
+        hr = AddFilterToList(ppsfList);
+        ExitOnFailure(hr, "failed to add filter to list");
+
+        psf = *ppsfList;
+
+        hr = ::StringCchCopyW(psf->wzComponent, countof(psf->wzComponent), pwzData);
+        ExitOnFailure(hr, "failed to copy component name: %ls", pwzData);
+
+        psf->isInstalled = isInstalled;
+        psf->isAction = isAction;
+
+        hr = WcaGetRecordString(hRec, fqWeb, &pwzData);
+        ExitOnFailure(hr, "Failed to get Web for VirtualDir");
+
+        if (*pwzData)
+        {
+            hr = ScaWebsGetBase(piMetabase, pswList, pwzData, psf->wzWebBase, countof(psf->wzWebBase), hWebBaseQuery);
+            if (FAILED(hr) && WcaIsUninstalling(isInstalled, isAction))
+            {
+                // If we're uninstalling, don't bother finding the existing web, just leave the filter root empty
+                hr = S_OK;
+            }
+            ExitOnFailure(hr, "Failed to get base of web for Filter");
+
+            if (0 != lstrlenW(psf->wzWebBase))
+            {
+                hr = ::StringCchPrintfW(psf->wzFilterRoot, countof(psf->wzFilterRoot), L"%s/Filters", psf->wzWebBase);
+                ExitOnFailure(hr, "Failed to allocate filter base string");
+            }
+        }
+        else
+        {
+            hr = ::StringCchCopyW(psf->wzFilterRoot, countof(psf->wzFilterRoot), L"/LM/W3SVC/Filters");
+            ExitOnFailure(hr, "Failed to allocate global filter base string");
+        }
+
+        // filter key
+        hr = WcaGetRecordString(hRec, fqFilter, &pwzData);
+        ExitOnFailure(hr, "Failed to get Filter.Filter");
+        hr = ::StringCchCopyW(psf->wzKey, countof(psf->wzKey), pwzData);
+        ExitOnFailure(hr, "Failed to copy key string to filter object");
+
+        // filter path
+        hr = WcaGetRecordString(hRec, fqPath, &pwzData);
+        ExitOnFailure(hr, "Failed to get Filter.Path");
+        hr = ::StringCchCopyW(psf->wzPath, countof(psf->wzPath), pwzData);
+        ExitOnFailure(hr, "Failed to copy path string to filter object");
+
+        // filter description
+        hr = WcaGetRecordString(hRec, fqDescription, &pwzData);
+        ExitOnFailure(hr, "Failed to get Filter.Description");
+        hr = ::StringCchCopyW(psf->wzDescription, countof(psf->wzDescription), pwzData);
+        ExitOnFailure(hr, "Failed to copy description string to filter object");
+
+        // filter flags
+        hr = WcaGetRecordInteger(hRec, fqFlags, &psf->iFlags);
+        ExitOnFailure(hr, "Failed to get Filter.Flags");
+
+        // filter load order
+        hr = WcaGetRecordInteger(hRec, fqLoadOrder, &psf->iLoadOrder);
+        ExitOnFailure(hr, "Failed to get Filter.LoadOrder");
+    }
+
+    if (E_NOMOREITEMS == hr)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "Failure while processing filters");
+
+LExit:
+    WcaFinishUnwrapQuery(hWrapQuery);
+
+    ReleaseStr(pwzData);
+    return hr;
+}
+
+
+HRESULT ScaFiltersInstall(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_FILTER* psfList
+    )
+{
+    HRESULT hr = S_OK;
+    SCA_FILTER* psf = psfList;
+    LPCWSTR wzPreviousFilterRoot = NULL;
+    LPWSTR pwzLoadOrder = NULL;
+
+    while (psf)
+    {
+        if (WcaIsInstalling(psf->isInstalled, psf->isAction))
+        {
+            if (!wzPreviousFilterRoot || CSTR_EQUAL != ::CompareStringW(LOCALE_INVARIANT, 0, wzPreviousFilterRoot, -1, psf->wzFilterRoot, -1))
+            {
+                if (pwzLoadOrder)
+                {
+                    hr = ScaWriteMetabaseValue(piMetabase, wzPreviousFilterRoot, L"", MD_FILTER_LOAD_ORDER, METADATA_NO_ATTRIBUTES, IIS_MD_UT_SERVER, STRING_METADATA, (LPVOID)pwzLoadOrder);
+                    ExitOnFailure(hr, "Failed to write filter load order to metabase");
+
+                    ReleaseNullStr(pwzLoadOrder);
+                }
+
+                hr = ReadFilterLoadOrder(piMetabase, psf->wzFilterRoot, &pwzLoadOrder);
+                ExitOnFailure(hr, "Failed to read filter load order.");
+
+                wzPreviousFilterRoot = psf->wzFilterRoot;
+            }
+
+            hr = ScaCreateMetabaseKey(piMetabase, psf->wzFilterRoot, psf->wzKey);
+            ExitOnFailure(hr, "Failed to create key for filter '%ls'", psf->wzKey);
+
+            hr = ScaWriteMetabaseValue(piMetabase, psf->wzFilterRoot, psf->wzKey, MD_KEY_TYPE, METADATA_NO_ATTRIBUTES, IIS_MD_UT_SERVER, STRING_METADATA, (LPVOID)L"IIsFilter");
+            ExitOnFailure(hr, "Failed to write key type for filter '%ls'", psf->wzKey);
+
+            // filter path
+            hr = ScaWriteMetabaseValue(piMetabase, psf->wzFilterRoot, psf->wzKey, MD_FILTER_IMAGE_PATH, METADATA_NO_ATTRIBUTES, IIS_MD_UT_SERVER, STRING_METADATA, (LPVOID)psf->wzPath);
+            ExitOnFailure(hr, "Failed to write Path for filter '%ls'", psf->wzKey);
+
+            // filter description
+            hr = ScaWriteMetabaseValue(piMetabase, psf->wzFilterRoot, psf->wzKey, MD_FILTER_DESCRIPTION, METADATA_NO_ATTRIBUTES, IIS_MD_UT_SERVER, STRING_METADATA, (LPVOID)psf->wzDescription);
+            ExitOnFailure(hr, "Failed to write Description for filter '%ls'", psf->wzKey);
+
+            // filter flags
+            if (MSI_NULL_INTEGER != psf->iFlags)
+            {
+                hr = ScaWriteMetabaseValue(piMetabase, psf->wzFilterRoot, psf->wzKey, MD_FILTER_FLAGS, METADATA_NO_ATTRIBUTES, IIS_MD_UT_SERVER, DWORD_METADATA, (LPVOID)((DWORD_PTR)psf->iFlags));
+                ExitOnFailure(hr, "Failed to write Flags for filter '%ls'", psf->wzKey);
+            }
+
+            // filter load order
+            if (MSI_NULL_INTEGER != psf->iLoadOrder)
+            {
+                hr = AddFilterToLoadOrder(psf->wzKey, psf->iLoadOrder, &pwzLoadOrder);
+                ExitOnFailure(hr, "Failed to add filter '%ls' to load order.", psf->wzKey);
+            }
+        }
+
+        psf = psf->psfNext;
+    }
+
+    if (pwzLoadOrder)
+    {
+        Assert(wzPreviousFilterRoot && *wzPreviousFilterRoot);
+
+        hr = ScaWriteMetabaseValue(piMetabase, wzPreviousFilterRoot, L"", MD_FILTER_LOAD_ORDER, METADATA_NO_ATTRIBUTES, IIS_MD_UT_SERVER, STRING_METADATA, (LPVOID)pwzLoadOrder);
+        ExitOnFailure(hr, "Failed to write filter load order to metabase");
+    }
+
+LExit:
+    ReleaseStr(pwzLoadOrder);
+    return hr;
+}
+
+
+HRESULT ScaFiltersUninstall(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_FILTER* psfList
+    )
+{
+    HRESULT hr = S_OK;
+    SCA_FILTER* psf = psfList;
+    LPCWSTR wzPreviousFilterRoot = NULL;
+    LPWSTR pwzLoadOrder = NULL;
+
+    while (psf)
+    {
+        if (WcaIsUninstalling(psf->isInstalled, psf->isAction))
+        {
+            if (!wzPreviousFilterRoot || CSTR_EQUAL != ::CompareStringW(LOCALE_INVARIANT, 0, wzPreviousFilterRoot, -1, psf->wzFilterRoot, -1))
+            {
+                if (pwzLoadOrder)
+                {
+                    hr = ScaWriteMetabaseValue(piMetabase, wzPreviousFilterRoot, L"", MD_FILTER_LOAD_ORDER, METADATA_NO_ATTRIBUTES, IIS_MD_UT_SERVER, STRING_METADATA, (LPVOID)pwzLoadOrder);
+                    ExitOnFailure(hr, "Failed to write filter load order to metabase");
+
+                    ReleaseNullStr(pwzLoadOrder);
+                }
+
+                hr = ReadFilterLoadOrder(piMetabase, psf->wzFilterRoot, &pwzLoadOrder);
+                ExitOnFailure(hr, "Failed to read filter load order.");
+
+                wzPreviousFilterRoot = psf->wzFilterRoot;
+            }
+
+            hr = RemoveFilterFromLoadOrder(psf->wzKey, &pwzLoadOrder);
+            ExitOnFailure(hr, "Failed to remove filter '%ls' from load order", psf->wzKey);
+
+            // remove the filter from the load order and remove the filter's key
+            if (0 != lstrlenW(psf->wzFilterRoot))
+            {
+                hr = ScaDeleteMetabaseKey(piMetabase, psf->wzFilterRoot, psf->wzKey);
+                ExitOnFailure(hr, "Failed to remove web '%ls' from metabase", psf->wzKey);
+            }
+        }
+
+        psf = psf->psfNext;
+    }
+
+    if (pwzLoadOrder)
+    {
+        Assert(wzPreviousFilterRoot && *wzPreviousFilterRoot);
+
+        hr = ScaWriteMetabaseValue(piMetabase, wzPreviousFilterRoot, L"", MD_FILTER_LOAD_ORDER, METADATA_NO_ATTRIBUTES, IIS_MD_UT_SERVER, STRING_METADATA, (LPVOID)pwzLoadOrder);
+        ExitOnFailure(hr, "Failed to write filter load order to metabase");
+    }
+
+LExit:
+    return hr;
+}
+
+
+void ScaFiltersFreeList(
+    __in SCA_FILTER* psfList
+    )
+{
+    SCA_FILTER* psfDelete = psfList;
+    while (psfList)
+    {
+        psfDelete = psfList;
+        psfList = psfList->psfNext;
+
+        MemFree(psfDelete);
+    }
+}
+
+HRESULT AddFilterToList(
+    __inout SCA_FILTER** ppsfList)
+{
+    HRESULT hr = S_OK;
+    SCA_FILTER* psf = static_cast<SCA_FILTER*>(MemAlloc(sizeof(SCA_FILTER), TRUE));
+    ExitOnNull(psf, hr, E_OUTOFMEMORY, "failed to add filter to filter list");
+
+    psf->psfNext = *ppsfList;
+    *ppsfList = psf;
+
+LExit:
+    return hr;
+}
+
+// private helper functions
+
+
+static HRESULT ReadFilterLoadOrder(
+    __in IMSAdminBase* piMetabase,
+    __in LPCWSTR wzFilterRoot,
+    __out LPWSTR *ppwzLoadOrder
+    )
+{
+    HRESULT hr = S_OK;
+    METADATA_HANDLE mhRoot = NULL;
+
+    METADATA_RECORD mr;
+    DWORD dwRequired = 0;
+    DWORD cchData = 255;
+
+    ::ZeroMemory(&mr, sizeof(mr));
+    mr.dwMDIdentifier = MD_FILTER_LOAD_ORDER;
+    mr.dwMDAttributes = METADATA_NO_ATTRIBUTES;
+    mr.dwMDUserType = IIS_MD_UT_SERVER;
+    mr.dwMDDataType = ALL_METADATA;
+    mr.dwMDDataLen = cchData;
+    mr.pbMDData = static_cast<BYTE*>(MemAlloc(mr.dwMDDataLen * sizeof(WCHAR), TRUE));
+    ExitOnNull(mr.pbMDData, hr, E_OUTOFMEMORY, "failed to allocate memory for MDData in metadata record");
+
+    hr = piMetabase->OpenKey(METADATA_MASTER_ROOT_HANDLE, wzFilterRoot, METADATA_PERMISSION_READ | METADATA_PERMISSION_WRITE, 10, &mhRoot);
+    for (int i = 30; i > 0 && HRESULT_FROM_WIN32(ERROR_PATH_BUSY) == hr; i--)
+    {
+        ::Sleep(1000);
+        WcaLog(LOGMSG_STANDARD, "Failed to open root key, retrying %d time(s)...", i);
+        hr = piMetabase->OpenKey(METADATA_MASTER_ROOT_HANDLE, wzFilterRoot, METADATA_PERMISSION_READ | METADATA_PERMISSION_WRITE, 10, &mhRoot);
+    }
+
+    if (SUCCEEDED(hr))
+    {
+        hr = piMetabase->GetData(mhRoot, L"", &mr, &dwRequired);
+        if (HRESULT_FROM_WIN32(ERROR_INSUFFICIENT_BUFFER) == hr)
+        {
+            mr.dwMDDataLen = cchData = dwRequired;
+
+            LPVOID pv = MemReAlloc(mr.pbMDData, mr.dwMDDataLen * sizeof(WCHAR), TRUE);
+            ExitOnNull(pv, hr, E_OUTOFMEMORY, "failed to allocate memory for MDData in metadata record");
+            mr.pbMDData = static_cast<BYTE*>(pv);
+
+            hr = piMetabase->GetData(mhRoot, L"", &mr, &dwRequired);
+        }
+    }
+
+    // The /Filters node or /Filters/FilterLoadOrder property might not exist (yet).
+    if (HRESULT_FROM_WIN32(ERROR_PATH_NOT_FOUND) == hr || MD_ERROR_DATA_NOT_FOUND == hr)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "Failed to get filter load order.");
+
+    hr = StrAllocString(ppwzLoadOrder, reinterpret_cast<LPCWSTR>(mr.pbMDData), 0);
+    ExitOnFailure(hr, "Failed to allocate string for filter load order.");
+
+LExit:
+    ReleaseMem(mr.pbMDData);
+
+    if (mhRoot)
+    {
+        piMetabase->CloseKey(mhRoot);
+    }
+
+    return hr;
+}
+
+
+static HRESULT AddFilterToLoadOrder(
+    __in LPCWSTR wzFilter,
+    __in int iLoadOrder,
+    __inout LPWSTR *ppwzLoadOrder
+    )
+{
+    HRESULT hr = S_OK;
+    LPCWSTR wzLoadOrder = *ppwzLoadOrder;
+    int cchFilter = lstrlenW(wzFilter);
+    LPWSTR pwzTemp = NULL;
+
+    // If the filter name ends with '\0' or ',' and
+    // the filter name begins at the beginning of the list or with ','
+    // Then we've found the exact filter by name.
+    //
+    // If the filter isn't already in the load order, add it
+    if (wzLoadOrder && *wzLoadOrder)
+    {
+        LPCWSTR pwz = wcsstr(wzLoadOrder, wzFilter);
+
+        if (NULL != pwz &&
+            (L'\0' == *(pwz + cchFilter) || L',' == *(pwz + cchFilter)) &&
+            (pwz == wzLoadOrder || L',' == *(pwz - 1)))
+        {
+            // Filter already in the load order, no work to do.
+        }
+        else
+        {
+            pwz = NULL;
+            if (0 <= iLoadOrder)
+            {
+                pwz = wzLoadOrder;
+                for (int i = 0; i < iLoadOrder && pwz; ++i)
+                {
+                    pwz = wcsstr(pwz, L",");
+                }
+            }
+
+            if (NULL == pwz) // put the filter at the end of the order
+            {
+                Assert(wzLoadOrder && *wzLoadOrder);
+
+                // tack on a comma since there are other filters in the order
+                hr = StrAllocConcat(ppwzLoadOrder, L",", 1);
+                ExitOnFailure(hr, "Failed to append a comma to filter load order.");
+
+                hr = StrAllocConcat(ppwzLoadOrder, wzFilter, cchFilter);
+                ExitOnFailure(hr, "Failed to append the filter on to the load order.");
+            }
+            else if (L',' == *pwz) // put the filter in the middle of the order
+            {
+                hr = StrAllocString(&pwzTemp, wzLoadOrder, pwz - wzLoadOrder + 1);
+                ExitOnFailure(hr, "Failed to copy first half of filter load order to temp string.");
+
+                hr = StrAllocConcat(&pwzTemp, wzFilter, 0);
+                ExitOnFailure(hr, "Failed to copy filter into load order.");
+
+                hr = StrAllocConcat(&pwzTemp, pwz, 0);
+                ExitOnFailure(hr, "Failed to copy remaining filter load order back onto load order.");
+
+                hr = StrAllocString(ppwzLoadOrder, pwzTemp, 0);
+                ExitOnFailure(hr, "Failed to copy temp string to load order string.");
+            }
+            else // put the filter at the beginning of the order
+            {
+                hr = StrAllocPrefix(ppwzLoadOrder, L",", 1);
+                ExitOnFailure(hr, "Failed to prepend a comma to filter load order.");
+
+                hr = StrAllocPrefix(ppwzLoadOrder, wzFilter, cchFilter);
+                ExitOnFailure(hr, "Failed to prepend the filter on to the load order.");
+            }
+        }
+    }
+    else
+    {
+        hr = StrAllocString(ppwzLoadOrder, wzFilter, cchFilter);
+        ExitOnFailure(hr, "Failed to add filter to load order.");
+    }
+
+LExit:
+    ReleaseStr(pwzTemp);
+    return hr;
+}
+
+
+static HRESULT RemoveFilterFromLoadOrder(
+    __in LPCWSTR wzFilter,
+    __inout LPWSTR *ppwzLoadOrder
+    )
+{
+    HRESULT hr = S_OK;
+    int cchFilter = lstrlenW(wzFilter);
+
+    LPCWSTR pwzStart = NULL;
+    LPWSTR pwzFind = NULL;
+
+    pwzStart = pwzFind = *ppwzLoadOrder;
+    while (NULL != (pwzFind = wcsstr(pwzFind, wzFilter)))
+    {
+        // Make sure to only match [wzFilter] and NOT foo[wzFilter]bar
+        if (pwzFind == pwzStart || L',' == *(pwzFind - 1))
+        {
+            int cchRemainder = lstrlenW(pwzFind) - cchFilter + 1; // add one to include the null terminator
+
+            if (L'\0' == *(pwzFind + cchFilter))
+            {
+                if (pwzFind == pwzStart)
+                {
+                    memmove(pwzFind, pwzFind + cchFilter, cchRemainder * sizeof(WCHAR)); // copy down the null terminator
+                }
+                else
+                {
+                    memmove(pwzFind - 1, pwzFind + cchFilter, cchRemainder * sizeof(WCHAR)); // copy down the null terminator over top the trailing ","
+                }
+            }
+            else if (L',' == *(pwzFind + cchFilter))
+            {
+                memmove(pwzFind, pwzFind + cchFilter + 1, (cchRemainder - 1) * sizeof(WCHAR)); // skip copying the ","
+            }
+            else // skip past the partial match
+            {
+                pwzFind = pwzFind + cchFilter;
+            }
+        }
+        else // skip past the partial match
+        {
+            pwzFind = pwzFind + cchFilter;
+        }
+    }
+
+//LExit:
+    return hr;
+}
diff --git a/src/ca/scafilter.h b/src/ca/scafilter.h
new file mode 100644
index 00000000..d072bf22
--- /dev/null
+++ b/src/ca/scafilter.h
@@ -0,0 +1,46 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+#include "scaweb.h"
+
+enum eFilterQuery { fqWeb = 1, fqFilter, fqComponent , fqPath, fqDescription, fqFlags, fqLoadOrder, fqInstalled, fqAction };
+
+struct SCA_FILTER
+{
+        // darwin information
+        WCHAR wzKey[MAX_DARWIN_KEY + 1];
+        WCHAR wzComponent[MAX_DARWIN_KEY + 1];
+        INSTALLSTATE isInstalled;
+        INSTALLSTATE isAction;
+
+        // metabase information
+        WCHAR wzWebKey[MAX_DARWIN_KEY + 1];
+        WCHAR wzWebBase[METADATA_MAX_NAME_LEN + 1];
+        WCHAR wzFilterRoot[METADATA_MAX_NAME_LEN + 1];
+
+        // iis configuation information
+        WCHAR wzPath[MAX_PATH];
+        WCHAR wzDescription[MAX_DARWIN_COLUMN + 1];
+        int iFlags;
+        int iLoadOrder;
+
+        SCA_FILTER* psfNext;
+};
+
+
+// prototypes
+HRESULT AddFilterToList(
+    __in SCA_FILTER** ppsfList
+    );
+
+UINT __stdcall ScaFiltersRead(IMSAdminBase* piMetabase,
+                              SCA_WEB* pswList, __in WCA_WRAPQUERY_HANDLE hWebBaseQuery, SCA_FILTER** ppsfList,
+                              __inout LPWSTR *ppwzCustomActionData);
+
+HRESULT ScaFiltersInstall(IMSAdminBase* piMetabase, SCA_FILTER* psfList);
+
+HRESULT ScaFiltersUninstall(IMSAdminBase* piMetabase, SCA_FILTER* psfList);
+
+void ScaFiltersFreeList(SCA_FILTER* psfList);
+
diff --git a/src/ca/scafilter7.cpp b/src/ca/scafilter7.cpp
new file mode 100644
index 00000000..dda91c4d
--- /dev/null
+++ b/src/ca/scafilter7.cpp
@@ -0,0 +1,284 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+static HRESULT WriteFilter(const SCA_FILTER* psf);
+
+UINT __stdcall ScaFiltersRead7(
+    __in SCA_WEB7* pswList,
+    __in WCA_WRAPQUERY_HANDLE /*hWebBaseQuery*/,
+    __inout SCA_FILTER** ppsfList,
+    __inout LPWSTR *ppwzCustomActionData
+    )
+{
+    HRESULT hr = S_OK;
+    MSIHANDLE hRec;
+    INSTALLSTATE isInstalled = INSTALLSTATE_UNKNOWN;
+    INSTALLSTATE isAction = INSTALLSTATE_UNKNOWN;
+    SCA_FILTER* psf;
+
+    LPWSTR pwzData = NULL;
+    WCA_WRAPQUERY_HANDLE hWrapQuery = NULL;
+    hr = WcaBeginUnwrapQuery(&hWrapQuery, ppwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap query for ScaAppPoolRead");
+
+    if (0 == WcaGetQueryRecords(hWrapQuery))
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping ScaFiltersRead() - no IIsFilter table");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    // loop through all the filters
+    while (S_OK == (hr = WcaFetchWrappedRecord(hWrapQuery, &hRec)))
+    {
+        // Get the Component first.  If the component is not being modified during
+        // this transaction, skip processing this whole record.
+        // get the darwin information
+        hr = WcaGetRecordString(hRec, fqComponent, &pwzData);
+        ExitOnFailure(hr, "failed to get IIsFilter.Component");
+
+        hr = WcaGetRecordInteger(hRec, fqInstalled, (int *)&isInstalled);
+        ExitOnFailure(hr, "Failed to get Component installed state for IIs filter");
+
+        hr = WcaGetRecordInteger(hRec, fqAction, (int *)&isAction);
+        ExitOnFailure(hr, "Failed to get Component action state for IIs filter");
+
+        if (!WcaIsInstalling(isInstalled, isAction) &&
+            !WcaIsReInstalling(isInstalled, isAction) &&
+            !WcaIsUninstalling(isInstalled, isAction))
+        {
+            continue; // skip this record.
+        }
+
+        hr = AddFilterToList(ppsfList);
+        ExitOnFailure(hr, "failed to add filter to list");
+
+        psf = *ppsfList;
+
+        hr = ::StringCchCopyW(psf->wzComponent, countof(psf->wzComponent), pwzData);
+        ExitOnFailure(hr, "failed to copy component name: %ls", pwzData);
+
+        psf->isInstalled = isInstalled;
+        psf->isAction = isAction;
+
+        hr = WcaGetRecordString(hRec, fqWeb, &pwzData);
+        ExitOnFailure(hr, "Failed to get Web for VirtualDir");
+
+        if (*pwzData)
+        {
+            hr = ScaWebsGetBase7(pswList, pwzData, psf->wzFilterRoot, countof(psf->wzFilterRoot));
+            if (FAILED(hr))
+            {
+                WcaLog(LOGMSG_VERBOSE, "Could not find site for filter: %ls. Result 0x%x ", psf->wzFilterRoot, hr);
+                hr = S_OK;
+            }
+        }
+        else
+        {
+            hr = ::StringCchCopyW(psf->wzFilterRoot, countof(psf->wzFilterRoot), L"/");
+            ExitOnFailure(hr, "Failed to allocate global filter base string");
+        }
+
+        // filter Name key
+        hr = WcaGetRecordString(hRec, fqFilter, &pwzData);
+        ExitOnFailure(hr, "Failed to get Filter.Filter");
+        hr = ::StringCchCopyW(psf->wzKey, countof(psf->wzKey), pwzData);
+        ExitOnFailure(hr, "Failed to copy key string to filter object");
+
+        // filter path
+        hr = WcaGetRecordString(hRec, fqPath, &pwzData);
+        ExitOnFailure(hr, "Failed to get Filter.Path");
+        hr = ::StringCchCopyW(psf->wzPath, countof(psf->wzPath), pwzData);
+        ExitOnFailure(hr, "Failed to copy path string to filter object");
+
+        // filter description -- not supported in iis 7
+        hr = WcaGetRecordString(hRec, fqDescription, &pwzData);
+        ExitOnFailure(hr, "Failed to get Filter.Description");
+        hr = ::StringCchCopyW(psf->wzDescription, countof(psf->wzDescription), pwzData);
+        ExitOnFailure(hr, "Failed to copy description string to filter object");
+
+        // filter flags
+        //What are these
+        hr = WcaGetRecordInteger(hRec, fqFlags, &psf->iFlags);
+        ExitOnFailure(hr, "Failed to get Filter.Flags");
+
+        // filter load order
+        hr = WcaGetRecordInteger(hRec, fqLoadOrder, &psf->iLoadOrder);
+        ExitOnFailure(hr, "Failed to get Filter.LoadOrder");
+    }
+
+    if (E_NOMOREITEMS == hr)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "Failure while processing filters");
+
+LExit:
+    WcaFinishUnwrapQuery(hWrapQuery);
+
+    ReleaseStr(pwzData);
+
+    return hr;
+}
+
+
+HRESULT ScaFiltersInstall7(
+    __in SCA_FILTER* psfList
+    )
+{
+    HRESULT hr = S_OK;
+    SCA_FILTER* psf = psfList;
+
+    if (!psf)
+    {
+        ExitFunction();
+    }
+    //write global filters
+    hr = ScaWriteConfigID(IIS_FILTER_GLOBAL_BEGIN);
+    ExitOnFailure(hr, "Failed to write filter begin ID");
+    while (psf)
+    {
+        if (WcaIsInstalling(psf->isInstalled, psf->isAction))
+        {
+            if (0 == wcscmp(psf->wzFilterRoot, L"/"))
+            {
+                hr = WriteFilter(psf);
+            }
+        }
+        psf = psf->psfNext;
+    }
+    hr = ScaWriteConfigID(IIS_FILTER_END);
+    ExitOnFailure(hr, "Failed to write filter ID");
+
+    psf = psfList;
+
+    //Write Web Site Filters
+    hr = ScaWriteConfigID(IIS_FILTER_BEGIN);
+    ExitOnFailure(hr, "Failed to write filter begin ID");
+    while (psf)
+    {
+        if (WcaIsInstalling(psf->isInstalled, psf->isAction))
+        {
+            if (0 != wcscmp(psf->wzFilterRoot, L"/"))
+            {
+                hr = WriteFilter(psf);
+            }
+        }
+        psf = psf->psfNext;
+    }
+    hr = ScaWriteConfigID(IIS_FILTER_END);
+    ExitOnFailure(hr, "Failed to write filter ID");
+
+LExit:
+
+    return hr;
+}
+static HRESULT WriteFilter(const SCA_FILTER* psf)
+{
+    HRESULT hr = S_OK;
+
+    hr = ScaWriteConfigID(IIS_FILTER);
+    ExitOnFailure(hr, "Failed to write filter begin ID");
+
+    hr = ScaWriteConfigID(IIS_CREATE);
+    ExitOnFailure(hr, "Failed to write filter create ID");
+
+    //filter Name key
+    hr = ScaWriteConfigString(psf->wzKey);
+    ExitOnFailure(hr, "Failed to write key name for filter '%ls'", psf->wzKey);
+
+    //web site name
+    hr = ScaWriteConfigString(psf->wzFilterRoot);
+    ExitOnFailure(hr, "Failed to write filter web root ");
+
+    // filter path
+    hr = ScaWriteConfigString(psf->wzPath);
+    ExitOnFailure(hr, "Failed to write Path for filter '%ls'", psf->wzKey);
+
+    //filter load order
+    hr = ScaWriteConfigInteger(psf->iLoadOrder);
+    ExitOnFailure(hr, "Failed to write load order for filter '%ls'", psf->wzKey);
+
+LExit:
+    return hr;
+}
+
+
+HRESULT ScaFiltersUninstall7(
+    __in SCA_FILTER* psfList
+    )
+{
+    HRESULT hr = S_OK;
+    SCA_FILTER* psf = psfList;
+
+    if (!psf)
+    {
+        ExitFunction1(hr = S_OK);
+    }
+
+    //Uninstall global filters
+    hr = ScaWriteConfigID(IIS_FILTER_GLOBAL_BEGIN);
+    ExitOnFailure(hr, "Failed to write filter begin ID");
+
+    while (psf)
+    {
+        if (WcaIsUninstalling(psf->isInstalled, psf->isAction))
+        {
+            if (0 == wcscmp(psf->wzFilterRoot, L"/"))
+            {
+                hr = ScaWriteConfigID(IIS_FILTER);
+                ExitOnFailure(hr, "Failed to write filter begin ID");
+
+                hr = ScaWriteConfigID(IIS_DELETE);
+                ExitOnFailure(hr, "Failed to write filter create ID");
+
+                //filter Name key
+                hr = ScaWriteConfigString(psf->wzKey);
+                ExitOnFailure(hr, "Failed to write key name for filter '%ls'", psf->wzKey);
+
+                //web site name
+                hr = ScaWriteConfigString(psf->wzFilterRoot);
+                ExitOnFailure(hr, "Failed to write filter web root ");
+
+            }
+        }
+        psf = psf->psfNext;
+    }
+
+    hr = ScaWriteConfigID(IIS_FILTER_END);
+    ExitOnFailure(hr, "Failed to write filter ID");
+
+    psf = psfList;
+
+    //Uninstall website filters
+    hr = ScaWriteConfigID(IIS_FILTER_BEGIN);
+    ExitOnFailure(hr, "Failed to write filter begin ID");
+    while (psf)
+    {
+        if (WcaIsUninstalling(psf->isInstalled, psf->isAction))
+        {
+            if (0 != wcscmp(psf->wzFilterRoot, L"/"))
+            {
+                hr = ScaWriteConfigID(IIS_FILTER);
+                ExitOnFailure(hr, "Failed to write filter begin ID");
+
+                hr = ScaWriteConfigID(IIS_DELETE);
+                ExitOnFailure(hr, "Failed to write filter create ID");
+
+                //filter Name key
+                hr = ScaWriteConfigString(psf->wzKey);
+                ExitOnFailure(hr, "Failed to write key name for filter '%ls'", psf->wzKey);
+
+                //web site name
+                hr = ScaWriteConfigString(psf->wzFilterRoot);
+                ExitOnFailure(hr, "Failed to write filter web root ");
+            }
+        }
+        psf = psf->psfNext;
+    }
+    hr = ScaWriteConfigID(IIS_FILTER_END);
+    ExitOnFailure(hr, "Failed to write filter ID");
+
+LExit:
+    return hr;
+}
diff --git a/src/ca/scafilter7.h b/src/ca/scafilter7.h
new file mode 100644
index 00000000..50ff6652
--- /dev/null
+++ b/src/ca/scafilter7.h
@@ -0,0 +1,21 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+#include "scaweb.h"
+
+// prototypes
+UINT __stdcall ScaFiltersRead7(
+    __in SCA_WEB7* pswList,
+    __in WCA_WRAPQUERY_HANDLE hWebBaseQuery, 
+    __inout SCA_FILTER** ppsfList,
+    __inout LPWSTR *ppwzCustomActionData
+    );
+
+HRESULT ScaFiltersInstall7(
+    SCA_FILTER* psfList
+    );
+
+HRESULT ScaFiltersUninstall7(
+    SCA_FILTER* psfList
+    );
diff --git a/src/ca/scahttpheader.cpp b/src/ca/scahttpheader.cpp
new file mode 100644
index 00000000..a8fea796
--- /dev/null
+++ b/src/ca/scahttpheader.cpp
@@ -0,0 +1,323 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+enum eHttpHeaderQuery { hhqName = 1, hhqParentType, hhqParentValue, hhqValue, hhqAttributes};
+
+static HRESULT AddHttpHeaderToList(
+    __in SCA_HTTP_HEADER** ppshhList
+    );
+
+
+void ScaHttpHeaderFreeList(
+    __in SCA_HTTP_HEADER* pshhList
+    )
+{
+    SCA_HTTP_HEADER* pshhDelete = pshhList;
+    while (pshhList)
+    {
+        pshhDelete = pshhList;
+        pshhList = pshhList->pshhNext;
+
+        MemFree(pshhDelete);
+    }
+}
+
+
+HRESULT ScaHttpHeaderRead(
+    __in SCA_HTTP_HEADER** ppshhList,
+    __inout LPWSTR *ppwzCustomActionData
+    )
+{
+    Assert(ppshhList);
+
+    HRESULT hr = S_OK;
+        MSIHANDLE hRec;
+    LPWSTR pwzData = NULL;
+    SCA_HTTP_HEADER* pshh = NULL;
+    WCA_WRAPQUERY_HANDLE hWrapQuery = NULL;
+
+    hr = WcaBeginUnwrapQuery(&hWrapQuery, ppwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap query for ScaAppPoolRead");
+
+    if (0 == WcaGetQueryRecords(hWrapQuery))
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping ScaHttpHeaderRead() - required tables not present.");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    // loop through all the HTTP headers
+    while (S_OK == (hr = WcaFetchWrappedRecord(hWrapQuery, &hRec)))
+    {
+        hr = AddHttpHeaderToList(ppshhList);
+        ExitOnFailure(hr, "failed to add http header to list");
+
+        pshh = *ppshhList;
+
+        hr = WcaGetRecordInteger(hRec, hhqParentType, &(pshh->iParentType));
+        ExitOnFailure(hr, "failed to get IIsHttpHeader.ParentType");
+
+        hr = WcaGetRecordString(hRec, hhqParentValue, &pwzData);
+        ExitOnFailure(hr, "Failed to get IIsHttpHeader.ParentValue");
+        hr = ::StringCchCopyW(pshh->wzParentValue, countof(pshh->wzParentValue), pwzData);
+        ExitOnFailure(hr, "Failed to copy IIsHttpHeader.ParentValue");
+
+        hr = WcaGetRecordString(hRec, hhqName, &pwzData);
+        ExitOnFailure(hr, "Failed to get IIsHttpHeader.Name");
+        hr = ::StringCchCopyW(pshh->wzName, countof(pshh->wzName), pwzData);
+        ExitOnFailure(hr, "Failed to copy IIsHttpHeader.Name");
+
+        hr = WcaGetRecordString(hRec, hhqValue, &pwzData);
+        ExitOnFailure(hr, "Failed to get IIsHttpHeader.Value");
+        hr = ::StringCchCopyW(pshh->wzValue, countof(pshh->wzValue), pwzData);
+        ExitOnFailure(hr, "Failed to copy IIsHttpHeader.Value");
+
+        hr = WcaGetRecordInteger(hRec, hhqAttributes, &(pshh->iAttributes));
+        ExitOnFailure(hr, "failed to get IIsHttpHeader.Attributes");
+    }
+
+    if (E_NOMOREITEMS == hr)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "Failure while processing web errors");
+
+LExit:
+    WcaFinishUnwrapQuery(hWrapQuery);
+
+    ReleaseStr(pwzData);
+
+    return hr;
+}
+
+
+HRESULT ScaGetHttpHeader(
+    __in int iParentType,
+    __in LPCWSTR wzParentValue,
+    __in SCA_HTTP_HEADER** ppshhList,
+    __out SCA_HTTP_HEADER** ppshhOut
+    )
+{
+    HRESULT hr = S_OK;
+    SCA_HTTP_HEADER* pshhAdd = NULL;
+    SCA_HTTP_HEADER* pshhLast = NULL;
+
+    *ppshhOut = NULL;
+
+    if (!*ppshhList)
+    {
+        return hr;
+    }
+
+    SCA_HTTP_HEADER* pshh = *ppshhList;
+    while (pshh)
+    {
+        if (iParentType == pshh->iParentType && CSTR_EQUAL == ::CompareStringW(LOCALE_SYSTEM_DEFAULT, 0, wzParentValue, -1, pshh->wzParentValue, -1))
+        {
+            // Found a match, take this one out of the list and add it to the matched out list
+            pshhAdd = pshh;
+
+            if (pshhLast)
+            {
+                // If we're not at the beginning of the list tell the last node about it's new next (since we're taking away it's current next)
+                pshhLast->pshhNext = pshhAdd->pshhNext;
+            }
+            else
+            {
+                // If we are at the beginning (no pshhLast) update the beginning (since we're taking it)
+                *ppshhList = pshh->pshhNext;
+            }
+            pshh = pshh->pshhNext; // move on
+
+            // Add the one we've removed to the beginning of the out list
+            pshhAdd->pshhNext = *ppshhOut;
+            *ppshhOut = pshhAdd;
+        }
+        else
+        {
+            pshhLast = pshh; // remember the last we that didn't match
+            pshh = pshh->pshhNext; // move on
+        }
+    }
+
+    return hr;
+}
+
+
+HRESULT ScaWriteHttpHeader(
+    __in IMSAdminBase* piMetabase,
+    __in LPCWSTR wzRoot,
+    __in SCA_HTTP_HEADER* pshhList
+    )
+{
+    Assert(piMetabase && pshhList);
+
+    HRESULT hr = S_OK;
+    METADATA_RECORD mr = { 0 };
+    DWORD cchData = 0;
+    LPWSTR pwzSearchKey = NULL;
+    LPWSTR pwz = NULL;
+    LPWSTR pwzHeaders = NULL;
+    LPWSTR pwzNewHeader = NULL;
+    DWORD dwFoundHeaderIndex = 0;
+    LPCWSTR wzFoundHeader = NULL;
+    BOOL fOldValueFound = FALSE;
+
+    ExitOnNull(wzRoot, hr, E_INVALIDARG, "Failed to write HTTP header, because no root was provided");
+
+    Assert(*wzRoot);
+
+    // Check if HTTP header already exist here.
+    mr.dwMDIdentifier = MD_HTTP_CUSTOM;
+    mr.dwMDAttributes = METADATA_INHERIT;
+    mr.dwMDUserType = IIS_MD_UT_SERVER;
+    mr.dwMDDataType = ALL_METADATA;
+    mr.dwMDDataLen = cchData = 0;
+    mr.pbMDData = NULL;
+
+    hr = MetaGetValue(piMetabase, METADATA_MASTER_ROOT_HANDLE, wzRoot, &mr);
+    if (HRESULT_FROM_WIN32(ERROR_PATH_NOT_FOUND) == hr || MD_ERROR_DATA_NOT_FOUND == hr)
+    {
+        //
+        // If we don't have any HTTP Headers already, move up to get the parent headers.
+        // TODO: Make it configurable to not inherit HTTP Headers
+        //
+        hr = StrAllocConcat(&pwzSearchKey, wzRoot, 0);
+        ExitOnFailure(hr, "Failed to copy root string: %ls", wzRoot);
+
+        pwz = pwzSearchKey + lstrlenW(pwzSearchKey);
+        while (NULL == pwzHeaders)
+        {
+            // find the last slash
+            while (*pwz != '/' && pwz != pwzSearchKey)
+            {
+                --pwz;
+            }
+
+            if (pwz == pwzSearchKey)
+            {
+                break;
+            }
+
+            *pwz = L'\0';
+
+            // Try here.  If it's not found, keep walking up the path
+            hr = MetaGetValue(piMetabase, METADATA_MASTER_ROOT_HANDLE, pwzSearchKey, &mr);
+            if (HRESULT_FROM_WIN32(ERROR_PATH_NOT_FOUND) == hr || MD_ERROR_DATA_NOT_FOUND == hr)
+            {
+                hr = S_FALSE;
+            }
+            ExitOnFailure(hr, "Failed to find search for HTTP headers for web root: %ls while walking up the tree", wzRoot);
+
+            if (S_OK == hr)
+            {
+                hr = StrAllocString(&pwzHeaders, reinterpret_cast<LPWSTR>(mr.pbMDData), 0);
+                ExitOnFailure(hr, "Failed to allocate parent HTTP header string");
+                break;
+            }
+        }
+    }
+    else
+    {
+        hr = StrAllocString(&pwzHeaders, reinterpret_cast<LPWSTR>(mr.pbMDData), 0);
+        ExitOnFailure(hr, "Failed to allocate HTTP header string");
+    }
+    ExitOnFailure(hr, "Failed while searching for default HTTP headers to start with for web root: %ls", wzRoot);
+
+    // Loop through the HTTP headers
+    for (SCA_HTTP_HEADER* pshh = pshhList; pshh; pshh = pshh->pshhNext)
+    {
+        fOldValueFound = FALSE; // assume a HTTP Header match will not be found
+
+        hr = StrAllocFormatted(&pwzNewHeader, L"%s: ", pshh->wzName);
+        ExitOnFailure(hr, "Failed to allocate header name");
+
+        if (NULL != pwzHeaders && *pwzHeaders)
+        {
+            // Try to find a matching header already in the list
+            hr = MultiSzFindSubstring(pwzHeaders, pwzNewHeader, &dwFoundHeaderIndex, &wzFoundHeader);
+            ExitOnFailure(hr, "Failed while searching for existing HTTP header.");
+
+            // If there was a substring HTTP header match, make sure the match was at the beginning 
+            // of the string because that is the HTTP header name.
+            if (S_OK == hr)
+            {
+                DWORD cchMatch = lstrlenW(pwzNewHeader);
+                if (CSTR_EQUAL == ::CompareStringW(LOCALE_SYSTEM_DEFAULT, NORM_IGNORECASE, pwzNewHeader, cchMatch, wzFoundHeader, cchMatch))
+                {
+                    fOldValueFound = TRUE;
+                    break;
+                }
+            }
+        }
+
+        // Add the value on to the header name now.
+        hr = StrAllocConcat(&pwzNewHeader, pshh->wzValue, 0);
+        ExitOnFailure(hr, "Failed to add value on to HTTP header name.");
+
+        // If we have something to replace, replace it, otherwise, put it at the beginning (order shouldn't matter)
+        if (fOldValueFound)
+        {
+            if (NULL == pwzHeaders)
+            {
+                ExitOnFailure(hr = E_INVALIDARG, "While attempting to replace old HTTP header with new HTTP header, it was discovered that the old HTTP header was NULL!");
+            }
+            hr = MultiSzReplaceString(&pwzHeaders, dwFoundHeaderIndex, pwzNewHeader);
+            ExitOnFailure(hr, "Failed to replace old HTTP header with new HTTP header");
+        }
+        else
+        {
+            hr = MultiSzPrepend(&pwzHeaders, NULL, pwzNewHeader);
+            ExitOnFailure(hr, "Failed to prepend new HTTP header");
+        }
+    }
+
+    // now write the HttpCustom to the metabase
+    hr = ScaWriteMetabaseValue(piMetabase, wzRoot, NULL, MD_HTTP_CUSTOM, METADATA_INHERIT, IIS_MD_UT_FILE, MULTISZ_METADATA, pwzHeaders);
+    ExitOnFailure(hr, "Failed to write HTTP Headers to metabase");
+
+LExit:
+    MetaFreeValue(&mr);
+
+    ReleaseStr(pwzNewHeader);
+    ReleaseStr(pwzHeaders);
+    ReleaseStr(pwzSearchKey);
+
+    return hr;
+}
+
+
+HRESULT ScaHttpHeaderCheckList(
+    __in SCA_HTTP_HEADER* pshhList
+    )
+{
+    if (!pshhList)
+    {
+        return S_OK;
+    }
+
+    while (pshhList)
+    {
+        WcaLog(LOGMSG_STANDARD, "Http Header: %ls for parent: %ls not used!", pshhList->wzName, pshhList->wzParentValue);
+        pshhList = pshhList->pshhNext;
+    }
+
+    return E_FAIL;
+}
+
+
+static HRESULT AddHttpHeaderToList(
+    __in SCA_HTTP_HEADER** ppshhList
+    )
+{
+    HRESULT hr = S_OK;
+
+    SCA_HTTP_HEADER* pshh = static_cast<SCA_HTTP_HEADER*>(MemAlloc(sizeof(SCA_HTTP_HEADER), TRUE));
+    ExitOnNull(pshh, hr, E_OUTOFMEMORY, "failed to allocate memory for new http header list element");
+
+    pshh->pshhNext = *ppshhList;
+    *ppshhList = pshh;
+
+LExit:
+    return hr;
+}
diff --git a/src/ca/scahttpheader.h b/src/ca/scahttpheader.h
new file mode 100644
index 00000000..a4c407a4
--- /dev/null
+++ b/src/ca/scahttpheader.h
@@ -0,0 +1,40 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+enum eHttpHeaderParentType { hhptVDir = 1, hhptWeb };
+
+struct SCA_HTTP_HEADER
+{
+    int iParentType;
+    WCHAR wzParentValue[MAX_DARWIN_KEY + 1];
+
+    WCHAR wzName[MAX_PATH];
+    WCHAR wzValue[MAX_PATH];
+    int iAttributes;
+
+    SCA_HTTP_HEADER* pshhNext;
+};
+
+// prototypes
+HRESULT ScaHttpHeaderRead(
+    __in SCA_HTTP_HEADER **ppshhList,
+    __inout LPWSTR *ppwzCustomActionData
+    );
+void ScaHttpHeaderFreeList(
+    __in SCA_HTTP_HEADER *pshhList
+    );
+HRESULT ScaHttpHeaderCheckList(
+    __in SCA_HTTP_HEADER* pshhList
+    );
+HRESULT ScaGetHttpHeader(
+    __in int iParentType,
+    __in LPCWSTR wzParentValue,
+    __in SCA_HTTP_HEADER** ppshhList,
+    __out SCA_HTTP_HEADER** ppshhOut
+    );
+HRESULT ScaWriteHttpHeader(
+    __in IMSAdminBase* piMetabase,
+    LPCWSTR wzRoot,
+    SCA_HTTP_HEADER* pshhList
+    );
diff --git a/src/ca/scahttpheader7.cpp b/src/ca/scahttpheader7.cpp
new file mode 100644
index 00000000..645dd8d4
--- /dev/null
+++ b/src/ca/scahttpheader7.cpp
@@ -0,0 +1,130 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+HRESULT ScaGetHttpHeader7(
+    __in int iParentType,
+    __in_z LPCWSTR wzParentValue,
+    __in SCA_HTTP_HEADER** ppshhList,
+    __out SCA_HTTP_HEADER** ppshhOut
+    )
+{
+    HRESULT hr = S_OK;
+    SCA_HTTP_HEADER* pshhAdd = NULL;
+    SCA_HTTP_HEADER* pshhLast = NULL;
+
+    *ppshhOut = NULL;
+
+    if (!*ppshhList)
+    {
+        return hr;
+    }
+
+    SCA_HTTP_HEADER* pshh = *ppshhList;
+    while (pshh)
+    {
+        if (iParentType == pshh->iParentType && 0 == wcscmp(wzParentValue, pshh->wzParentValue))
+        {
+            // Found a match, take this one out of the list and add it to the matched out list
+            pshhAdd = pshh;
+
+            if (pshhLast)
+            {
+                // If we're not at the beginning of the list tell the last node about it's new next (since we're taking away it's current next)
+                pshhLast->pshhNext = pshhAdd->pshhNext;
+            }
+            else
+            {
+                // If we are at the beginning (no pshhLast) update the beginning (since we're taking it)
+                *ppshhList = pshh->pshhNext;
+            }
+            pshh = pshh->pshhNext; // move on
+
+            // Add the one we've removed to the beginning of the out list
+            pshhAdd->pshhNext = *ppshhOut;
+            *ppshhOut = pshhAdd;
+        }
+        else
+        {
+            pshhLast = pshh; // remember the last we that didn't match
+            pshh = pshh->pshhNext; // move on
+        }
+    }
+
+    return hr;
+}
+
+
+HRESULT ScaWriteHttpHeader7(
+     __in_z LPCWSTR wzWebName,
+     __in_z LPCWSTR wzRoot,
+     SCA_HTTP_HEADER* pshhList
+    )
+{
+
+    HRESULT hr = S_OK;
+
+    hr = ScaWriteConfigID(IIS_HTTP_HEADER_BEGIN);
+    ExitOnFailure(hr, "Fail to write httpHeader begin ID");
+
+    hr = ScaWriteConfigString(wzWebName);
+    ExitOnFailure(hr, "Fail to write httpHeader Web Key");
+
+    hr = ScaWriteConfigString(wzRoot);
+    ExitOnFailure(hr, "Fail to write httpHeader Vdir key");
+
+    // Loop through the HTTP headers
+    for (SCA_HTTP_HEADER* pshh = pshhList; pshh; pshh = pshh->pshhNext)
+    {
+        hr = ScaWriteConfigID(IIS_HTTP_HEADER);
+        ExitOnFailure(hr, "Fail to write httpHeader ID");
+
+        hr = ScaWriteConfigString(pshh->wzName);
+        ExitOnFailure(hr, "Fail to write httpHeader name");
+
+        hr = ScaWriteConfigString(pshh->wzValue);
+        ExitOnFailure(hr, "Fail to write httpHeader value");
+    }
+
+    hr = ScaWriteConfigID(IIS_HTTP_HEADER_END);
+    ExitOnFailure(hr, "Fail to write httpHeader end ID");
+
+LExit:
+    return hr;
+}
+
+
+HRESULT ScaHttpHeaderCheckList7(
+    __in SCA_HTTP_HEADER* pshhList
+    )
+{
+    if (!pshhList)
+    {
+        return S_OK;
+    }
+
+    while (pshhList)
+    {
+        WcaLog(LOGMSG_STANDARD, "Http Header: %ls for parent: %ls not used!", pshhList->wzName, pshhList->wzParentValue);
+        pshhList = pshhList->pshhNext;
+    }
+
+    return E_FAIL;
+}
+
+
+//static HRESULT AddHttpHeaderToList(
+//    __in SCA_HTTP_HEADER** ppshhList
+//    )
+//{
+//    HRESULT hr = S_OK;
+//
+//    SCA_HTTP_HEADER* pshh = static_cast<SCA_HTTP_HEADER*>(MemAlloc(sizeof(SCA_HTTP_HEADER), TRUE));
+//    ExitOnNull(pshh, hr, E_OUTOFMEMORY, "failed to allocate memory for new http header list element");
+//
+//    pshh->pshhNext = *ppshhList;
+//    *ppshhList = pshh;
+//
+//LExit:
+//    return hr;
+//}
diff --git a/src/ca/scahttpheader7.h b/src/ca/scahttpheader7.h
new file mode 100644
index 00000000..7a873c16
--- /dev/null
+++ b/src/ca/scahttpheader7.h
@@ -0,0 +1,15 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+HRESULT ScaGetHttpHeader7(
+    __in int iParentType,
+    __in_z LPCWSTR wzParentValue,
+    __in SCA_HTTP_HEADER** ppshhList,
+    __out SCA_HTTP_HEADER** ppshhOut
+    );
+HRESULT ScaWriteHttpHeader7(
+    __in_z LPCWSTR wzWebName,
+    __in_z LPCWSTR wzRoot,
+    SCA_HTTP_HEADER* pshhList
+    );
diff --git a/src/ca/scaiis.cpp b/src/ca/scaiis.cpp
new file mode 100644
index 00000000..a29af1db
--- /dev/null
+++ b/src/ca/scaiis.cpp
@@ -0,0 +1,481 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+// globals
+LPWSTR vpwzCustomActionData = NULL;
+DWORD vdwCustomActionCost = 0;
+
+HRESULT ScaMetabaseTransaction(__in_z LPCWSTR wzBackup)
+{
+    HRESULT hr = S_OK;
+
+    // TODO: These functions have been reported to hang IIS (O11:51709).  They may have been fixed in IIS6, but if not, need to be re-written the hard way
+
+    hr = WcaDoDeferredAction(L"StartMetabaseTransaction", wzBackup, COST_IIS_TRANSACTIONS);
+    ExitOnFailure(hr, "Failed to schedule StartMetabaseTransaction");
+
+    hr = WcaDoDeferredAction(L"RollbackMetabaseTransaction", wzBackup, 0);   // rollback cost is irrelevant
+    ExitOnFailure(hr, "Failed to schedule RollbackMetabaseTransaction");
+
+    hr = WcaDoDeferredAction(L"CommitMetabaseTransaction", wzBackup, 0);  // commit is free
+    ExitOnFailure(hr, "Failed to schedule StartMetabaseTransaction");
+
+LExit:
+    return hr;
+}
+
+
+HRESULT ScaCreateWeb(IMSAdminBase* piMetabase, LPCWSTR /*wzWeb*/, LPCWSTR wzWebBase)
+{
+    Assert(piMetabase);
+
+    HRESULT hr = S_OK;
+    UINT ui = 0;
+
+    hr = ScaCreateMetabaseKey(piMetabase, wzWebBase, L"");
+    ExitOnFailure(hr, "Failed to create web");
+
+    hr = ScaWriteMetabaseValue(piMetabase, wzWebBase, L"", MD_KEY_TYPE, METADATA_NO_ATTRIBUTES, IIS_MD_UT_SERVER, STRING_METADATA, (LPVOID)L"IIsWebServer");
+    ExitOnFailure(hr, "Failed to set key type for web");
+
+    hr = ScaCreateMetabaseKey(piMetabase, wzWebBase, L"Root");
+    ExitOnFailure(hr, "Failed to create web root");
+
+    hr = ScaWriteMetabaseValue(piMetabase, wzWebBase, L"Root", MD_KEY_TYPE, METADATA_NO_ATTRIBUTES, IIS_MD_UT_SERVER, STRING_METADATA, (LPVOID)L"IIsWebVirtualDir");
+    ExitOnFailure(hr, "Failed to set key type for web root");
+
+    ui = 0x4000003e; // 1073741886;    // default directory browsing rights
+    hr = ScaWriteMetabaseValue(piMetabase, wzWebBase, L"Root", MD_DIRECTORY_BROWSING, METADATA_INHERIT, IIS_MD_UT_FILE, DWORD_METADATA, (LPVOID)((DWORD_PTR)ui));
+    ExitOnFailure(hr, "Failed to set directory browsing for web");
+
+    hr = ScaCreateMetabaseKey(piMetabase, wzWebBase, L"Filters");
+    ExitOnFailure(hr, "Failed to create web filters root");
+
+    hr = ScaWriteMetabaseValue(piMetabase, wzWebBase, L"Filters", MD_KEY_TYPE, METADATA_NO_ATTRIBUTES, IIS_MD_UT_SERVER, STRING_METADATA, (LPVOID)L"IIsFilters");
+    ExitOnFailure(hr, "Failed to set key for web filters root");
+
+    hr = ScaWriteMetabaseValue(piMetabase, wzWebBase, L"Filters", MD_FILTER_LOAD_ORDER, METADATA_NO_ATTRIBUTES, IIS_MD_UT_SERVER, STRING_METADATA, (LPVOID)L"");
+    ExitOnFailure(hr, "Failed to set empty load order for web");
+
+LExit:
+    return hr;
+}
+
+
+HRESULT ScaDeleteApp(IMSAdminBase* piMetabase, LPCWSTR wzWebRoot)
+{
+    Assert(piMetabase);
+    Unused(piMetabase);
+
+    HRESULT hr = S_OK;
+    WCHAR wzKey[METADATA_MAX_NAME_LEN];
+
+    WCHAR* pwzCustomActionData = NULL;
+
+    hr = WcaWriteIntegerToCaData(MBA_DELETEAPP, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to add metabase delete app directive to CustomActionData");
+
+    hr = ::StringCchCopyW(wzKey, countof(wzKey), wzWebRoot);
+    ExitOnFailure(hr, "Failed to copy webroot string to key");
+    hr = WcaWriteStringToCaData(wzKey, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to add metabase key to CustomActionData");
+
+    hr = ScaAddToIisConfiguration(pwzCustomActionData, COST_IIS_DELETEAPP);
+    ExitOnFailure(hr, "Failed to add ScaDeleteApp action data: %ls cost: %d", pwzCustomActionData, COST_IIS_DELETEAPP);
+
+LExit:
+    ReleaseStr(pwzCustomActionData);
+
+    return hr;
+}
+
+
+HRESULT ScaCreateApp(IMSAdminBase* piMetabase, LPCWSTR wzWebRoot,
+                     DWORD dwIsolation)
+{
+    Assert(piMetabase);
+    Unused(piMetabase);
+
+    HRESULT hr = S_OK;
+    WCHAR wzKey[METADATA_MAX_NAME_LEN];
+    BOOL fInProc = FALSE;
+
+    WCHAR* pwzCustomActionData = NULL;
+
+    hr = WcaWriteIntegerToCaData(MBA_CREATEAPP, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to add metabase create app directive to CustomActionData");
+
+    hr = ::StringCchCopyW(wzKey, countof(wzKey), wzWebRoot);
+    ExitOnFailure(hr, "Failed to copy webroot string to key");
+    hr = WcaWriteStringToCaData(wzKey, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to add metabase key to CustomActionData");
+
+    if (0 == dwIsolation)
+        fInProc = TRUE;
+    else
+        fInProc = FALSE;
+
+    hr = WcaWriteIntegerToCaData(fInProc, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to add isolation value to CustomActionData");
+
+    hr = ScaAddToIisConfiguration(pwzCustomActionData, COST_IIS_CREATEAPP);
+    ExitOnFailure(hr, "Failed to add ScaCreateApp action data: %ls cost: %d", pwzCustomActionData, COST_IIS_CREATEAPP);
+
+LExit:
+    ReleaseStr(pwzCustomActionData);
+
+    return hr;
+}
+
+
+HRESULT ScaCreateMetabaseKey(IMSAdminBase* piMetabase, LPCWSTR wzRootKey,
+                             LPCWSTR wzSubKey)
+{
+    Assert(piMetabase);
+    Unused(piMetabase);
+
+    HRESULT hr = S_OK;
+    WCHAR wzKey[METADATA_MAX_NAME_LEN];
+    WCHAR* pwzCustomActionData = NULL;
+
+    hr = ::StringCchCopyW(wzKey, countof(wzKey), wzRootKey);
+    ExitOnFailure(hr, "Failed to copy root key string to key");
+    if (L'/' != *(wzKey + lstrlenW(wzRootKey)))
+    {
+        hr = ::StringCchCatW(wzKey, countof(wzKey), L"/");
+        ExitOnFailure(hr, "Failed to concatenate / to key string");
+    }
+    if (wzSubKey && *wzSubKey)
+    {
+        if (L'/' == *wzSubKey)
+        {
+            hr = ::StringCchCatW(wzKey, countof(wzKey), wzSubKey + 1);
+            ExitOnFailure(hr, "Failed to concatenate subkey (minus slash) to key string");
+        }
+        else
+        {
+            hr = ::StringCchCatW(wzKey, countof(wzKey), wzSubKey);
+            ExitOnFailure(hr, "Failed to concatenate subkey to key string");
+        }
+    }
+
+    hr = WcaWriteIntegerToCaData(MBA_CREATEKEY, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to add metabase delete key directive to CustomActionData");
+
+    hr = WcaWriteStringToCaData(wzKey, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to add metabase key to CustomActionData");
+
+    hr = ScaAddToIisConfiguration(pwzCustomActionData, COST_IIS_CREATEKEY);
+    ExitOnFailure(hr, "Failed to add ScaCreateMetabaseKey action data: %ls cost: %d", pwzCustomActionData, COST_IIS_CREATEKEY);
+
+LExit:
+    ReleaseStr(pwzCustomActionData);
+
+    return hr;
+}
+
+
+HRESULT ScaDeleteMetabaseKey(IMSAdminBase* piMetabase, LPCWSTR wzRootKey,
+                             LPCWSTR wzSubKey)
+{
+    Assert(piMetabase);
+    Unused(piMetabase);
+
+    HRESULT hr = S_OK;
+    WCHAR wzKey[METADATA_MAX_NAME_LEN];
+    WCHAR* pwzCustomActionData = NULL;
+
+    hr = ::StringCchCopyW(wzKey, countof(wzKey), wzRootKey);
+    ExitOnFailure(hr, "Failed to copy root key string to key");
+    if (L'/' != *(wzKey + lstrlenW(wzRootKey)))
+    {
+        hr = ::StringCchCatW(wzKey, countof(wzKey), L"/");
+        ExitOnFailure(hr, "Failed to concatenate / to key string");
+    }
+    if (*wzSubKey)
+    {
+        if (L'/' == *wzSubKey)
+        {
+            hr = ::StringCchCatW(wzKey, countof(wzKey), wzSubKey + 1);
+            ExitOnFailure(hr, "Failed to concatenate subkey (minus slash) to key string");
+        }
+        else
+        {
+            hr = ::StringCchCatW(wzKey, countof(wzKey), wzSubKey);
+            ExitOnFailure(hr, "Failed to concatenate subkey to key string");
+        }
+    }
+
+    hr = WcaWriteIntegerToCaData(MBA_DELETEKEY, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to add metabase delete key directive to CustomActionData");
+
+    hr = WcaWriteStringToCaData(wzKey, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to add metabase key to CustomActionData");
+
+    hr = ScaAddToIisConfiguration(pwzCustomActionData, COST_IIS_DELETEKEY);
+    ExitOnFailure(hr, "Failed to add ScaDeleteMetabaseKey action data: %ls cost: %d", pwzCustomActionData, COST_IIS_DELETEKEY);
+
+LExit:
+    ReleaseStr(pwzCustomActionData);
+
+    return hr;
+}
+
+
+HRESULT ScaDeleteMetabaseValue(IMSAdminBase* piMetabase, LPCWSTR wzRootKey,
+                              LPCWSTR wzSubKey, DWORD dwIdentifier,
+                              DWORD dwDataType)
+{
+    Assert(piMetabase);
+    Unused(piMetabase);
+
+    HRESULT hr = S_OK;
+    WCHAR wzKey[METADATA_MAX_NAME_LEN];
+    WCHAR* pwzCustomActionData = NULL;
+
+    hr = ::StringCchCopyW(wzKey, countof(wzKey), wzRootKey);
+    ExitOnFailure(hr, "Failed to copy root key string to key");
+    if (L'/' != *(wzKey + lstrlenW(wzRootKey)))
+    {
+        hr = ::StringCchCatW(wzKey, countof(wzKey), L"/");
+        ExitOnFailure(hr, "Failed to concatenate / to key string");
+    }
+
+    if (wzSubKey && *wzSubKey)
+    {
+        if (L'/' == *wzSubKey)
+        {
+            hr = ::StringCchCatW(wzKey, countof(wzKey), wzSubKey + 1);
+            ExitOnFailure(hr, "Failed to concatenate subkey (minus slash) to key string");
+        }
+        else
+        {
+            hr = ::StringCchCatW(wzKey, countof(wzKey), wzSubKey);
+            ExitOnFailure(hr, "Failed to concatenate subkey to key string");
+        }
+    }
+
+    hr = WcaWriteIntegerToCaData(MBA_DELETEVALUE, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to add metabase write value directive to CustomActionData");
+
+    hr = WcaWriteStringToCaData(wzKey, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to add metabase key to CustomActionData");
+
+    hr = WcaWriteIntegerToCaData(dwIdentifier, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to add metabase identifier to CustomActionData");
+
+    hr = WcaWriteIntegerToCaData(dwDataType, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to add metabase data type to CustomActionData");
+
+    hr = ScaAddToIisConfiguration(pwzCustomActionData, COST_IIS_DELETEVALUE);
+    ExitOnFailure(hr, "Failed to add ScaDeleteMetabaseValue action data: %ls, cost: %d", pwzCustomActionData, COST_IIS_DELETEVALUE);
+
+LExit:
+    ReleaseStr(pwzCustomActionData);
+
+    return hr;
+}
+
+
+#pragma prefast(push)
+#pragma prefast(disable:25120) // Disable "requires count parameter" warning - we do have a way to distinguish buffer sizes in all situations,
+                               // it just depends on the dwDataType, and there's no way to annotate the situation in SAL
+HRESULT ScaWriteMetabaseValue(IMSAdminBase* piMetabase, LPCWSTR wzRootKey,
+                              LPCWSTR wzSubKey, DWORD dwIdentifier,
+                              DWORD dwAttributes, DWORD dwUserType,
+                              DWORD dwDataType, LPVOID pvData)
+#pragma prefast(pop)
+{
+    Assert(piMetabase && (pvData || (DWORD_METADATA == dwDataType)));    // pvData may be 0 if it is DWORD data
+    Unused(piMetabase);
+
+    HRESULT hr = S_OK;
+    WCHAR wzKey[METADATA_MAX_NAME_LEN];
+    WCHAR* pwzCustomActionData = NULL;
+
+    if (BINARY_METADATA == dwDataType)
+    {
+        ExitOnNull(pvData, hr, E_INVALIDARG, "Failed to write binary metadata - no data available to write");
+    }
+
+    hr = ::StringCchCopyW(wzKey, countof(wzKey), wzRootKey);
+    ExitOnFailure(hr, "Failed to copy root key string to key");
+    if (L'/' != *(wzKey + lstrlenW(wzRootKey)))
+    {
+        hr = ::StringCchCatW(wzKey, countof(wzKey), L"/");
+        ExitOnFailure(hr, "Failed to concatenate / to key string");
+    }
+    if (wzSubKey && *wzSubKey)
+    {
+        if (L'/' == *wzSubKey)
+        {
+            hr = ::StringCchCatW(wzKey, countof(wzKey), wzSubKey + 1);
+            ExitOnFailure(hr, "Failed to concatenate subkey (minus slash) to key string");
+        }
+        else
+        {
+            hr = ::StringCchCatW(wzKey, countof(wzKey), wzSubKey);
+            ExitOnFailure(hr, "Failed to concatenate subkey to key string");
+        }
+    }
+
+    hr = WcaWriteIntegerToCaData(MBA_WRITEVALUE, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to add metabase write value directive to CustomActionData");
+
+    hr = WcaWriteStringToCaData(wzKey, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to add metabase key to CustomActionData");
+
+    hr = WcaWriteIntegerToCaData(dwIdentifier, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to add metabase identifier to CustomActionData");
+
+    hr = WcaWriteIntegerToCaData(dwAttributes, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to add metabase attributes to CustomActionData");
+
+    hr = WcaWriteIntegerToCaData(dwUserType, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to add metabase user type to CustomActionData");
+
+    hr = WcaWriteIntegerToCaData(dwDataType, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to add metabase data type to CustomActionData");
+
+    switch (dwDataType)
+    {
+    case DWORD_METADATA:
+        hr = WcaWriteIntegerToCaData((DWORD)((DWORD_PTR)pvData), &pwzCustomActionData);
+        break;
+    case STRING_METADATA:
+        hr = WcaWriteStringToCaData((LPCWSTR)pvData, &pwzCustomActionData);
+        break;
+    case MULTISZ_METADATA:
+        {
+        // change NULLs to unprintable character  to create a 'safe' MULTISZ string
+        LPWSTR pwz = (LPWSTR)pvData;
+        for (;;)
+        {
+            if ('\0' == *pwz)
+            {
+                *pwz = MAGIC_MULTISZ_CHAR;
+                if ('\0' == *(pwz + 1))    // second null back to back means end of string
+                    break;
+            }
+
+            ++pwz;
+        }
+
+        hr = WcaWriteStringToCaData((LPCWSTR)pvData, &pwzCustomActionData);
+        }
+        break;
+    case BINARY_METADATA:
+        hr = WcaWriteStreamToCaData(((BLOB*) pvData)->pBlobData, ((BLOB*) pvData)->cbSize, &pwzCustomActionData);
+        break;
+    default:
+        hr = E_UNEXPECTED;
+    }
+    ExitOnFailure(hr, "Failed to add metabase data to CustomActionData");
+
+    // TODO: maybe look the key up and make sure we're not just writing the same value that already there
+
+    hr = ScaAddToIisConfiguration(pwzCustomActionData, COST_IIS_WRITEVALUE);
+    ExitOnFailure(hr, "Failed to add ScaWriteMetabaseValue action data: %ls, cost: %d", pwzCustomActionData, COST_IIS_WRITEVALUE);
+
+LExit:
+    ReleaseStr(pwzCustomActionData);
+
+    return hr;
+}
+
+
+HRESULT ScaAddToIisConfiguration(LPCWSTR pwzData, DWORD dwCost)
+{
+    HRESULT hr = S_OK;
+
+    hr = WcaWriteStringToCaData(pwzData, &vpwzCustomActionData);
+    ExitOnFailure(hr, "failed to add to metabase configuration data string: %ls", pwzData);
+
+    vdwCustomActionCost += dwCost;
+
+LExit:
+    return hr;
+}
+
+
+HRESULT ScaWriteConfigurationScript(__in LPCWSTR pwzCaScriptKey)
+{
+    HRESULT hr = S_OK;
+    WCA_CASCRIPT_HANDLE hScript = NULL;
+    LPWSTR pwzHashString = NULL;
+    BYTE rgbActualHash[SHA1_HASH_LEN] = { };
+    DWORD dwHashedBytes = SHA1_HASH_LEN;
+
+    // Create CaScript for communication with WriteMetabaseChanges
+    hr = WcaCaScriptCreate(WCA_ACTION_INSTALL, WCA_CASCRIPT_SCHEDULED, FALSE, pwzCaScriptKey, FALSE, &hScript);
+    ExitOnFailure(hr, "Failed to write ca script for WriteMetabaseChanges script.");
+
+    if (vpwzCustomActionData && *vpwzCustomActionData)
+    {
+        // Write the actual custom action data to the ca script
+        WcaCaScriptWriteString(hScript, vpwzCustomActionData);
+
+        hr = CrypHashBuffer((BYTE*)vpwzCustomActionData, sizeof(vpwzCustomActionData) * sizeof(WCHAR), PROV_RSA_AES, CALG_SHA1, rgbActualHash, dwHashedBytes);
+        ExitOnFailure(hr, "Failed to calculate hash of CustomAction data.");
+
+        hr = StrAlloc(&pwzHashString, ((dwHashedBytes * 2) + 1));
+        ExitOnFailure(hr, "Failed to allocate string for script hash");
+
+        hr = StrHexEncode(rgbActualHash, dwHashedBytes, pwzHashString, ((dwHashedBytes * 2) + 1));
+        ExitOnFailure(hr, "Failed to convert hash bytes to string.");
+
+        WcaLog(LOGMSG_VERBOSE,  "Custom action data hash: %ls", pwzHashString);
+        WcaLog(LOGMSG_TRACEONLY, "Custom action data being written to ca script: %ls", vpwzCustomActionData);
+    }
+    else
+        hr = S_FALSE;
+
+LExit:
+    // Release the string
+    ReleaseStr(vpwzCustomActionData);
+    ReleaseStr(pwzHashString);
+
+    // Flush the ca script to disk as best we can
+    WcaCaScriptFlush(hScript);
+
+    WcaCaScriptClose(hScript, WCA_CASCRIPT_CLOSE_PRESERVE);
+
+    return hr;
+}
+
+
+HRESULT ScaLoadMetabase(IMSAdminBase** ppiMetabase)
+{
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    // if IIS was uninstalled (thus no IID_IMSAdminBase) allow the
+    // user to still uninstall this package by clicking "Ignore"
+    do
+    {
+        hr = ::CoCreateInstance(CLSID_MSAdminBase, NULL, CLSCTX_ALL, IID_IMSAdminBase, (void**)ppiMetabase);
+        if (FAILED(hr))
+        {
+            WcaLog(LOGMSG_STANDARD, "failed to get IID_IMSAdminBase Object");
+            er = WcaErrorMessage(msierrIISCannotConnect, hr, INSTALLMESSAGE_ERROR | MB_ABORTRETRYIGNORE, 0);
+            switch (er)
+            {
+            case IDABORT:
+                ExitFunction();   // bail with the error result from the CoCreate to kick off a rollback
+            case IDRETRY:
+                hr = S_FALSE;   // hit me, baby, one more time
+                break;
+            case IDIGNORE:
+                hr = S_OK;  // pretend everything is okay and bail
+                break;
+            default:  // For failure on uninstall continue
+                hr = S_OK;
+                break;
+            }
+        }
+    } while (S_FALSE == hr);
+
+LExit:
+    return hr;
+}
diff --git a/src/ca/scaiis.h b/src/ca/scaiis.h
new file mode 100644
index 00000000..4c743edf
--- /dev/null
+++ b/src/ca/scaiis.h
@@ -0,0 +1,33 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+HRESULT ScaMetabaseTransaction(__in_z LPCWSTR wzBackup);
+
+HRESULT ScaCreateWeb(IMSAdminBase* piMetabase, LPCWSTR wzWeb, LPCWSTR wzWebBase);
+
+HRESULT ScaDeleteApp(IMSAdminBase* piMetabase, LPCWSTR wzWebRoot);
+
+HRESULT ScaCreateApp(IMSAdminBase* piMetabase, LPCWSTR wzWebRoot,
+                     DWORD dwIsolation);
+
+HRESULT ScaCreateMetabaseKey(IMSAdminBase* piMetabase, LPCWSTR wzRootKey,
+                             LPCWSTR wzSubKey);
+
+HRESULT ScaDeleteMetabaseKey(IMSAdminBase* piMetabase, LPCWSTR wzRootKey,
+                             LPCWSTR wzSubKey);
+
+HRESULT ScaWriteMetabaseValue(IMSAdminBase* piMetabase, LPCWSTR wzRootKey,
+                              LPCWSTR wzSubKey, DWORD dwIdentifier,
+                              DWORD dwAttributes, DWORD dwUserType,
+                              DWORD dwDataType, LPVOID pvData);
+
+HRESULT ScaDeleteMetabaseValue(IMSAdminBase* piMetabase, LPCWSTR wzRootKey,
+                              LPCWSTR wzSubKey, DWORD dwIdentifier,
+                              DWORD dwDataType);
+
+HRESULT ScaWriteConfigurationScript(LPCWSTR pwzCaScriptKey);
+
+HRESULT ScaAddToIisConfiguration(LPCWSTR pwzData, DWORD dwCost);
+
+HRESULT ScaLoadMetabase(IMSAdminBase** piMetabase);
diff --git a/src/ca/scaiis7.cpp b/src/ca/scaiis7.cpp
new file mode 100644
index 00000000..f0f4a629
--- /dev/null
+++ b/src/ca/scaiis7.cpp
@@ -0,0 +1,74 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+#define COST_IIS_WRITEKEY 10
+
+HRESULT ScaIIS7ConfigTransaction(LPCWSTR wzBackup)
+{
+    HRESULT hr = S_OK;
+
+    hr = WcaDoDeferredAction(L"StartIIS7ConfigTransaction", wzBackup, COST_IIS_TRANSACTIONS);
+    ExitOnFailure(hr, "Failed to schedule StartIIS7ConfigTransaction");
+
+    hr = WcaDoDeferredAction(L"RollbackIIS7ConfigTransaction", wzBackup, 0);   // rollback cost is irrelevant
+    ExitOnFailure(hr, "Failed to schedule RollbackIIS7ConfigTransaction");
+
+    hr = WcaDoDeferredAction(L"CommitIIS7ConfigTransaction", wzBackup, 0);  // commit is free
+    ExitOnFailure(hr, "Failed to schedule StartIIS7ConfigTransaction");
+
+LExit:
+    return hr;
+}
+
+HRESULT ScaWriteConfigString(const LPCWSTR wzValue)
+{
+    HRESULT hr = S_OK;
+    WCHAR* pwzCustomActionData = NULL;
+
+    hr = WcaWriteStringToCaData(wzValue, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to add metabase delete key directive to CustomActionData");
+
+    hr = ScaAddToIisConfiguration(pwzCustomActionData, COST_IIS_WRITEKEY);
+    ExitOnFailure(hr, "Failed to add ScaWriteMetabaseValue action data: %ls, cost: %d", pwzCustomActionData, COST_IIS_WRITEKEY);
+
+LExit:
+    ReleaseStr(pwzCustomActionData);
+
+    return hr;
+}
+
+HRESULT ScaWriteConfigInteger(DWORD dwValue)
+{
+    HRESULT hr = S_OK;
+    WCHAR* pwzCustomActionData = NULL;
+
+    hr = WcaWriteIntegerToCaData(dwValue, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to add metabase delete key directive to CustomActionData");
+
+    hr = ScaAddToIisConfiguration(pwzCustomActionData, COST_IIS_WRITEKEY);
+    ExitOnFailure(hr, "Failed to add ScaWriteMetabaseValue action data: %ls, cost: %d", pwzCustomActionData, COST_IIS_WRITEKEY);
+
+LExit:
+    ReleaseStr(pwzCustomActionData);
+
+    return hr;
+}
+
+HRESULT ScaWriteConfigID(IIS_CONFIG_ACTION emID)
+{
+    HRESULT hr = S_OK;
+    WCHAR* pwzCustomActionData = NULL;
+
+    hr = WcaWriteIntegerToCaData(emID, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to add metabase delete key directive to CustomActionData");
+
+    hr = ScaAddToIisConfiguration(pwzCustomActionData, COST_IIS_WRITEKEY);
+    ExitOnFailure(hr, "Failed to add ScaWriteMetabaseValue action data: %ls, cost: %d", pwzCustomActionData, COST_IIS_WRITEKEY);
+
+LExit:
+    ReleaseStr(pwzCustomActionData);
+
+    return hr;
+}
+
diff --git a/src/ca/scaiis7.h b/src/ca/scaiis7.h
new file mode 100644
index 00000000..f398deca
--- /dev/null
+++ b/src/ca/scaiis7.h
@@ -0,0 +1,17 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+HRESULT ScaScheduleIIS7Configuration();
+
+HRESULT ScaIIS7ConfigTransaction(__in_z LPCWSTR wzBackup);
+
+HRESULT ScaCreateApp7(__in_z LPCWSTR wzWebRoot, DWORD dwIsolation);
+
+HRESULT ScaDeleteConfigElement(IIS_CONFIG_ACTION emElement, LPCWSTR wzSubKey);
+
+HRESULT ScaWriteConfigString(__in_z const LPCWSTR wzValue);
+
+HRESULT ScaWriteConfigID(IIS_CONFIG_ACTION emID);
+
+HRESULT ScaWriteConfigInteger(DWORD dwValue);
diff --git a/src/ca/scamimemap.cpp b/src/ca/scamimemap.cpp
new file mode 100644
index 00000000..8afe99f9
--- /dev/null
+++ b/src/ca/scamimemap.cpp
@@ -0,0 +1,200 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+enum eMimeMapQuery { mmqMimeMap = 1, mmqParentType, mmqParentValue, 
+                        mmqMimeType, mmqExtension};
+
+// prototypes
+static HRESULT AddMimeMapToList(SCA_MIMEMAP** ppsmmList);
+
+
+void ScaMimeMapFreeList(SCA_MIMEMAP* psmmList)
+{
+    SCA_MIMEMAP* psmmDelete = psmmList;
+    while (psmmList)
+    {
+        psmmDelete = psmmList;
+        psmmList = psmmList->psmmNext;
+
+        MemFree(psmmDelete);
+    }
+}
+
+
+HRESULT __stdcall ScaMimeMapRead(
+    SCA_MIMEMAP** ppsmmList,
+    __inout LPWSTR *ppwzCustomActionData
+    )
+{
+    HRESULT hr = S_OK;
+    MSIHANDLE hRec;
+    LPWSTR pwzData = NULL;
+    SCA_MIMEMAP* psmm;
+    WCA_WRAPQUERY_HANDLE hWrapQuery = NULL;
+
+    hr = WcaBeginUnwrapQuery(&hWrapQuery, ppwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap query for ScaMimeMapRead");
+
+    if (0 == WcaGetQueryRecords(hWrapQuery))
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping ScaMimeMapRead() - required table not present");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    // loop through all the mimemappings
+    while (S_OK == (hr = WcaFetchWrappedRecord(hWrapQuery, &hRec)))
+    {
+        hr = AddMimeMapToList(ppsmmList);
+        ExitOnFailure(hr, "failed to add mime map to list");
+
+        psmm = *ppsmmList;
+
+        hr = WcaGetRecordString(hRec, mmqMimeMap, &pwzData);
+        ExitOnFailure(hr, "Failed to get MimeMap.MimeMap");
+        hr = ::StringCchCopyW(psmm->wzMimeMap, countof(psmm->wzMimeMap), pwzData);
+        ExitOnFailure(hr, "Failed to copy mimemap string to mimemap object");
+
+        hr = WcaGetRecordInteger(hRec, mmqParentType, &psmm->iParentType);
+        ExitOnFailure(hr, "Failed to get MimeMap.iParentType");
+    
+        hr = WcaGetRecordString(hRec, mmqParentValue, &pwzData);
+        ExitOnFailure(hr, "Failed to get MimeMap.ParentValue");
+        hr = ::StringCchCopyW(psmm->wzParentValue, countof(psmm->wzParentValue), pwzData);
+        ExitOnFailure(hr, "Failed to copy parent value string to mimemap object");
+
+        hr = WcaGetRecordString(hRec, mmqExtension, &pwzData);
+        ExitOnFailure(hr, "Failed to get MimeMap.Extension");
+        hr = ::StringCchCopyW(psmm->wzExtension, countof(psmm->wzExtension), pwzData);
+        ExitOnFailure(hr, "Failed to copy extension string to mimemap object");
+
+        hr = WcaGetRecordString(hRec, mmqMimeType, &pwzData);
+        ExitOnFailure(hr, "Failed to get MimeMap.MimeType");
+        hr = ::StringCchCopyW(psmm->wzMimeType, countof(psmm->wzMimeType), pwzData);
+        ExitOnFailure(hr, "Failed to copy mimetype string to mimemap object");
+    }
+
+    if (E_NOMOREITEMS == hr)
+        hr = S_OK;
+    ExitOnFailure(hr, "Failure while processing mimemappings");
+
+LExit:
+    WcaFinishUnwrapQuery(hWrapQuery);
+
+    ReleaseStr(pwzData);
+
+    return hr;
+}
+
+
+HRESULT ScaGetMimeMap(int iParentType, LPCWSTR wzParentValue, SCA_MIMEMAP **ppsmmList, SCA_MIMEMAP **ppsmmOut)
+{
+    HRESULT hr = S_OK;
+    SCA_MIMEMAP* psmmAdd = NULL;
+    SCA_MIMEMAP* psmmLast = NULL;
+
+    *ppsmmOut = NULL;
+    
+    if (!*ppsmmList)
+        return hr;
+
+    SCA_MIMEMAP* psmm = *ppsmmList;
+    while (psmm)
+    {
+        if (iParentType == psmm->iParentType && 0 == lstrcmpW(wzParentValue, psmm->wzParentValue))
+        {
+            // Found a match, take this one out of the list and add it to the matched out list
+            psmmAdd = psmm;
+
+            if (psmmLast)
+            {
+                // If we're not at the beginning of the list tell the last node about it's new next (since we're taking away it's current next)
+                psmmLast->psmmNext = psmmAdd->psmmNext;
+            }
+            else
+            {
+                // If we are at the beginning (no psmmLast) update the beginning (since we're taking it)
+                *ppsmmList = psmm->psmmNext;
+            }
+            psmm = psmm->psmmNext; // move on
+
+            // Add the one we've removed to the beginning of the out list
+            psmmAdd->psmmNext = *ppsmmOut;
+            *ppsmmOut = psmmAdd;
+        }
+        else
+        {
+            psmmLast = psmm; // remember the last we that didn't match
+            psmm = psmm->psmmNext; // move on
+        }
+    }
+
+    return hr;
+}
+
+HRESULT ScaMimeMapCheckList(SCA_MIMEMAP* psmmList)
+{
+    if (!psmmList)
+        return S_OK;
+    
+    while (psmmList)
+    {
+        WcaLog(LOGMSG_STANDARD, "MimeMapping of %ls with ParentType=%d and ParentValue=%ls not used!", psmmList->wzMimeMap, psmmList->iParentType, psmmList->wzParentValue);
+        psmmList = psmmList->psmmNext;
+    }
+
+    return E_FAIL;
+}
+
+
+HRESULT ScaWriteMimeMap(IMSAdminBase* piMetabase, LPCWSTR wzRootOfWeb, 
+                               SCA_MIMEMAP* psmmList)
+{
+    HRESULT hr = S_OK;
+
+    WCHAR wzMimeMap[8192];
+    WCHAR *pwzNext = wzMimeMap;
+    const WCHAR *pwzMac = wzMimeMap + countof(wzMimeMap); // used to properly create the MULTI_SZ
+
+    // fill the MULTI_SZ wzMimeMap buffer for the MimeMap attribute
+    ::ZeroMemory(wzMimeMap, sizeof(wzMimeMap));
+
+    for (SCA_MIMEMAP* psmm = psmmList; psmm; psmm = psmm->psmmNext)
+    {
+        hr = ::StringCchPrintfW(pwzNext, max(0, pwzMac - pwzNext), L"%s,%s", psmm->wzExtension, psmm->wzMimeType);
+        ExitOnFailure(hr, "Failed to set MimeMap string");
+
+        pwzNext += lstrlenW(pwzNext) + 1; // reserve space for null
+        Assert(pwzNext <= pwzMac);
+    }
+
+    if (pwzNext != wzMimeMap)
+    {
+        // now write the CustomErrors to the metabase
+        hr = ScaWriteMetabaseValue(piMetabase, wzRootOfWeb, NULL, MD_MIME_MAP, METADATA_INHERIT, IIS_MD_UT_FILE, MULTISZ_METADATA, wzMimeMap);
+        ExitOnFailure(hr, "Failed to write MimeMap");
+    }
+    else
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping ScaWriteMimeMap() - no mappings found.");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+LExit:
+    return hr;
+}
+
+
+static HRESULT AddMimeMapToList(SCA_MIMEMAP** ppsmmList)
+{
+    HRESULT hr = S_OK;
+
+    SCA_MIMEMAP* psmm = static_cast<SCA_MIMEMAP*>(MemAlloc(sizeof(SCA_MIMEMAP), TRUE));
+    ExitOnNull(psmm, hr, E_OUTOFMEMORY, "failed to allocate memory for new mime map list element");
+
+    psmm->psmmNext = *ppsmmList;
+    *ppsmmList = psmm;
+    
+LExit:
+    return hr;
+}
diff --git a/src/ca/scamimemap.h b/src/ca/scamimemap.h
new file mode 100644
index 00000000..b50e82e9
--- /dev/null
+++ b/src/ca/scamimemap.h
@@ -0,0 +1,33 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+enum eMimeMapParentType { mmptVDir = 1, mmptWeb = 2 };
+
+struct SCA_MIMEMAP
+{
+        // iis configuation information
+        WCHAR wzMimeMap[MAX_DARWIN_KEY + 1];
+        int iParentType;
+        WCHAR wzParentValue[MAX_DARWIN_KEY + 1];
+        WCHAR wzMimeType[MAX_DARWIN_KEY + 1];
+        WCHAR wzExtension[MAX_DARWIN_KEY + 1];
+
+
+        SCA_MIMEMAP* psmmNext;
+};
+
+
+// prototypes
+
+HRESULT __stdcall ScaMimeMapRead(SCA_MIMEMAP** ppsmmList, __inout LPWSTR *ppwzCustomActionData);
+
+HRESULT ScaGetMimeMap(int iParentType, LPCWSTR wzParentValue, SCA_MIMEMAP **psmmList, SCA_MIMEMAP **ppsmmOut);
+
+HRESULT ScaMimeMapCheckList(SCA_MIMEMAP* psmmList);
+
+void ScaMimeMapFreeList(SCA_MIMEMAP* psmmList);
+
+HRESULT ScaWriteMimeMap(IMSAdminBase* piMetabase, LPCWSTR wzRootOfWeb, 
+                               SCA_MIMEMAP* psmmList);
+
diff --git a/src/ca/scamimemap7.cpp b/src/ca/scamimemap7.cpp
new file mode 100644
index 00000000..f6689720
--- /dev/null
+++ b/src/ca/scamimemap7.cpp
@@ -0,0 +1,68 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+// prototypes
+HRESULT ScaWriteMimeMap7(
+    __in_z LPCWSTR wzWebName,
+    __in_z LPCWSTR wzRootOfWeb,
+    SCA_MIMEMAP* psmmList
+    )
+{
+    HRESULT hr = S_OK;
+    SCA_MIMEMAP* psmm;
+
+    //create the mimemap list for this vdir application
+    //all go to same web/root location tag
+    hr = ScaWriteConfigID(IIS_MIMEMAP_BEGIN);
+    ExitOnFailure(hr, "Failed to write mimemap begin id");
+    hr = ScaWriteConfigString(wzWebName);                //site name key
+    ExitOnFailure(hr, "Failed to write mimemap web key");
+    hr = ScaWriteConfigString(wzRootOfWeb);               //app path key
+    ExitOnFailure(hr, "Failed to write mimemap app key");
+
+    psmm = psmmList;
+
+    while (psmm)
+    {
+        //create the Extension for this vdir application
+        hr = ScaWriteConfigID(IIS_MIMEMAP);
+        ExitOnFailure(hr, "Failed to write mimemap id");
+
+        if (*psmm->wzExtension)
+        {
+            hr = ScaWriteConfigString(psmm->wzExtension);
+        }
+        else   // blank means "*" (all)
+        {
+            hr = ScaWriteConfigString(L"*");
+        }
+        ExitOnFailure(hr, "Failed to write mimemap extension");
+
+        hr = ScaWriteConfigString(psmm->wzMimeType);
+        ExitOnFailure(hr, "Failed to write mimemap type");
+
+        psmm = psmm->psmmNext;
+    }
+
+    hr = ScaWriteConfigID(IIS_MIMEMAP_END);
+    ExitOnFailure(hr, "Failed to write mimemap end id");
+
+LExit:
+    return hr;
+}
+
+
+//static HRESULT AddMimeMapToList(SCA_MIMEMAP** ppsmmList)
+//{
+//    HRESULT hr = S_OK;
+//
+//    SCA_MIMEMAP* psmm = static_cast<SCA_MIMEMAP*>(MemAlloc(sizeof(SCA_MIMEMAP), TRUE));
+//    ExitOnNull(psmm, hr, E_OUTOFMEMORY, "failed to allocate memory for new mime map list element");
+//
+//    psmm->psmmNext = *ppsmmList;
+//    *ppsmmList = psmm;
+//
+//LExit:
+//    return hr;
+//}
diff --git a/src/ca/scamimemap7.h b/src/ca/scamimemap7.h
new file mode 100644
index 00000000..88fcdc39
--- /dev/null
+++ b/src/ca/scamimemap7.h
@@ -0,0 +1,10 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+HRESULT ScaWriteMimeMap7(
+    __in_z LPCWSTR wzWebName,
+    __in_z LPCWSTR wzRootOfWeb,
+    SCA_MIMEMAP* psmmList
+    );
+
diff --git a/src/ca/scaproperty.cpp b/src/ca/scaproperty.cpp
new file mode 100644
index 00000000..d0e0d8a4
--- /dev/null
+++ b/src/ca/scaproperty.cpp
@@ -0,0 +1,252 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+/*------------------------------------------------------------------
+IIsProperty table:
+
+Property  Component_  Attributes  Value
+s72      s72         i4          s255
+------------------------------------------------------------------*/
+
+// sql queries
+enum ePropertyQuery { pqProperty = 1, pqComponent, pqAttributes, pqValue, pqInstalled, pqAction };
+
+
+// prototypes
+static HRESULT AddPropertyToList(
+    SCA_PROPERTY** ppspList
+    );
+
+
+// functions
+void ScaPropertyFreeList(
+    SCA_PROPERTY* pspList
+    )
+{
+    SCA_PROPERTY* pspDelete = pspList;
+    while (pspList)
+    {
+        pspDelete = pspList;
+        pspList = pspList->pspNext;
+
+        MemFree(pspDelete);
+    }
+}
+
+
+HRESULT ScaPropertyRead(
+    SCA_PROPERTY** ppspList,
+    __inout LPWSTR *ppwzCustomActionData
+    )
+{
+    HRESULT hr = S_OK;
+    MSIHANDLE hRec;
+
+    LPWSTR pwzData = NULL;
+    SCA_PROPERTY* pss;
+
+    WCA_WRAPQUERY_HANDLE hWrapQuery = NULL;
+
+    ExitOnNull(ppspList, hr, E_INVALIDARG, "Failed to read property, because no property to read was provided");
+
+    hr = WcaBeginUnwrapQuery(&hWrapQuery, ppwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap query for ScaAppPoolRead");
+
+    if (0 == WcaGetQueryRecords(hWrapQuery))
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping ScaInstallProperty() - required table not present");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    // loop through all the Settings
+    while (S_OK == (hr = WcaFetchWrappedRecord(hWrapQuery, &hRec)))
+    {
+        hr = AddPropertyToList(ppspList);
+        ExitOnFailure(hr, "failed to add property to list");
+
+        pss = *ppspList;
+
+        hr = WcaGetRecordString(hRec, pqProperty, &pwzData);
+        ExitOnFailure(hr, "failed to get IIsProperty.Property");
+        hr = ::StringCchCopyW(pss->wzProperty, countof(pss->wzProperty), pwzData);
+        ExitOnFailure(hr, "failed to copy Property name: %ls", pwzData);
+
+        hr = WcaGetRecordString(hRec, pqValue, &pwzData);
+        ExitOnFailure(hr, "failed to get IIsProperty.Value");
+        hr = ::StringCchCopyW(pss->wzValue, countof(pss->wzValue), pwzData);
+        ExitOnFailure(hr, "failed to copy Property value: %ls", pwzData);
+
+        hr = WcaGetRecordInteger(hRec, pqAttributes, &pss->iAttributes);
+        ExitOnFailure(hr, "failed to get IIsProperty.Attributes");
+
+        hr = WcaGetRecordString(hRec, pqComponent, &pwzData);
+        ExitOnFailure(hr, "failed to get IIsProperty.Component");
+        hr = ::StringCchCopyW(pss->wzComponent, countof(pss->wzComponent), pwzData);
+        ExitOnFailure(hr, "failed to copy component name: %ls", pwzData);
+
+        hr = WcaGetRecordInteger(hRec, pqInstalled, (int *)&pss->isInstalled);
+        ExitOnFailure(hr, "Failed to get Component installed state for filter");
+
+        hr = WcaGetRecordInteger(hRec, pqAction, (int *)&pss->isAction);
+        ExitOnFailure(hr, "Failed to get Component action state for filter");
+    }
+
+    if (E_NOMOREITEMS == hr)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "failure while processing IIsProperty table");
+
+LExit:
+    WcaFinishUnwrapQuery(hWrapQuery);
+
+    ReleaseStr(pwzData);
+
+    return hr;
+}
+
+
+HRESULT ScaPropertyInstall(
+    IMSAdminBase* piMetabase, 
+    SCA_PROPERTY* pspList
+    )
+{
+    Assert(piMetabase);
+
+    HRESULT hr = S_OK;
+
+    for (SCA_PROPERTY* psp = pspList; psp; psp = psp->pspNext)
+    {
+        // if we are installing the web site
+        if (WcaIsInstalling(psp->isInstalled, psp->isAction))
+        {
+            hr = ScaWriteProperty(piMetabase, psp);
+            ExitOnFailure(hr, "failed to write Property '%ls' to metabase", psp->wzProperty);
+        }
+    }
+
+LExit:
+    return hr;
+}
+
+
+HRESULT ScaPropertyUninstall(
+    IMSAdminBase* piMetabase, 
+    SCA_PROPERTY* pspList
+    )
+{
+    Assert(piMetabase);
+
+    HRESULT hr = S_OK;
+
+    for (SCA_PROPERTY* psp = pspList; psp; psp = psp->pspNext)
+    {
+        // if we are uninstalling the web site
+        if (WcaIsUninstalling(psp->isInstalled, psp->isAction))
+        {
+            hr = ScaRemoveProperty(piMetabase, psp);
+            ExitOnFailure(hr, "Failed to remove Property '%ls' from metabase", psp->wzProperty);
+        }
+    }
+
+LExit:
+    return hr;
+}
+
+
+HRESULT ScaWriteProperty(
+    IMSAdminBase* piMetabase, 
+    SCA_PROPERTY* psp
+    )
+{
+    Assert(piMetabase);
+
+    HRESULT hr = S_OK;
+    DWORD dwValue;
+    LPWSTR wz = NULL;
+
+    ExitOnNull(psp, hr, E_INVALIDARG, "Failed to write property because no property to write was given");
+
+    //
+    // Figure out what setting we're writing and write it
+    //
+    if (0 == lstrcmpW(psp->wzProperty, wzIISPROPERTY_IIS5_ISOLATION_MODE))
+    {
+        dwValue = 1;
+        hr = ScaWriteMetabaseValue(piMetabase, L"/LM/W3SVC", NULL, MD_GLOBAL_STANDARD_APP_MODE_ENABLED, METADATA_NO_ATTRIBUTES, IIS_MD_UT_SERVER, DWORD_METADATA, (LPVOID)((DWORD_PTR)dwValue));
+        ExitOnFailure(hr, "failed to set IIs5IsolationMode");
+    }
+    else if (0 == lstrcmpW(psp->wzProperty, wzIISPROPERTY_MAX_GLOBAL_BANDWIDTH))
+    {
+        dwValue = wcstoul(psp->wzValue, &wz, 10) * 1024; // remember, the value shown is in kilobytes, the value saved is in bytes
+        hr = ScaWriteMetabaseValue(piMetabase, L"/LM/W3SVC", NULL, MD_MAX_GLOBAL_BANDWIDTH, METADATA_NO_ATTRIBUTES, IIS_MD_UT_SERVER, DWORD_METADATA, (LPVOID)((DWORD_PTR)dwValue));
+        ExitOnFailure(hr, "failed to set MaxGlobalBandwidth");
+    }
+    else if (0 == lstrcmpW(psp->wzProperty, wzIISPROPERTY_LOG_IN_UTF8))
+    {
+        dwValue = 1;
+        hr = ScaWriteMetabaseValue(piMetabase, L"/LM/W3SVC", NULL, MD_GLOBAL_LOG_IN_UTF_8, METADATA_NO_ATTRIBUTES, IIS_MD_UT_SERVER, DWORD_METADATA, (LPVOID)((DWORD_PTR)dwValue));
+        ExitOnFailure(hr, "failed to set LogInUTF8");
+    }
+    else if (0 == lstrcmpW(psp->wzProperty, wzIISPROPERTY_ETAG_CHANGENUMBER))
+    {
+        dwValue = wcstoul(psp->wzValue, &wz, 10);
+        hr = ScaWriteMetabaseValue(piMetabase, L"/LM/W3SVC", NULL, /*MD_ETAG_CHANGENUMBER*/ 2039, METADATA_INHERIT, IIS_MD_UT_SERVER, DWORD_METADATA, (LPVOID)((DWORD_PTR)dwValue));
+        ExitOnFailure(hr, "failed to set EtagChangenumber");
+    }
+LExit:
+    return hr;
+}
+
+
+HRESULT ScaRemoveProperty(
+    IMSAdminBase* piMetabase, 
+    SCA_PROPERTY* psp
+    )
+{
+    Assert(piMetabase);
+
+    HRESULT hr = S_OK;
+    DWORD dwValue;
+
+    ExitOnNull(psp, hr, E_INVALIDARG, "Failed to remove property because no property to remove was given");
+
+    if (0 == lstrcmpW(psp->wzProperty, wzIISPROPERTY_IIS5_ISOLATION_MODE))
+    {
+        dwValue = 0;
+        hr = ScaWriteMetabaseValue(piMetabase, L"/LM/W3SVC", NULL, MD_GLOBAL_STANDARD_APP_MODE_ENABLED, METADATA_NO_ATTRIBUTES, IIS_MD_UT_SERVER, DWORD_METADATA, (LPVOID)((DWORD_PTR)dwValue));
+        ExitOnFailure(hr, "failed to clear IIs5IsolationMode");
+    }
+    else if (0 == lstrcmpW(psp->wzProperty, wzIISPROPERTY_MAX_GLOBAL_BANDWIDTH))
+    {
+        dwValue = 0xFFFFFFFF; // This unchecks the box
+        hr = ScaWriteMetabaseValue(piMetabase, L"/LM/W3SVC", NULL, MD_MAX_GLOBAL_BANDWIDTH, METADATA_NO_ATTRIBUTES , IIS_MD_UT_SERVER, DWORD_METADATA, (LPVOID)((DWORD_PTR)dwValue));
+        ExitOnFailure(hr, "failed to clear MaxGlobalBandwidth");
+    }
+    else if (0 == lstrcmpW(psp->wzProperty, wzIISPROPERTY_LOG_IN_UTF8))
+    {
+        dwValue = 0;
+        hr = ScaWriteMetabaseValue(piMetabase, L"/LM/W3SVC", NULL, MD_GLOBAL_LOG_IN_UTF_8, METADATA_NO_ATTRIBUTES, IIS_MD_UT_SERVER, DWORD_METADATA, (LPVOID)((DWORD_PTR)dwValue));
+        ExitOnFailure(hr, "failed to clear LogInUTF8");
+    }
+
+LExit:
+    return hr;
+}
+
+
+static HRESULT AddPropertyToList(
+    SCA_PROPERTY** ppspList
+    )
+{
+    HRESULT hr = S_OK;
+    SCA_PROPERTY* psp = static_cast<SCA_PROPERTY*>(MemAlloc(sizeof(SCA_PROPERTY), TRUE));
+    ExitOnNull(psp, hr, E_OUTOFMEMORY, "failed to allocate memory for new property list element");
+    
+    psp->pspNext = *ppspList;
+    *ppspList = psp;
+    
+LExit:
+    return hr;
+}
diff --git a/src/ca/scaproperty.h b/src/ca/scaproperty.h
new file mode 100644
index 00000000..21e7cfc7
--- /dev/null
+++ b/src/ca/scaproperty.h
@@ -0,0 +1,54 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+#define wzIISPROPERTY_IIS5_ISOLATION_MODE L"IIs5IsolationMode"
+#define wzIISPROPERTY_MAX_GLOBAL_BANDWIDTH L"MaxGlobalBandwidth"
+#define wzIISPROPERTY_LOG_IN_UTF8 L"LogInUTF8"
+#define wzIISPROPERTY_ETAG_CHANGENUMBER L"ETagChangeNumber"
+
+struct SCA_PROPERTY
+{
+        // iis configuation information
+        WCHAR wzProperty[MAX_DARWIN_KEY + 1];
+        WCHAR wzComponent[MAX_DARWIN_KEY + 1];
+        INSTALLSTATE isInstalled;
+        INSTALLSTATE isAction;
+        INT iAttributes;
+        WCHAR wzValue[MAX_DARWIN_COLUMN + 1];
+
+        SCA_PROPERTY *pspNext;
+};
+
+
+// prototypes
+
+HRESULT ScaPropertyRead(
+        SCA_PROPERTY** ppspList,
+    __inout LPWSTR *ppwzCustomActionData
+        );
+
+void ScaPropertyFreeList(
+        SCA_PROPERTY* pspList
+        );
+
+HRESULT ScaPropertyInstall(
+        IMSAdminBase* piMetabase, 
+        SCA_PROPERTY* pspList
+        );
+
+HRESULT ScaPropertyUninstall(
+        IMSAdminBase* piMetabase, 
+        SCA_PROPERTY* pspList
+        );
+
+HRESULT ScaWriteProperty(
+        IMSAdminBase* piMetabase, 
+        SCA_PROPERTY* psp
+        );
+
+HRESULT ScaRemoveProperty(
+        IMSAdminBase* piMetabase, 
+        SCA_PROPERTY* psp
+        );
+
diff --git a/src/ca/scaproperty7.cpp b/src/ca/scaproperty7.cpp
new file mode 100644
index 00000000..d17eeb68
--- /dev/null
+++ b/src/ca/scaproperty7.cpp
@@ -0,0 +1,108 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+HRESULT ScaPropertyInstall7(
+    SCA_PROPERTY* pspList
+    )
+{
+    HRESULT hr = S_OK;
+
+    for (SCA_PROPERTY* psp = pspList; psp; psp = psp->pspNext)
+    {
+        // if we are installing the web site
+        if (WcaIsInstalling(psp->isInstalled, psp->isAction))
+        {
+            hr = ScaWriteProperty7(psp);
+            ExitOnFailure(hr, "failed to write Property '%ls' ", psp->wzProperty);
+        }
+    }
+
+LExit:
+    return hr;
+}
+
+
+HRESULT ScaPropertyUninstall7(
+    SCA_PROPERTY* pspList
+    )
+{
+    HRESULT hr = S_OK;
+
+    for (SCA_PROPERTY* psp = pspList; psp; psp = psp->pspNext)
+    {
+        // if we are uninstalling the web site
+        if (WcaIsUninstalling(psp->isInstalled, psp->isAction))
+        {
+            hr = ScaRemoveProperty7(psp);
+            ExitOnFailure(hr, "Failed to remove Property '%ls'", psp->wzProperty);
+        }
+    }
+
+LExit:
+    return hr;
+}
+
+
+HRESULT ScaWriteProperty7(
+    const SCA_PROPERTY* psp
+    )
+{
+    HRESULT hr = S_OK;
+    DWORD dwValue;
+    LPWSTR wz = NULL;
+
+    ExitOnNull(psp, hr, E_INVALIDARG, "Failed to write property because no property to write was given");
+    //
+    // Figure out what setting we're writing and write it
+    //
+    if (0 == wcscmp(psp->wzProperty, wzIISPROPERTY_IIS5_ISOLATION_MODE))
+    {
+        // IIs5IsolationMode not supported
+        WcaLog(LOGMSG_VERBOSE, "Not supported by IIS7: IIs5IsolationMode, ignoring");
+    }
+    else if (0 == wcscmp(psp->wzProperty, wzIISPROPERTY_MAX_GLOBAL_BANDWIDTH))
+    {
+        dwValue = wcstoul(psp->wzValue, &wz, 10) * 1024; // remember, the value shown is in kilobytes, the value saved is in bytes
+        hr = ScaWriteConfigID(IIS_PROPERTY);
+        ExitOnFailure(hr, "failed to set Property ID");
+        hr = ScaWriteConfigID(IIS_PROPERTY_MAXBAND);
+        ExitOnFailure(hr, "failed to set Property MSXBAND ID");
+        hr = ScaWriteConfigInteger(dwValue);
+        ExitOnFailure(hr, "failed to set Property MSXBAND value");
+    }
+    else if (0 == wcscmp(psp->wzProperty, wzIISPROPERTY_LOG_IN_UTF8))
+    {
+        dwValue = 1;
+        hr = ScaWriteConfigID(IIS_PROPERTY);
+        ExitOnFailure(hr, "failed to set Property ID");
+        hr = ScaWriteConfigID(IIS_PROPERTY_LOGUTF8);
+        ExitOnFailure(hr, "failed to set Property LOG ID");
+        hr = ScaWriteConfigInteger(dwValue);
+        ExitOnFailure(hr, "failed to set Property Log value");
+    }
+    else if (0 == wcscmp(psp->wzProperty, wzIISPROPERTY_ETAG_CHANGENUMBER))
+    {
+        //EtagChangenumber not supported
+        WcaLog(LOGMSG_VERBOSE, "Not supported by IIS7: EtagChangenumber, ignoring");
+    }
+
+LExit:
+    return hr;
+}
+
+HRESULT ScaRemoveProperty7(
+    __in SCA_PROPERTY* /*psp*/
+    )
+{
+
+    // NOP function for now
+    //The two global values being set by WebProperty:
+    //    <iis:WebProperty Id="MaxGlobalBandwidth" Value="1024" />
+    //    <iis:WebProperty Id ="LogInUTF8" />
+    // should should not be removed on uninstall.
+
+    HRESULT hr = S_OK;
+
+    return hr;
+}
diff --git a/src/ca/scaproperty7.h b/src/ca/scaproperty7.h
new file mode 100644
index 00000000..bbf811e8
--- /dev/null
+++ b/src/ca/scaproperty7.h
@@ -0,0 +1,26 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+#define wzIISPROPERTY_IIS5_ISOLATION_MODE L"IIs5IsolationMode"
+#define wzIISPROPERTY_MAX_GLOBAL_BANDWIDTH L"MaxGlobalBandwidth"
+#define wzIISPROPERTY_LOG_IN_UTF8 L"LogInUTF8"
+#define wzIISPROPERTY_ETAG_CHANGENUMBER L"ETagChangeNumber"
+
+// prototypes
+HRESULT ScaPropertyInstall7(
+    SCA_PROPERTY* pspList
+    );
+
+HRESULT ScaPropertyUninstall7(
+    SCA_PROPERTY* pspList
+    );
+
+HRESULT ScaWriteProperty7(
+    const SCA_PROPERTY* psp
+    );
+
+HRESULT ScaRemoveProperty7(
+    SCA_PROPERTY* psp
+    );
+
diff --git a/src/ca/scasched.cpp b/src/ca/scasched.cpp
new file mode 100644
index 00000000..cdece45d
--- /dev/null
+++ b/src/ca/scasched.cpp
@@ -0,0 +1,823 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+const int ConfigureIIsCost = 8;
+const int WriteMetabaseChangesCost = 20;
+const int WriteIIS7ConfigChangesCost = 20;
+
+// sql queries
+LPCWSTR vcsUserDeferredQuery = L"SELECT `User`, `Component_`, `Name`, `Domain`, `Password` FROM `User`";
+
+LPCWSTR vcsWebSvcExtQuery = L"SELECT `Component_`, `File`, `Description`, `Group`, `Attributes` FROM `IIsWebServiceExtension`";
+
+LPCWSTR vcsAppPoolQuery = L"SELECT `AppPool`, `Name`, `Component_`, `Attributes`, `User_`, `RecycleMinutes`, `RecycleRequests`, `RecycleTimes`, `VirtualMemory`, `PrivateMemory`, `IdleTimeout`, `QueueLimit`, `CPUMon`, `MaxProc`, `ManagedRuntimeVersion`, `ManagedPipelineMode` FROM `IIsAppPool`";
+
+LPCWSTR vcsComponentAttrQuery = L"SELECT `Component`,`Attributes` FROM `Component`";
+
+LPCWSTR vcsMimeMapQuery = L"SELECT `MimeMap`, `ParentType`, `ParentValue`, `MimeType`, `Extension` FROM `IIsMimeMap`";
+
+LPCWSTR vcsHttpHeaderQuery = L"SELECT `Name`, `ParentType`, `ParentValue`, `Value`, `Attributes` FROM `IIsHttpHeader` ORDER BY `Sequence`";
+
+LPCWSTR vcsWebErrorQuery =
+    L"SELECT `ErrorCode`, `SubCode`, `ParentType`, `ParentValue`, `File`, `URL` "
+    L"FROM `IIsWebError` ORDER BY `ErrorCode`, `SubCode`";
+
+LPCWSTR vcsWebDirPropertiesQuery = L"SELECT `DirProperties`, `Access`, `Authorization`, `AnonymousUser_`, `IIsControlledPassword`, `LogVisits`, `Index`, `DefaultDoc`, `AspDetailedError`, `HttpExpires`, `CacheControlMaxAge`, `CacheControlCustom`, `NoCustomError`, `AccessSSLFlags`, `AuthenticationProviders` "
+    L"FROM `IIsWebDirProperties`";
+
+LPCWSTR vcsSslCertificateQuery = L"SELECT `Certificate`.`StoreName`, `CertificateHash`.`Hash`, `IIsWebSiteCertificates`.`Web_` FROM `Certificate`, `CertificateHash`, `IIsWebSiteCertificates` WHERE `Certificate`.`Certificate`=`CertificateHash`.`Certificate_` AND `CertificateHash`.`Certificate_`=`IIsWebSiteCertificates`.`Certificate_`";
+
+LPCWSTR vcsWebLogQuery = L"SELECT `Log`, `Format` "
+    L"FROM `IIsWebLog`";
+
+LPCWSTR vcsWebApplicationQuery = L"SELECT `Name`, `Isolation`, `AllowSessions`, `SessionTimeout`, "
+    L"`Buffer`, `ParentPaths`, `DefaultScript`, `ScriptTimeout`, "
+    L"`ServerDebugging`, `ClientDebugging`, `AppPool_`, `Application` "
+    L"FROM `IIsWebApplication`";
+
+LPCWSTR vcsWebAppExtensionQuery = L"SELECT `Extension`, `Verbs`, `Executable`, `Attributes`, `Application_` FROM `IIsWebApplicationExtension`";
+
+LPCWSTR vcsWebQuery = L"SELECT `Web`, `Component_`, `Id`, `Description`, `ConnectionTimeout`, `Directory_`, `State`, `Attributes`, `DirProperties_`, `Application_`, "
+    L"`Address`, `IP`, `Port`, `Header`, `Secure`, `Log_` FROM `IIsWebSite`, `IIsWebAddress` "
+    L"WHERE `KeyAddress_`=`Address` ORDER BY `Sequence`";
+
+LPCWSTR vcsWebAddressQuery = L"SELECT `Address`, `Web_`, `IP`, `Port`, `Header`, `Secure` "
+    L"FROM `IIsWebAddress`";
+
+LPCWSTR vcsWebBaseQuery = L"SELECT `Web`, `Id`, `IP`, `Port`, `Header`, `Secure`, `Description` "
+    L"FROM `IIsWebSite`, `IIsWebAddress` "
+    L"WHERE `KeyAddress_`=`Address`";
+
+LPCWSTR vcsWebDirQuery = L"SELECT `Web_`, `WebDir`, `Component_`, `Path`, `DirProperties_`, `Application_` "
+    L"FROM `IIsWebDir`";
+
+LPCWSTR vcsVDirQuery = L"SELECT `Web_`, `VirtualDir`, `Component_`, `Alias`, `Directory_`, `DirProperties_`, `Application_` "
+    L"FROM `IIsWebVirtualDir`";
+
+LPCWSTR vcsFilterQuery = L"SELECT `Web_`, `Name`, `Component_`, `Path`, `Description`, `Flags`, `LoadOrder` FROM `IIsFilter` ORDER BY `Web_`";
+
+LPCWSTR vcsPropertyQuery = L"SELECT `Property`, `Component_`, `Attributes`, `Value` "
+    L"FROM `IIsProperty`";
+
+#define IIS7CONDITION L"VersionNT >= 600"
+#define USEIIS7CONDITION IIS7CONDITION L"AND NOT UseIis6Compatibility"
+
+/********************************************************************
+ConfigureIIs - CUSTOM ACTION ENTRY POINT for installing IIs settings
+
+********************************************************************/
+extern "C" UINT __stdcall ConfigureIIs(
+    __in MSIHANDLE hInstall
+    )
+{
+    //AssertSz(FALSE, "debug ConfigureIIs here");
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+    LPWSTR pwzScriptKey = NULL;
+    LPWSTR pwzBackupId = NULL;
+    LPWSTR pwzCustomActionData = NULL; // CustomActionData for ConfigureIIs custom action
+
+    // initialize
+    hr = WcaInitialize(hInstall, "ConfigureIIs");
+    ExitOnFailure(hr, "Failed to initialize");
+
+    // check for the prerequsite tables
+    if (S_OK != WcaTableExists(L"IIsWebSite") && S_OK != WcaTableExists(L"IIsFilter") && S_OK != WcaTableExists(L"IIsProperty") && 
+        S_OK != WcaTableExists(L"IIsWebServiceExtension") && S_OK != WcaTableExists(L"IIsAppPool"))
+    {
+        WcaLog(LOGMSG_VERBOSE, "skipping IIs CustomAction, no IIsWebSite table, no IIsFilter table, no IIsProperty table, no IIsWebServiceExtension, and no IIsAppPool table");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    // Get a CaScript key
+    hr = WcaCaScriptCreateKey(&pwzScriptKey);
+    ExitOnFailure(hr, "Failed to get encoding key.");
+
+    // Generate a unique string to be used for this product's transaction
+    // This prevents a name collision when doing a major upgrade
+    hr = WcaGetProperty(L"ProductCode", &pwzBackupId);
+    ExitOnFailure(hr, "failed to get ProductCode");
+
+    hr = StrAllocConcat(&pwzBackupId, L"ScaConfigureIIs", 0);
+    ExitOnFailure(hr, "failed to concat ScaConfigureIIs");
+
+    // make sure the operations below are wrapped in a "transaction"
+    // use IIS7 transaction logic even if using Iis6 compat because Backup/Restore don't work with metabase compatibility
+    if (MSICONDITION_TRUE == ::MsiEvaluateConditionW(hInstall, IIS7CONDITION))
+    {
+        hr = ScaIIS7ConfigTransaction(pwzBackupId);
+        MessageExitOnFailure(hr, msierrIISFailedSchedTransaction, "failed to start IIS7 transaction");
+    }
+    else
+    {
+        hr = ScaMetabaseTransaction(pwzBackupId);
+        MessageExitOnFailure(hr, msierrIISFailedSchedTransaction, "failed to start IIS transaction");
+    }
+
+    // Write the CaScript key to the ConfigureIIS custom action data
+    hr = WcaWriteStringToCaData(pwzScriptKey, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to add encoding key to CustomActionData.");
+
+    // Wrap vcsUserDeferredQuery to send to deferred CA
+    if (S_OK == WcaTableExists(L"User"))
+    {
+        hr = WcaWrapQuery(vcsUserDeferredQuery, &pwzCustomActionData, efmcColumn3 | efmcColumn4 | efmcColumn5, 0xFFFFFFFF, 0xFFFFFFFF);
+        ExitOnFailure(hr, "Failed to wrap User query");
+    }
+    else
+    {
+        hr = WcaWrapEmptyQuery(&pwzCustomActionData);
+        ExitOnFailure(hr, "Failed to wrap User empty query");
+    }
+
+    // Wrap vcsWebSvcExtQuery to send to deferred CA
+    if (S_OK == WcaTableExists(L"IIsWebServiceExtension"))
+    {
+        hr = WcaWrapQuery(vcsWebSvcExtQuery, &pwzCustomActionData, efmcColumn2 | efmcColumn3 | efmcColumn4, 1, 0xFFFFFFFF);
+        ExitOnFailure(hr, "Failed to wrap IIsWebServiceExtension query");
+    }
+    else
+    {
+        hr = WcaWrapEmptyQuery(&pwzCustomActionData);
+        ExitOnFailure(hr, "Failed to wrap IIsWebServiceExtension empty query");
+    }
+
+    // Wrap vcsAppPoolQuery to send to deferred CA
+    if (S_OK == WcaTableExists(L"IIsAppPool"))
+    {
+        hr = WcaWrapQuery(vcsAppPoolQuery, &pwzCustomActionData, efmcColumn2 | efmcColumn15 | efmcColumn16, 3, 0xFFFFFFFF);
+        ExitOnFailure(hr, "Failed to wrap IIsAppPool query");
+
+        hr = WcaWrapQuery(vcsComponentAttrQuery, &pwzCustomActionData, 0, 0xFFFFFFFF, 0xFFFFFFFF);
+        ExitOnFailure(hr, "Failed to wrap Component query");
+    }
+    else
+    {
+        hr = WcaWrapEmptyQuery(&pwzCustomActionData);
+        ExitOnFailure(hr, "Failed to wrap IIsAppPool empty query");
+    }
+
+    // Wrap vcsMimeMapQuery to send to deferred CA
+    if (S_OK == WcaTableExists(L"IIsMimeMap"))
+    {
+        hr = WcaWrapQuery(vcsMimeMapQuery, &pwzCustomActionData, efmcColumn4 | efmcColumn5, 0xFFFFFFFF, 0xFFFFFFFF);
+        ExitOnFailure(hr, "Failed to wrap IIsMimeMap query");
+    }
+    else
+    {
+        hr = WcaWrapEmptyQuery(&pwzCustomActionData);
+        ExitOnFailure(hr, "Failed to wrap IIsMimeMap empty query");
+    }
+
+    // Wrap vcsHttpHeaderQuery to send to deferred CA
+    if (S_OK == WcaTableExists(L"IIsHttpHeader"))
+    {
+        hr = WcaWrapQuery(vcsHttpHeaderQuery, &pwzCustomActionData, efmcColumn1 | efmcColumn4, 0xFFFFFFFF, 0xFFFFFFFF);
+        ExitOnFailure(hr, "Failed to wrap IIsHttpHeader query");
+    }
+    else
+    {
+        hr = WcaWrapEmptyQuery(&pwzCustomActionData);
+        ExitOnFailure(hr, "Failed to wrap IIsHttpHeader empty query");
+    }
+
+    // Wrap vcsWebErrorQuery to send to deferred CA
+    if (S_OK == WcaTableExists(L"IIsWebError"))
+    {
+        hr = WcaWrapQuery(vcsWebErrorQuery, &pwzCustomActionData, efmcColumn5 | efmcColumn6, 0xFFFFFFFF, 0xFFFFFFFF);
+        ExitOnFailure(hr, "Failed to wrap IIsWebError query");
+    }
+    else
+    {
+        hr = WcaWrapEmptyQuery(&pwzCustomActionData);
+        ExitOnFailure(hr, "Failed to wrap IIsWebError empty query");
+    }
+
+    // Wrap vcsWebDirPropertiesQuery to send to deferred CA
+    if (S_OK == WcaTableExists(L"IIsWebDirProperties"))
+    {
+        hr = WcaWrapQuery(vcsWebDirPropertiesQuery, &pwzCustomActionData, efmcColumn8 | efmcColumn10 | efmcColumn12 | efmcColumn15, 0xFFFFFFFF, 0xFFFFFFFF);
+        ExitOnFailure(hr, "Failed to wrap IIsWebDirProperties query");
+    }
+    else
+    {
+        hr = WcaWrapEmptyQuery(&pwzCustomActionData);
+        ExitOnFailure(hr, "Failed to wrap IIsWebDirProperties empty query");
+    }
+
+    // Wrap vcsSslCertificateQuery to send to deferred CA
+    if (S_OK == WcaTableExists(L"Certificate") && S_OK == WcaTableExists(L"CertificateHash") && S_OK == WcaTableExists(L"IIsWebSiteCertificates"))
+    {
+        hr = WcaWrapQuery(vcsSslCertificateQuery, &pwzCustomActionData, 0, 0xFFFFFFFF, 0xFFFFFFFF);
+        ExitOnFailure(hr, "Failed to wrap SslCertificate query");
+    }
+    else
+    {
+        hr = WcaWrapEmptyQuery(&pwzCustomActionData);
+        ExitOnFailure(hr, "Failed to wrap SslCertificate empty query");
+    }
+
+    // Wrap vcsWebLogQuery to send to deferred CA
+    if (S_OK == WcaTableExists(L"IIsWebLog"))
+    {
+        hr = WcaWrapQuery(vcsWebLogQuery, &pwzCustomActionData, efmcColumn2, 0xFFFFFFFF, 0xFFFFFFFF);
+        ExitOnFailure(hr, "Failed to wrap IIsWebLog query");
+    }
+    else
+    {
+        hr = WcaWrapEmptyQuery(&pwzCustomActionData);
+        ExitOnFailure(hr, "Failed to wrap IIsWebLog empty query");
+    }
+
+    // Wrap vcsWebApplicationQuery to send to deferred CA
+    if (S_OK == WcaTableExists(L"IIsWebApplication"))
+    {
+        hr = WcaWrapQuery(vcsWebApplicationQuery, &pwzCustomActionData, efmcColumn1, 0xFFFFFFFF, 0xFFFFFFFF);
+        ExitOnFailure(hr, "Failed to wrap IIsWebApplication query");
+    }
+    else
+    {
+        hr = WcaWrapEmptyQuery(&pwzCustomActionData);
+        ExitOnFailure(hr, "Failed to wrap IIsWebApplication empty query");
+    }
+
+    // Wrap vcsWebAppExtensionQuery to send to deferred CA
+    if (S_OK == WcaTableExists(L"IIsWebApplicationExtension"))
+    {
+        hr = WcaWrapQuery(vcsWebAppExtensionQuery, &pwzCustomActionData, efmcColumn2 | efmcColumn3, 0xFFFFFFFF, 0xFFFFFFFF);
+        ExitOnFailure(hr, "Failed to wrap IIsWebApplicationExtension query");
+    }
+    else
+    {
+        hr = WcaWrapEmptyQuery(&pwzCustomActionData);
+        ExitOnFailure(hr, "Failed to wrap IIsWebApplicationExtension empty query");
+    }
+
+    // Wrap vcsWebQuery, vcsWebAddressQuery, and vcsWebBaseQuery to send to deferred CA
+    if (S_OK == WcaTableExists(L"IIsWebAddress") && S_OK == WcaTableExists(L"IIsWebSite"))
+    {
+        hr = WcaWrapQuery(vcsWebQuery, &pwzCustomActionData, efmcColumn3 | efmcColumn4 | efmcColumn12 | efmcColumn13 | efmcColumn14, 2, 6);
+        ExitOnFailure(hr, "Failed to wrap IIsWebSite query");
+
+        hr = WcaWrapQuery(vcsWebAddressQuery, &pwzCustomActionData, efmcColumn3 | efmcColumn4 | efmcColumn5, 0xFFFFFFFF, 0xFFFFFFFF);
+        ExitOnFailure(hr, "Failed to wrap IIsWebAddress query");
+
+        hr = WcaWrapQuery(vcsWebBaseQuery, &pwzCustomActionData, efmcColumn2 | efmcColumn3 | efmcColumn4 | efmcColumn5 | efmcColumn7, 0xFFFFFFFF, 0xFFFFFFFF);
+        ExitOnFailure(hr, "Failed to wrap IIsWebBase query");
+    }
+    else
+    {
+        hr = WcaWrapEmptyQuery(&pwzCustomActionData);
+        ExitOnFailure(hr, "Failed to wrap IIsWebSite empty query");
+
+        hr = WcaWrapEmptyQuery(&pwzCustomActionData);
+        ExitOnFailure(hr, "Failed to wrap IIsWebAddress empty query");
+
+        hr = WcaWrapEmptyQuery(&pwzCustomActionData);
+        ExitOnFailure(hr, "Failed to wrap IIsWebBase empty query");
+    }
+
+    // Wrap vcsWebDirQuery to send to deferred CA
+    if (S_OK == WcaTableExists(L"IIsWebDir"))
+    {
+        hr = WcaWrapQuery(vcsWebDirQuery, &pwzCustomActionData, efmcColumn4, 3, 0xFFFFFFFF);
+        ExitOnFailure(hr, "Failed to wrap IIsWebDir query");
+    }
+    else
+    {
+        hr = WcaWrapEmptyQuery(&pwzCustomActionData);
+        ExitOnFailure(hr, "Failed to wrap IIsWebDir empty query");
+    }
+
+    // Wrap vcsVDirQuery to send to deferred CA
+    if (S_OK == WcaTableExists(L"IIsWebVirtualDir"))
+    {
+        hr = WcaWrapQuery(vcsVDirQuery, &pwzCustomActionData, efmcColumn4, 3, 5);
+        ExitOnFailure(hr, "Failed to wrap IIsWebVirtualDir query");
+    }
+    else
+    {
+        hr = WcaWrapEmptyQuery(&pwzCustomActionData);
+        ExitOnFailure(hr, "Failed to wrap IIsWebVirtualDir empty query");
+    }
+
+    // Wrap vcsFilterQuery to send to deferred CA
+    if (S_OK == WcaTableExists(L"IIsFilter"))
+    {
+        hr = WcaWrapQuery(vcsFilterQuery, &pwzCustomActionData, efmcColumn4 | efmcColumn5, 3, 0xFFFFFFFF);
+        ExitOnFailure(hr, "Failed to wrap IIsFilter query");
+    }
+    else
+    {
+        hr = WcaWrapEmptyQuery(&pwzCustomActionData);
+        ExitOnFailure(hr, "Failed to wrap IIsFilter empty query");
+    }
+
+    // Wrap vcsPropertyQuery to send to deferred CA
+    if (S_OK == WcaTableExists(L"IIsProperty"))
+    {
+        hr = WcaWrapQuery(vcsPropertyQuery, &pwzCustomActionData, efmcColumn4, 2, 0xFFFFFFFF);
+        ExitOnFailure(hr, "Failed to wrap IIsProperty query");
+    }
+    else
+    {
+        hr = WcaWrapEmptyQuery(&pwzCustomActionData);
+        ExitOnFailure(hr, "Failed to wrap IIsProperty empty query");
+    }
+
+    if (MSICONDITION_TRUE == ::MsiEvaluateConditionW(hInstall, USEIIS7CONDITION))
+    {
+        // This must remain trace only, CA data may contain password
+        WcaLog(LOGMSG_TRACEONLY, "Custom Action Data for ConfigureIIS7Exec will be: %ls", pwzCustomActionData);
+
+        hr = WcaDoDeferredAction(L"ConfigureIIs7Exec", pwzCustomActionData, ConfigureIIsCost);
+        ExitOnFailure(hr, "Failed to schedule ConfigureIIs7Exec custom action");
+
+        ReleaseNullStr(pwzCustomActionData);
+
+        // Write the CaScript key to the ConfigureIIS custom action data
+        hr = WcaWriteStringToCaData(pwzScriptKey, &pwzCustomActionData);
+        ExitOnFailure(hr, "Failed to add script key to CustomActionData.");
+
+        hr = WcaDoDeferredAction(L"WriteIIS7ConfigChanges", pwzCustomActionData, WriteIIS7ConfigChangesCost);
+        ExitOnFailure(hr, "Failed to schedule WriteMetabaseChanges custom action");
+    }
+    else
+    {
+        // This must remain trace only, CA data may contain password
+        WcaLog(LOGMSG_TRACEONLY, "Custom Action Data for ConfigureIISExec will be: %ls", pwzCustomActionData);
+
+        hr = WcaDoDeferredAction(L"ConfigureIIsExec", pwzCustomActionData, ConfigureIIsCost);
+        ExitOnFailure(hr, "Failed to schedule ConfigureIISExec custom action");
+
+        ReleaseNullStr(pwzCustomActionData);
+
+        // Write the CaScript key to the ConfigureIIS custom action data
+        hr = WcaWriteStringToCaData(pwzScriptKey, &pwzCustomActionData);
+        ExitOnFailure(hr, "Failed to add script key to CustomActionData.");
+
+        hr = WcaDoDeferredAction(L"WriteMetabaseChanges", pwzCustomActionData, WriteMetabaseChangesCost);
+        ExitOnFailure(hr, "Failed to schedule WriteMetabaseChanges custom action");
+    }
+
+LExit:
+    ReleaseStr(pwzScriptKey);
+    ReleaseStr(pwzBackupId);
+    ReleaseStr(pwzCustomActionData);
+
+    er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+/********************************************************************
+ConfigureIIsExec - custom action for installing IIs settings - table
+data will be wrapped and passed in from immediate CA
+ReadIIsTables
+
+********************************************************************/
+extern "C" UINT __stdcall ConfigureIIsExec(
+    __in MSIHANDLE hInstall
+    )
+{
+    //AssertSz(FALSE, "debug ConfigureIIsExec here");
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    BOOL fInitializedCom = FALSE;
+    IMSAdminBase* piMetabase = NULL;
+
+    SCA_WEB* pswList = NULL;
+    SCA_WEBDIR* pswdList = NULL;
+    SCA_VDIR* psvdList = NULL;
+    SCA_FILTER* psfList = NULL;
+    SCA_APPPOOL *psapList = NULL;
+    SCA_MIMEMAP* psmmList = NULL;
+    SCA_HTTP_HEADER* pshhList = NULL;
+    SCA_PROPERTY *pspList = NULL;
+    SCA_WEBSVCEXT* psWseList = NULL;
+    SCA_WEB_ERROR* psweList = NULL;
+
+    LPWSTR pwzScriptKey = NULL;
+    LPWSTR pwzCustomActionData = NULL;
+
+    WCA_WRAPQUERY_HANDLE hUserQuery = NULL;
+    WCA_WRAPQUERY_HANDLE hWebBaseQuery = NULL;
+    WCA_WRAPQUERY_HANDLE hWebDirPropQuery = NULL;
+    WCA_WRAPQUERY_HANDLE hSslCertQuery = NULL;
+    WCA_WRAPQUERY_HANDLE hWebLogQuery = NULL;
+    WCA_WRAPQUERY_HANDLE hWebAppQuery = NULL;
+    WCA_WRAPQUERY_HANDLE hWebAppExtQuery = NULL;
+
+    // initialize
+    hr = WcaInitialize(hInstall, "ConfigureIIsExec");
+    ExitOnFailure(hr, "Failed to initialize");
+
+    hr = WcaGetProperty(L"CustomActionData", &pwzCustomActionData);
+    ExitOnFailure(hr, "failed to get CustomActionData");
+
+    // Get the CaScript key
+    hr = WcaReadStringFromCaData(&pwzCustomActionData, &pwzScriptKey);
+    ExitOnFailure(hr, "Failed to get CaScript key from custom action data");
+
+    hr = ::CoInitialize(NULL);
+    ExitOnFailure(hr, "failed to initialize COM");
+    fInitializedCom = TRUE;
+
+    // if IIS was uninstalled (thus no IID_IMSAdminBase) allow the
+    // user to still uninstall this package by clicking "Ignore"
+    do
+    {
+        hr = ::CoCreateInstance(CLSID_MSAdminBase, NULL, CLSCTX_ALL, IID_IMSAdminBase, (void**)&piMetabase);
+        if (FAILED(hr))
+        {
+            WcaLog(LOGMSG_STANDARD, "failed to get IID_IMSAdminBase Object");
+            er = WcaErrorMessage(msierrIISCannotConnect, hr, INSTALLMESSAGE_ERROR | MB_ABORTRETRYIGNORE, 0);
+            switch (er)
+            {
+            case IDABORT:
+                ExitFunction();   // bail with the error result from the CoCreate to kick off a rollback
+            case IDRETRY:
+                hr = S_FALSE;   // hit me, baby, one more time
+                break;
+            case IDIGNORE:
+                __fallthrough;
+            default:
+                WcaLog(LOGMSG_STANDARD, "ignoring absent IIS");
+                // We need to write the empty script to communicate to other deferred CA that there is noting to do.
+                hr = ScaWriteConfigurationScript(pwzScriptKey);
+                ExitOnFailure(hr, "failed to schedule metabase configuration");
+
+                ExitFunction1(hr = S_OK);  // pretend everything is okay
+                break;
+            }
+        }
+    } while (S_FALSE == hr);
+
+    // read the msi tables
+    hr = WcaBeginUnwrapQuery(&hUserQuery, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap user query");
+
+    hr = ScaWebSvcExtRead(&psWseList, &pwzCustomActionData);
+    MessageExitOnFailure(hr, msierrIISFailedReadWebSvcExt, "failed while processing WebServiceExtensions");
+
+    hr = ScaAppPoolRead(&psapList, hUserQuery, &pwzCustomActionData);
+    MessageExitOnFailure(hr, msierrIISFailedReadAppPool, "failed while processing WebAppPools");
+
+    // MimeMap, Error and HttpHeader need to be read before the virtual directory and web read
+    hr = ScaMimeMapRead(&psmmList, &pwzCustomActionData);
+    MessageExitOnFailure(hr, msierrIISFailedReadMimeMap, "failed while processing MimeMaps");
+
+    hr = ScaHttpHeaderRead(&pshhList, &pwzCustomActionData);
+    MessageExitOnFailure(hr, msierrIISFailedReadHttpHeader, "failed while processing HttpHeaders");
+
+    hr = ScaWebErrorRead(&psweList, &pwzCustomActionData);
+    MessageExitOnFailure(hr, msierrIISFailedReadWebError, "failed while processing WebErrors");
+
+    hr = WcaBeginUnwrapQuery(&hWebDirPropQuery, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap web dir properties query");
+
+    hr = WcaBeginUnwrapQuery(&hSslCertQuery, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap ssl certificate query");
+
+    hr = WcaBeginUnwrapQuery(&hWebLogQuery, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap web log query");
+
+    hr = WcaBeginUnwrapQuery(&hWebAppQuery, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap web application query");
+
+    hr = WcaBeginUnwrapQuery(&hWebAppExtQuery, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap web application extension query");
+
+    hr = ScaWebsRead(piMetabase, &psmmList, &pswList, &pshhList, &psweList, hUserQuery, hWebDirPropQuery, hSslCertQuery, hWebLogQuery, hWebAppQuery, hWebAppExtQuery, &pwzCustomActionData);
+    MessageExitOnFailure(hr, msierrIISFailedReadWebSite, "failed while processing WebSites");
+
+    hr = WcaBeginUnwrapQuery(&hWebBaseQuery, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap web base query");
+
+    hr = ScaWebDirsRead(piMetabase, pswList, hUserQuery, hWebBaseQuery, hWebDirPropQuery, hWebAppQuery, hWebAppExtQuery, &pwzCustomActionData, &pswdList);
+    MessageExitOnFailure(hr, msierrIISFailedReadWebDirs, "failed while processing WebDirs");
+
+    hr = ScaVirtualDirsRead(piMetabase, pswList, &psvdList, &psmmList, &pshhList, &psweList, hUserQuery, hWebBaseQuery, hWebDirPropQuery, hWebAppQuery, hWebAppExtQuery, &pwzCustomActionData);
+    MessageExitOnFailure(hr, msierrIISFailedReadVDirs, "failed while processing WebVirtualDirs");
+
+    hr = ScaFiltersRead(piMetabase, pswList, hWebBaseQuery, &psfList, &pwzCustomActionData);
+    MessageExitOnFailure(hr, msierrIISFailedReadFilters, "failed while processing WebFilters");
+
+    hr = ScaPropertyRead(&pspList, &pwzCustomActionData);
+    MessageExitOnFailure(hr, msierrIISFailedReadProp, "failed while processing WebProperties");
+
+    // do uninstall actions (order is important!)
+    hr = ScaPropertyUninstall(piMetabase, pspList);
+    MessageExitOnFailure(hr, msierrIISFailedSchedUninstallProp, "failed to uninstall IIS properties");
+
+    hr = ScaFiltersUninstall(piMetabase, psfList);
+    MessageExitOnFailure(hr, msierrIISFailedSchedUninstallFilters, "failed to schedule uninstall of filters");
+
+    hr = ScaVirtualDirsUninstall(piMetabase, psvdList);
+    MessageExitOnFailure(hr, msierrIISFailedSchedUninstallVDirs, "failed to schedule uninstall of virtual directories");
+
+    hr = ScaWebDirsUninstall(piMetabase, pswdList);
+    MessageExitOnFailure(hr, msierrIISFailedSchedUninstallWebDirs, "failed to schedule uninstall of web directories");
+
+    hr = ScaWebsUninstall(piMetabase, pswList);
+    MessageExitOnFailure(hr, msierrIISFailedSchedUninstallWebs, "failed to schedule uninstall of webs");
+
+    hr = ScaAppPoolUninstall(piMetabase, psapList);
+    MessageExitOnFailure(hr, msierrIISFailedSchedUninstallAppPool, "failed to schedule uninstall of AppPools");
+
+
+    // do install actions (order is important!)
+    // ScaWebSvcExtCommit contains both uninstall and install actions.
+    hr = ScaWebSvcExtCommit(piMetabase, psWseList);
+    MessageExitOnFailure(hr, msierrIISFailedSchedInstallWebSvcExt, "failed to schedule install/uninstall of WebSvcExt");
+
+    hr = ScaAppPoolInstall(piMetabase, psapList);
+    MessageExitOnFailure(hr, msierrIISFailedSchedInstallAppPool, "failed to schedule install of AppPools");
+
+    hr = ScaWebsInstall(piMetabase, pswList, psapList);
+    MessageExitOnFailure(hr, msierrIISFailedSchedInstallWebs, "failed to schedule install of webs");
+
+    hr = ScaWebDirsInstall(piMetabase, pswdList, psapList);
+    MessageExitOnFailure(hr, msierrIISFailedSchedInstallWebDirs, "failed to schedule install of web directories");
+
+    hr = ScaVirtualDirsInstall(piMetabase, psvdList, psapList);
+    MessageExitOnFailure(hr, msierrIISFailedSchedInstallVDirs, "failed to schedule install of virtual directories");
+
+    hr = ScaFiltersInstall(piMetabase, psfList);
+    MessageExitOnFailure(hr, msierrIISFailedSchedInstallFilters, "failed to schedule install of filters");
+
+    hr = ScaPropertyInstall(piMetabase, pspList);
+    MessageExitOnFailure(hr, msierrIISFailedSchedInstallProp, "failed to schedule install of properties");
+
+    hr = ScaWriteConfigurationScript(pwzScriptKey);
+    ExitOnFailure(hr, "failed to schedule metabase configuration");
+
+LExit:
+    ReleaseStr(pwzScriptKey);
+    ReleaseStr(pwzCustomActionData);
+
+    WcaFinishUnwrapQuery(hUserQuery);
+    WcaFinishUnwrapQuery(hWebBaseQuery);
+    WcaFinishUnwrapQuery(hWebDirPropQuery);
+    WcaFinishUnwrapQuery(hSslCertQuery);
+    WcaFinishUnwrapQuery(hWebLogQuery);
+    WcaFinishUnwrapQuery(hWebAppQuery);
+    WcaFinishUnwrapQuery(hWebAppExtQuery);
+
+    if (psWseList)
+    {
+        ScaWebSvcExtFreeList(psWseList);
+    }
+
+    if (psfList)
+    {
+        ScaFiltersFreeList(psfList);
+    }
+
+    if (psvdList)
+    {
+        ScaVirtualDirsFreeList(psvdList);
+    }
+
+    if (pswdList)
+    {
+        ScaWebDirsFreeList(pswdList);
+    }
+
+    if (pswList)
+    {
+        ScaWebsFreeList(pswList);
+    }
+
+    if (psmmList)
+    {
+        ScaMimeMapCheckList(psmmList);
+        ScaMimeMapFreeList(psmmList);
+    }
+
+    if (pshhList)
+    {
+        ScaHttpHeaderCheckList(pshhList);
+        ScaHttpHeaderFreeList(pshhList);
+    }
+
+    if (psweList)
+    {
+        ScaWebErrorCheckList(psweList);
+        ScaWebErrorFreeList(psweList);
+    }
+
+    ReleaseObject(piMetabase);
+
+    if (fInitializedCom)
+    {
+        ::CoUninitialize();
+    }
+
+    er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+
+/********************************************************************
+ConfigureIIs - CUSTOM ACTION ENTRY POINT for installing IIs settings
+
+********************************************************************/
+extern "C" UINT __stdcall ConfigureIIs7Exec(
+    __in MSIHANDLE hInstall
+    )
+{
+    //AssertSz(FALSE, "debug ConfigureIIs7Exec here");
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    LPWSTR pwzScriptKey = NULL;
+    LPWSTR pwzCustomActionData = NULL;
+
+    SCA_WEB7* pswList = NULL;
+    SCA_WEBDIR7* pswdList = NULL;
+    SCA_VDIR7* psvdList = NULL;
+    SCA_FILTER* psfList = NULL;
+    SCA_APPPOOL *psapList = NULL;
+    SCA_MIMEMAP* psmmList = NULL;
+    SCA_HTTP_HEADER* pshhList = NULL;
+    SCA_PROPERTY *pspList = NULL;
+    SCA_WEBSVCEXT* psWseList = NULL;
+    SCA_WEB_ERROR* psweList = NULL;
+
+    WCA_WRAPQUERY_HANDLE hUserQuery = NULL;
+    WCA_WRAPQUERY_HANDLE hWebBaseQuery = NULL;
+    WCA_WRAPQUERY_HANDLE hWebDirPropQuery = NULL;
+    WCA_WRAPQUERY_HANDLE hSslCertQuery = NULL;
+    WCA_WRAPQUERY_HANDLE hWebLogQuery = NULL;
+    WCA_WRAPQUERY_HANDLE hWebAppQuery = NULL;
+    WCA_WRAPQUERY_HANDLE hWebAppExtQuery = NULL;
+
+    // initialize
+    hr = WcaInitialize(hInstall, "ConfigureIIs7Exec");
+    ExitOnFailure(hr, "Failed to initialize");
+
+    hr = WcaGetProperty(L"CustomActionData", &pwzCustomActionData);
+    ExitOnFailure(hr, "failed to get CustomActionData");
+
+    // Get the CaScript key
+    hr = WcaReadStringFromCaData(&pwzCustomActionData, &pwzScriptKey);
+    ExitOnFailure(hr, "Failed to get CaScript key from custom action data");
+
+    // read the msi tables
+    hr = WcaBeginUnwrapQuery(&hUserQuery, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap user query");
+
+    hr = ScaWebSvcExtRead(&psWseList, &pwzCustomActionData);
+    MessageExitOnFailure(hr, msierrIISFailedReadWebSvcExt, "failed while processing WebServiceExtensions");
+
+    hr = ScaAppPoolRead(&psapList, hUserQuery, &pwzCustomActionData);
+    MessageExitOnFailure(hr, msierrIISFailedReadAppPool, "failed while processing WebAppPools");
+
+    // MimeMap, Error and HttpHeader need to be read before the virtual directory and web read
+    hr = ScaMimeMapRead(&psmmList, &pwzCustomActionData);
+    MessageExitOnFailure(hr, msierrIISFailedReadMimeMap, "failed while processing MimeMaps");
+
+    hr = ScaHttpHeaderRead(&pshhList, &pwzCustomActionData);
+    MessageExitOnFailure(hr, msierrIISFailedReadHttpHeader, "failed while processing HttpHeaders");
+
+    hr = ScaWebErrorRead(&psweList, &pwzCustomActionData);
+    MessageExitOnFailure(hr, msierrIISFailedReadWebError, "failed while processing WebErrors");
+
+    hr = WcaBeginUnwrapQuery(&hWebDirPropQuery, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap web dir properties query");
+
+    hr = WcaBeginUnwrapQuery(&hSslCertQuery, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap ssl certificate query");
+
+    hr = WcaBeginUnwrapQuery(&hWebLogQuery, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap web log query");
+
+    hr = WcaBeginUnwrapQuery(&hWebAppQuery, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap web application query");
+
+    hr = WcaBeginUnwrapQuery(&hWebAppExtQuery, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap web application extension query");
+
+    hr = ScaWebsRead7(&pswList, &pshhList, &psweList, hUserQuery, hWebDirPropQuery, hSslCertQuery, hWebLogQuery, hWebAppQuery, hWebAppExtQuery, &pwzCustomActionData);
+    MessageExitOnFailure(hr, msierrIISFailedReadWebSite, "failed while processing WebSites");
+
+    hr = WcaBeginUnwrapQuery(&hWebBaseQuery, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap web base query");
+
+    hr = ScaWebDirsRead7(pswList, hUserQuery, hWebBaseQuery, hWebDirPropQuery, hWebAppQuery, hWebAppExtQuery, &pwzCustomActionData, &pswdList);
+    MessageExitOnFailure(hr, msierrIISFailedReadWebDirs, "failed while processing WebDirs");
+
+    hr = ScaVirtualDirsRead7(pswList, &psvdList, &psmmList, &pshhList, &psweList, hUserQuery, hWebBaseQuery, hWebDirPropQuery, hWebAppQuery, hWebAppExtQuery, &pwzCustomActionData);
+    MessageExitOnFailure(hr, msierrIISFailedReadVDirs, "failed while processing WebVirtualDirs");
+
+    hr = ScaFiltersRead7(pswList, hWebBaseQuery, &psfList, &pwzCustomActionData);
+    MessageExitOnFailure(hr, msierrIISFailedReadFilters, "failed while processing WebFilters");
+
+    hr = ScaPropertyRead(&pspList, &pwzCustomActionData);
+    MessageExitOnFailure(hr, msierrIISFailedReadProp, "failed while processing WebProperties");
+
+    // do uninstall actions (order is important!)
+    hr = ScaPropertyUninstall7(pspList);
+    MessageExitOnFailure(hr, msierrIISFailedSchedUninstallProp, "failed to uninstall IIS properties");
+
+    hr = ScaFiltersUninstall7(psfList);
+    MessageExitOnFailure(hr, msierrIISFailedSchedUninstallFilters, "failed to schedule uninstall of filters");
+
+    hr = ScaVirtualDirsUninstall7(psvdList);
+    MessageExitOnFailure(hr, msierrIISFailedSchedUninstallVDirs, "failed to schedule uninstall of virtual directories");
+
+    hr = ScaWebDirsUninstall7(pswdList);
+    MessageExitOnFailure(hr, msierrIISFailedSchedUninstallWebDirs, "failed to schedule uninstall of web directories");
+
+    hr = ScaWebsUninstall7(pswList);
+    MessageExitOnFailure(hr, msierrIISFailedSchedUninstallWebs, "failed to schedule uninstall of webs");
+
+    hr = ScaAppPoolUninstall7(psapList);
+    MessageExitOnFailure(hr, msierrIISFailedSchedUninstallAppPool, "failed to schedule uninstall of AppPools");
+
+
+    // do install actions (order is important!)
+    // ScaWebSvcExtCommit contains both uninstall and install actions.
+    hr = ScaWebSvcExtCommit7(psWseList);
+    MessageExitOnFailure(hr, msierrIISFailedSchedInstallWebSvcExt, "failed to schedule install/uninstall of WebSvcExt");
+
+    hr = ScaAppPoolInstall7(psapList);
+    MessageExitOnFailure(hr, msierrIISFailedSchedInstallAppPool, "failed to schedule install of AppPools");
+
+    hr = ScaWebsInstall7(pswList, psapList);
+    MessageExitOnFailure(hr, msierrIISFailedSchedInstallWebs, "failed to schedule install of webs");
+
+    hr = ScaWebDirsInstall7(pswdList, psapList);
+    MessageExitOnFailure(hr, msierrIISFailedSchedInstallWebDirs, "failed to schedule install of web directories");
+
+    hr = ScaVirtualDirsInstall7(psvdList, psapList);
+    MessageExitOnFailure(hr, msierrIISFailedSchedInstallVDirs, "failed to schedule install of virtual directories");
+
+    hr = ScaFiltersInstall7(psfList);
+    MessageExitOnFailure(hr, msierrIISFailedSchedInstallFilters, "failed to schedule install of filters");
+
+    hr = ScaPropertyInstall7(pspList);
+    MessageExitOnFailure(hr, msierrIISFailedSchedInstallProp, "failed to schedule install of properties");
+
+    hr = ScaWriteConfigurationScript(pwzScriptKey);
+    ExitOnFailure(hr, "failed to schedule metabase configuration");
+
+LExit:
+    ReleaseNullStr(pwzScriptKey);
+    ReleaseNullStr(pwzCustomActionData);
+
+    WcaFinishUnwrapQuery(hUserQuery);
+    WcaFinishUnwrapQuery(hWebBaseQuery);
+    WcaFinishUnwrapQuery(hWebDirPropQuery);
+    WcaFinishUnwrapQuery(hSslCertQuery);
+    WcaFinishUnwrapQuery(hWebLogQuery);
+    WcaFinishUnwrapQuery(hWebAppQuery);
+    WcaFinishUnwrapQuery(hWebAppExtQuery);
+
+    if (psWseList)
+    {
+        ScaWebSvcExtFreeList(psWseList);
+    }
+
+    if (psfList)
+    {
+        ScaFiltersFreeList(psfList);
+    }
+
+    if (psvdList)
+    {
+        ScaVirtualDirsFreeList7(psvdList);
+    }
+
+    if (pswdList)
+    {
+        ScaWebDirsFreeList7(pswdList);
+    }
+
+    if (pswList)
+    {
+        ScaWebsFreeList7(pswList);
+    }
+
+    if (psmmList)
+    {
+        ScaMimeMapFreeList(psmmList);
+    }
+
+    if (pshhList)
+    {
+        ScaHttpHeaderCheckList(pshhList);
+        ScaHttpHeaderFreeList(pshhList);
+    }
+
+    if (psweList)
+    {
+        ScaWebErrorCheckList(psweList);
+        ScaWebErrorFreeList(psweList);
+    }
+
+    er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
diff --git a/src/ca/scassl.cpp b/src/ca/scassl.cpp
new file mode 100644
index 00000000..4a06b77e
--- /dev/null
+++ b/src/ca/scassl.cpp
@@ -0,0 +1,115 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+enum eSslCertificateQuery { scqStoreName = 1, scqHash, scqWeb };
+
+static HRESULT AddSslCertificateToList(
+    __in SCA_WEB_SSL_CERTIFICATE** ppswscList
+    );
+
+
+HRESULT ScaSslCertificateRead(
+    __in LPCWSTR wzWebId,
+    __in WCA_WRAPQUERY_HANDLE hSslCertQuery,
+    __inout SCA_WEB_SSL_CERTIFICATE** ppswscList
+    )
+{
+    HRESULT hr = S_OK;
+
+    MSIHANDLE hRec;
+    SCA_WEB_SSL_CERTIFICATE* pswsc = NULL;
+    LPWSTR pwzData = NULL;
+
+    WcaFetchWrappedReset(hSslCertQuery);
+
+    // Get the certificate information.
+    while (S_OK == (hr = WcaFetchWrappedRecordWhereString(hSslCertQuery, scqWeb, wzWebId, &hRec)))
+    {
+        hr = AddSslCertificateToList(ppswscList);
+        ExitOnFailure(hr, "failed to add ssl certificate to list");
+
+        pswsc = *ppswscList;
+
+        hr = WcaGetRecordString(hRec, scqStoreName, &pwzData);
+        ExitOnFailure(hr, "Failed to get web ssl certificate store name.");
+
+        hr = ::StringCchCopyW(pswsc->wzStoreName, countof(pswsc->wzStoreName), pwzData);
+        ExitOnFailure(hr, "Failed to copy web ssl certificate store name.");
+
+        hr = WcaGetRecordString(hRec, scqHash, &pwzData);
+        ExitOnFailure(hr, "Failed to get hash for web ssl certificate.");
+
+        hr = StrHexDecode(pwzData, pswsc->rgbSHA1Hash, countof(pswsc->rgbSHA1Hash));
+        ExitOnFailure(hr, "Failed to decode certificate hash for web: %ls, data: %ls", wzWebId, pwzData);
+    }
+
+    if (E_NOMOREITEMS == hr)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "Failed to read IIsWebSiteCertificates table.");
+
+LExit:
+    ReleaseStr(pwzData);
+    return hr;
+}
+
+
+HRESULT ScaSslCertificateWriteMetabase(
+    __in IMSAdminBase* piMetabase,
+    __in LPCWSTR wzWebBase,
+    __in SCA_WEB_SSL_CERTIFICATE* pswscList
+    )
+{
+    HRESULT hr = S_OK;
+    BLOB blob;
+
+    for (SCA_WEB_SSL_CERTIFICATE* pswsc = pswscList; pswsc; pswsc = pswsc->pNext)
+    {
+        // Write: /W3SVC/1:SslCertStoreName = "MY", "CA", "Root", etc.
+        hr = ScaWriteMetabaseValue(piMetabase, wzWebBase, L"", MD_SSL_CERT_STORE_NAME, METADATA_INHERIT, IIS_MD_UT_SERVER, STRING_METADATA, static_cast<LPVOID>(pswsc->wzStoreName));
+        ExitOnFailure(hr, "Failed to write SslCertStoreName");
+
+        // Write: /W3SVC/1:SslCertHash = <blob>
+        blob.pBlobData = pswsc->rgbSHA1Hash;
+        blob.cbSize = countof(pswsc->rgbSHA1Hash);
+        hr = ScaWriteMetabaseValue(piMetabase, wzWebBase, L"", MD_SSL_CERT_HASH, METADATA_INHERIT, IIS_MD_UT_SERVER, BINARY_METADATA, static_cast<LPVOID>(&blob));
+        ExitOnFailure(hr, "Failed to write SslCertHash");
+    }
+
+LExit:
+    return hr;
+}
+
+
+void ScaSslCertificateFreeList(
+    __in SCA_WEB_SSL_CERTIFICATE* pswscList
+    )
+{
+    SCA_WEB_SSL_CERTIFICATE* pswscDelete = pswscList;
+    while (pswscList)
+    {
+        pswscDelete = pswscList;
+        pswscList = pswscList->pNext;
+
+        MemFree(pswscDelete);
+    }
+}
+
+
+static HRESULT AddSslCertificateToList(
+    __in SCA_WEB_SSL_CERTIFICATE** ppswscList
+    )
+{
+    HRESULT hr = S_OK;
+
+    SCA_WEB_SSL_CERTIFICATE* pswsc = static_cast<SCA_WEB_SSL_CERTIFICATE*>(MemAlloc(sizeof(SCA_WEB_SSL_CERTIFICATE), TRUE));
+    ExitOnNull(pswsc, hr, E_OUTOFMEMORY, "failed to allocate memory for new SSL certificate list element");
+
+    pswsc->pNext = *ppswscList;
+    *ppswscList = pswsc;
+
+LExit:
+    return hr;
+}
diff --git a/src/ca/scassl.h b/src/ca/scassl.h
new file mode 100644
index 00000000..df7c473d
--- /dev/null
+++ b/src/ca/scassl.h
@@ -0,0 +1,36 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+#define MD_SSL_CERT_HASH                ( IIS_MD_SSL_BASE+6 )
+#define MD_SSL_CERT_STORE_NAME          ( IIS_MD_SSL_BASE+11 )
+//#define WIDE(x)               WIDE2(x)
+//#define WIDE2(x)      L ## x
+
+
+// structs
+struct SCA_WEB_SSL_CERTIFICATE
+{
+    WCHAR wzStoreName[65];
+    BYTE rgbSHA1Hash[CB_CERTIFICATE_HASH];
+
+    SCA_WEB_SSL_CERTIFICATE* pNext;
+};
+
+
+// prototypes
+HRESULT ScaSslCertificateRead(
+    __in LPCWSTR wzWebId,
+    __in WCA_WRAPQUERY_HANDLE hSslCertQuery,
+    __inout SCA_WEB_SSL_CERTIFICATE** ppswscList
+    );
+
+HRESULT ScaSslCertificateWriteMetabase(
+    __in IMSAdminBase* piMetabase,
+    __in LPCWSTR wzWebBase,
+    __in SCA_WEB_SSL_CERTIFICATE* pswscList
+    );
+
+void ScaSslCertificateFreeList(
+    __in SCA_WEB_SSL_CERTIFICATE* pswscList
+    );
diff --git a/src/ca/scassl7.cpp b/src/ca/scassl7.cpp
new file mode 100644
index 00000000..47c16a9d
--- /dev/null
+++ b/src/ca/scassl7.cpp
@@ -0,0 +1,34 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+HRESULT ScaSslCertificateWrite7(
+    __in_z LPCWSTR wzWebBase,
+    __in SCA_WEB_SSL_CERTIFICATE* pswscList
+    )
+{
+    HRESULT hr = S_OK;
+    WCHAR wzEncodedCertificateHash[CB_CERTIFICATE_HASH * 2 + 1] = { 0 };
+
+    for (SCA_WEB_SSL_CERTIFICATE* pswsc = pswscList; pswsc; pswsc = pswsc->pNext)
+    {
+        hr = ScaWriteConfigID(IIS_SSL_BINDING);
+        ExitOnFailure(hr, "Failed write SSL binding ID");
+        hr = ScaWriteConfigID(IIS_CREATE);                      // Need to determine site action
+        ExitOnFailure(hr, "Failed write binding action");
+
+        hr = ScaWriteConfigString(wzWebBase);                   //site name key
+        ExitOnFailure(hr, "Failed to write SSL website");
+        hr = ScaWriteConfigString(pswsc->wzStoreName);          //ssl store name
+        ExitOnFailure(hr, "Failed to write SSL store name");
+
+        hr = StrHexEncode(pswsc->rgbSHA1Hash, countof(pswsc->rgbSHA1Hash), wzEncodedCertificateHash, countof(wzEncodedCertificateHash));
+        ExitOnFailure(hr, "Failed to encode SSL hash");
+
+        hr = ScaWriteConfigString(wzEncodedCertificateHash);    //ssl hash
+        ExitOnFailure(hr, "Failed to write SSL hash");
+    }
+LExit:
+
+    return hr;
+}
diff --git a/src/ca/scassl7.h b/src/ca/scassl7.h
new file mode 100644
index 00000000..1a4b09af
--- /dev/null
+++ b/src/ca/scassl7.h
@@ -0,0 +1,8 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+HRESULT ScaSslCertificateWrite7(
+    __in_z LPCWSTR wzWebBase,
+    __in SCA_WEB_SSL_CERTIFICATE* pswscList
+    );
diff --git a/src/ca/scauser.cpp b/src/ca/scauser.cpp
new file mode 100644
index 00000000..0b99edff
--- /dev/null
+++ b/src/ca/scauser.cpp
@@ -0,0 +1,91 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+LPCWSTR vcsUserQuery = L"SELECT `User`, `Component_`, `Name`, `Domain`, `Password` FROM `User` WHERE `User`=?";
+enum eUserQuery { vuqUser = 1, vuqComponent, vuqName, vuqDomain, vuqPassword };
+
+LPCWSTR vcsGroupQuery = L"SELECT `Group`, `Component_`, `Name`, `Domain` FROM `Group` WHERE `Group`=?";
+enum eGroupQuery { vgqGroup = 1, vgqComponent, vgqName, vgqDomain };
+
+LPCWSTR vcsUserGroupQuery = L"SELECT `User_`, `Group_` FROM `UserGroup` WHERE `User_`=?";
+enum eUserGroupQuery { vugqUser = 1, vugqGroup };
+
+LPCWSTR vActionableQuery = L"SELECT `User`,`Component_`,`Name`,`Domain`,`Password`,`Attributes` FROM `User` WHERE `Component_` IS NOT NULL";
+enum eActionableQuery { vaqUser = 1, vaqComponent, vaqName, vaqDomain, vaqPassword, vaqAttributes };
+
+HRESULT __stdcall ScaGetUserDeferred(
+    __in LPCWSTR wzUser,
+    __in WCA_WRAPQUERY_HANDLE hUserQuery,
+    __out SCA_USER* pscau
+    )
+{
+    if (!wzUser || !pscau)
+    {
+        return E_INVALIDARG;
+    }
+
+    HRESULT hr = S_OK;
+    MSIHANDLE hRec, hRecTest;
+
+    LPWSTR pwzData = NULL;
+
+    // clear struct and bail right away if no user key was passed to search for
+    ::ZeroMemory(pscau, sizeof(*pscau));
+    if (!*wzUser)
+    {
+        ExitFunction1(hr = S_OK);
+    }
+
+    // Reset back to the first record
+    WcaFetchWrappedReset(hUserQuery);
+
+    hr = WcaFetchWrappedRecordWhereString(hUserQuery, vuqUser, wzUser, &hRec);
+    if (S_OK == hr)
+    {
+        hr = WcaFetchWrappedRecordWhereString(hUserQuery, vuqUser, wzUser, &hRecTest);
+        if (S_OK == hr)
+        {
+            AssertSz(FALSE, "Found multiple matching User rows");
+        }
+
+        hr = WcaGetRecordString(hRec, vuqUser, &pwzData);
+        ExitOnFailure(hr, "Failed to get User.User");
+        hr = ::StringCchCopyW(pscau->wzKey, countof(pscau->wzKey), pwzData);
+        ExitOnFailure(hr, "Failed to copy key string to user object (in deferred CA)");
+
+        hr = WcaGetRecordString(hRec, vuqComponent, &pwzData);
+        ExitOnFailure(hr, "Failed to get User.Component_");
+        hr = ::StringCchCopyW(pscau->wzComponent, countof(pscau->wzComponent), pwzData);
+        ExitOnFailure(hr, "Failed to copy component string to user object (in deferred CA)");
+
+        hr = WcaGetRecordString(hRec, vuqName, &pwzData);
+        ExitOnFailure(hr, "Failed to get User.Name");
+        hr = ::StringCchCopyW(pscau->wzName, countof(pscau->wzName), pwzData);
+        ExitOnFailure(hr, "Failed to copy name string to user object (in deferred CA)");
+
+        hr = WcaGetRecordString(hRec, vuqDomain, &pwzData);
+        ExitOnFailure(hr, "Failed to get User.Domain");
+        hr = ::StringCchCopyW(pscau->wzDomain, countof(pscau->wzDomain), pwzData);
+        ExitOnFailure(hr, "Failed to copy domain string to user object (in deferred CA)");
+
+        hr = WcaGetRecordString(hRec, vuqPassword, &pwzData);
+        ExitOnFailure(hr, "Failed to get User.Password");
+        hr = ::StringCchCopyW(pscau->wzPassword, countof(pscau->wzPassword), pwzData);
+        ExitOnFailure(hr, "Failed to copy password string to user object (in deferred CA)");
+    }
+    else if (E_NOMOREITEMS == hr)
+    {
+        WcaLog(LOGMSG_STANDARD, "Error: Cannot locate User.User='%ls'", wzUser);
+        hr = E_FAIL;
+    }
+    else
+    {
+        ExitOnFailure(hr, "Error fetching single User row");
+    }
+
+LExit:
+    ReleaseStr(pwzData);
+
+    return hr;
+}
diff --git a/src/ca/scauser.h b/src/ca/scauser.h
new file mode 100644
index 00000000..b2b94650
--- /dev/null
+++ b/src/ca/scauser.h
@@ -0,0 +1,39 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+// structs
+struct SCA_GROUP
+{
+    WCHAR wzKey[MAX_DARWIN_KEY + 1];
+    WCHAR wzComponent[MAX_DARWIN_KEY + 1];
+
+    WCHAR wzDomain[MAX_DARWIN_COLUMN + 1];
+    WCHAR wzName[MAX_DARWIN_COLUMN + 1];
+
+    SCA_GROUP *psgNext;
+};
+
+struct SCA_USER
+{
+    WCHAR wzKey[MAX_DARWIN_KEY + 1];
+    WCHAR wzComponent[MAX_DARWIN_KEY + 1];
+    INSTALLSTATE isInstalled;
+    INSTALLSTATE isAction;
+
+    WCHAR wzDomain[MAX_DARWIN_COLUMN + 1];
+    WCHAR wzName[MAX_DARWIN_COLUMN + 1];
+    WCHAR wzPassword[MAX_DARWIN_COLUMN + 1];
+    INT iAttributes;
+
+    SCA_GROUP *psgGroups;
+
+    SCA_USER *psuNext;
+};
+
+
+// prototypes
+HRESULT __stdcall ScaGetUserDeferred(
+    __in LPCWSTR wzUser, 
+    __in WCA_WRAPQUERY_HANDLE hUserQuery,
+    __out SCA_USER* pscau
+    );
diff --git a/src/ca/scavdir.cpp b/src/ca/scavdir.cpp
new file mode 100644
index 00000000..d388ce97
--- /dev/null
+++ b/src/ca/scavdir.cpp
@@ -0,0 +1,331 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+// prototypes
+static HRESULT AddVirtualDirToList(
+    __in SCA_VDIR** psvdList
+    );
+
+
+HRESULT __stdcall ScaVirtualDirsRead(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_WEB* pswList,
+    __in SCA_VDIR** ppsvdList,
+    __in SCA_MIMEMAP** ppsmmList,
+    __in SCA_HTTP_HEADER** ppshhList,
+    __in SCA_WEB_ERROR** ppsweList,
+    __in WCA_WRAPQUERY_HANDLE hUserQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebBaseQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebDirPropQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebAppQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebAppExtQuery,
+    __inout LPWSTR *ppwzCustomActionData
+    )
+{
+    Assert(piMetabase && ppsvdList);
+
+    HRESULT hr = S_OK;
+    MSIHANDLE hRec;
+    INSTALLSTATE isInstalled = INSTALLSTATE_UNKNOWN;
+    INSTALLSTATE isAction = INSTALLSTATE_UNKNOWN;
+
+    SCA_VDIR* pvdir = NULL;
+    LPWSTR pwzData = NULL;
+
+    WCA_WRAPQUERY_HANDLE hWrapQuery = NULL;
+
+    hr = WcaBeginUnwrapQuery(&hWrapQuery, ppwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap query for ScaAppPoolRead");
+
+    if (0 == WcaGetQueryRecords(hWrapQuery))
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping ScaVirtualDirsRead() because IIsWebVirtualDir table not present");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    // loop through all the vdirs
+    while (S_OK == (hr = WcaFetchWrappedRecord(hWrapQuery, &hRec)))
+    {
+        // Get the Component first.  If there is a Component and it is not being modified during
+        // this transaction, skip processing this whole record.
+        hr = WcaGetRecordString(hRec, vdqComponent, &pwzData);
+        ExitOnFailure(hr, "failed to get IIsWebVirtualDir.Component");
+
+        hr = WcaGetRecordInteger(hRec, vdqInstalled, (int *)&isInstalled);
+        ExitOnFailure(hr, "Failed to get Component installed state for virtual dir");
+
+        hr = WcaGetRecordInteger(hRec, vdqAction, (int *)&isAction);
+        ExitOnFailure(hr, "Failed to get Component action state for virtual dir");
+
+        if (!WcaIsInstalling(isInstalled, isAction) &&
+            !WcaIsReInstalling(isInstalled, isAction) &&
+            !WcaIsUninstalling(isInstalled, isAction))
+        {
+            continue; // skip this record.
+        }
+
+        hr = AddVirtualDirToList(ppsvdList);
+        ExitOnFailure(hr, "failed to add virtual dir to list");
+
+        pvdir = *ppsvdList;
+
+        hr = ::StringCchCopyW(pvdir->wzComponent, countof(pvdir->wzComponent), pwzData);
+        ExitOnFailure(hr, "failed to copy component name: %ls", pwzData);
+
+        pvdir->isInstalled = isInstalled;
+        pvdir->isAction = isAction;
+
+        // get the web key
+        hr = WcaGetRecordString(hRec, vdqWeb, &pwzData);
+        ExitOnFailure(hr, "Failed to get Web for VirtualDir");
+
+        hr = ScaWebsGetBase(piMetabase, pswList, pwzData, pvdir->wzWebBase, countof(pvdir->wzWebBase), hWebBaseQuery);
+        if (WcaIsUninstalling(isInstalled, isAction))
+        {
+            // If we're uninstalling, ignore any failure to find the existing web
+            hr = S_OK;
+        }
+        ExitOnFailure(hr, "Failed to get base of web: %ls for VirtualDir", pwzData);
+
+        hr = WcaGetRecordString(hRec, vdqAlias, &pwzData);
+        ExitOnFailure(hr, "Failed to get Alias for VirtualDir");
+
+        if (0 != lstrlenW(pvdir->wzWebBase))
+        {
+            hr = ::StringCchPrintfW(pvdir->wzVDirRoot, countof(pvdir->wzVDirRoot), L"%s/Root/%s", pvdir->wzWebBase, pwzData);
+            ExitOnFailure(hr, "Failed to set VDirRoot for VirtualDir");
+        }
+
+        // get the vdir's directory
+        hr = WcaGetRecordString(hRec, vdqDirectory, &pwzData);
+        ExitOnFailure(hr, "Failed to get Directory for VirtualDir");
+
+        // get the web's directory
+        if (INSTALLSTATE_SOURCE == pvdir->isAction)
+        {
+            hr = WcaGetRecordString(hRec, vdqSourcePath, &pwzData);
+        }
+        else
+        {
+            hr = WcaGetRecordString(hRec, vdqTargetPath, &pwzData);
+        }
+        ExitOnFailure(hr, "Failed to get Source/TargetPath for Directory");
+
+        // remove trailing backslash(es)
+        while (lstrlenW(pwzData) > 0 && pwzData[lstrlenW(pwzData)-1] == L'\\')
+        {
+            pwzData[lstrlenW(pwzData)-1] = 0;
+        }
+        hr = ::StringCchCopyW(pvdir->wzDirectory, countof(pvdir->wzDirectory), pwzData);
+        ExitOnFailure(hr, "Failed to copy directory string to vdir object");
+
+        // get the security information for this web
+        hr = WcaGetRecordString(hRec, vdqProperties, &pwzData);
+        ExitOnFailure(hr, "Failed to get web directory identifier for VirtualDir");
+        if (*pwzData)
+        {
+            hr = ScaGetWebDirProperties(pwzData, hUserQuery, hWebDirPropQuery, &pvdir->swp);
+            ExitOnFailure(hr, "Failed to get web directory for VirtualDir");
+
+            pvdir->fHasProperties = TRUE;
+        }
+
+        // get the application information for this web
+        hr = WcaGetRecordString(hRec, vdqApplication, &pwzData);
+        ExitOnFailure(hr, "Failed to get application identifier for VirtualDir");
+        if (*pwzData)
+        {
+            hr = ScaGetWebApplication(NULL, pwzData, hWebAppQuery, hWebAppExtQuery, &pvdir->swapp);
+            ExitOnFailure(hr, "Failed to get application for VirtualDir");
+
+            pvdir->fHasApplication = TRUE;
+        }
+
+        hr = WcaGetRecordString(hRec, vdqVDir, &pwzData);
+        ExitOnFailure(hr, "Failed to get VDir for VirtualDir");
+
+        if (*pwzData && *ppsmmList)
+        {
+            hr = ScaGetMimeMap(mmptVDir, pwzData, ppsmmList, &pvdir->psmm);
+            ExitOnFailure(hr, "Failed to get mimemap for VirtualDir");
+        }
+
+        if (*pwzData && *ppshhList)
+        {
+            hr = ScaGetHttpHeader(hhptVDir, pwzData, ppshhList, &pvdir->pshh);
+            ExitOnFailure(hr, "Failed to get custom HTTP headers for VirtualDir: %ls", pwzData);
+        }
+
+        if (*pwzData && *ppsweList)
+        {
+            hr = ScaGetWebError(weptVDir, pwzData, ppsweList, &pvdir->pswe);
+            ExitOnFailure(hr, "Failed to get custom web errors for VirtualDir: %ls", pwzData);
+        }
+    }
+
+    if (E_NOMOREITEMS == hr)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "Failure while processing VirtualDirs");
+
+LExit:
+    WcaFinishUnwrapQuery(hWrapQuery);
+
+    ReleaseStr(pwzData);
+    return hr;
+}
+
+
+HRESULT ScaVirtualDirsInstall(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_VDIR* psvdList,
+    __in SCA_APPPOOL * psapList
+    )
+{
+    Assert(piMetabase);
+
+    HRESULT hr = S_OK;
+    SCA_VDIR* psvd = psvdList;
+    int i;
+
+    while (psvd)
+    {
+        // On reinstall, we have to uninstall the old application, otherwise a duplicate will be created
+        if (WcaIsReInstalling(psvd->isInstalled, psvd->isAction))
+        {
+            if (psvd->fHasApplication)
+            {
+                hr = ScaDeleteApp(piMetabase, psvd->wzVDirRoot);
+                ExitOnFailure(hr, "Failed to remove application for WebVDir as part of a reinstall");
+            }
+        }
+
+        if (WcaIsInstalling(psvd->isInstalled, psvd->isAction))
+        {
+            hr = ScaCreateMetabaseKey(piMetabase, psvd->wzVDirRoot, L"");
+            ExitOnFailure(hr, "Failed to create key for VirtualDir");
+            hr = ScaWriteMetabaseValue(piMetabase, psvd->wzVDirRoot, L"", MD_KEY_TYPE, METADATA_NO_ATTRIBUTES, IIS_MD_UT_SERVER, STRING_METADATA, (LPVOID)L"IIsWebVirtualDir");
+            ExitOnFailure(hr, "Failed to write key type for for VirtualDir");
+            i = 0x4000003e; // 1073741886;      // default directory browsing rights
+            hr = ScaWriteMetabaseValue(piMetabase, psvd->wzVDirRoot, L"", MD_DIRECTORY_BROWSING, METADATA_INHERIT, IIS_MD_UT_FILE, DWORD_METADATA, (LPVOID)((DWORD_PTR)i));
+            ExitOnFailure(hr, "Failed to set directory browsing for VirtualDir");
+
+            hr = ScaWriteMetabaseValue(piMetabase, psvd->wzVDirRoot, L"", MD_VR_PATH, METADATA_INHERIT, IIS_MD_UT_FILE, STRING_METADATA, (LPVOID)psvd->wzDirectory);
+            ExitOnFailure(hr, "Failed to write Directory for VirtualDir");
+
+            if (psvd->fHasProperties)
+            {
+                ScaWriteWebDirProperties(piMetabase, psvd->wzVDirRoot, &psvd->swp);
+                ExitOnFailure(hr, "Failed to write directory properties for VirtualDir");
+            }
+
+            if (psvd->fHasApplication)
+            {
+                hr = ScaWriteWebApplication(piMetabase, psvd->wzVDirRoot, &psvd->swapp, psapList);
+                ExitOnFailure(hr, "Failed to write application for VirtualDir");
+            }
+
+            if (psvd->psmm)
+            {
+                hr = ScaWriteMimeMap(piMetabase, psvd->wzVDirRoot, psvd->psmm);
+                ExitOnFailure(hr, "Failed to write mimemap for VirtualDir");
+            }
+
+            if (psvd->pshh)
+            {
+                hr = ScaWriteHttpHeader(piMetabase, psvd->wzVDirRoot, psvd->pshh);
+                ExitOnFailure(hr, "Failed to write custom HTTP headers for VirtualDir");
+            }
+
+            if (psvd->pswe)
+            {
+                hr = ScaWriteWebError(piMetabase, weptVDir, psvd->wzVDirRoot, psvd->pswe);
+                ExitOnFailure(hr, "Failed to write custom web errors for VirtualDir");
+            }
+        }
+
+        psvd = psvd->psvdNext;
+    }
+
+LExit:
+    return hr;
+}
+
+
+HRESULT ScaVirtualDirsUninstall(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_VDIR* psvdList
+    )
+{
+    Assert(piMetabase);
+
+    HRESULT hr = S_OK;
+    SCA_VDIR* psvd = psvdList;
+
+    while (psvd)
+    {
+        if (WcaIsUninstalling(psvd->isInstalled, psvd->isAction))
+        {
+            // delete the application for this virtual directory
+            if (psvd->fHasApplication)
+            {
+                hr = ScaDeleteApp(piMetabase, psvd->wzVDirRoot);
+                ExitOnFailure(hr, "Failed to remove application for WebVDir");
+            }
+
+            if (0 != lstrlenW(psvd->wzVDirRoot))
+            {
+                hr = ScaDeleteMetabaseKey(piMetabase, psvd->wzVDirRoot, L"");
+                ExitOnFailure(hr, "Failed to remove VirtualDir '%ls' from metabase", psvd->wzKey);
+            }
+        }
+
+        psvd = psvd->psvdNext;
+    }
+
+LExit:
+    return hr;
+}
+
+
+void ScaVirtualDirsFreeList(
+    __in SCA_VDIR* psvdList
+    )
+{
+    SCA_VDIR* psvdDelete = psvdList;
+    while (psvdList)
+    {
+        psvdDelete = psvdList;
+        psvdList = psvdList->psvdNext;
+
+        if (psvdDelete->psmm)
+        {
+            ScaMimeMapFreeList(psvdDelete->psmm);
+        }
+
+        if (psvdDelete->pswe)
+        {
+            ScaWebErrorFreeList(psvdDelete->pswe);
+        }
+
+        MemFree(psvdDelete);
+    }
+}
+
+
+static HRESULT AddVirtualDirToList(
+    __in SCA_VDIR** ppsvdList
+    )
+{
+    HRESULT hr = S_OK;
+    SCA_VDIR* psvd = static_cast<SCA_VDIR*>(MemAlloc(sizeof(SCA_VDIR), TRUE));
+    ExitOnNull(psvd, hr, E_OUTOFMEMORY, "failed to allocate memory for new vdir list element");
+
+    psvd->psvdNext= *ppsvdList;
+    *ppsvdList = psvd;
+
+LExit:
+    return hr;
+}
diff --git a/src/ca/scavdir.h b/src/ca/scavdir.h
new file mode 100644
index 00000000..c7e9661b
--- /dev/null
+++ b/src/ca/scavdir.h
@@ -0,0 +1,71 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+#include "scawebprop.h"
+#include "scawebapp.h"
+#include "scamimemap.h"
+#include "scaapppool.h"
+
+enum eVDirQuery { vdqWeb = 1, vdqVDir, vdqComponent , vdqAlias, vdqDirectory, vdqProperties, vdqApplication, vdqInstalled, vdqAction, vdqSourcePath, vdqTargetPath };
+
+struct SCA_VDIR
+{
+    // darwin information
+    WCHAR wzKey[MAX_DARWIN_KEY + 1];
+    WCHAR wzComponent[MAX_DARWIN_KEY + 1];
+    INSTALLSTATE isInstalled;
+    INSTALLSTATE isAction;
+
+    // metabase information
+    WCHAR wzWebKey[MAX_DARWIN_KEY + 1];
+    WCHAR wzWebBase[METADATA_MAX_NAME_LEN + 1];
+    WCHAR wzVDirRoot[METADATA_MAX_NAME_LEN + 1];
+
+    // iis configuation information
+    WCHAR wzDirectory[MAX_PATH];
+
+    BOOL fHasProperties;
+    SCA_WEB_PROPERTIES swp;
+
+    BOOL fHasApplication;
+    SCA_WEB_APPLICATION swapp;
+
+    SCA_MIMEMAP* psmm; // mime mappings
+    SCA_HTTP_HEADER* pshh; // custom web errors
+    SCA_WEB_ERROR* pswe; // custom web errors
+
+    SCA_VDIR* psvdNext;
+};
+
+
+// prototypes
+HRESULT __stdcall ScaVirtualDirsRead(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_WEB* pswList,
+    __in SCA_VDIR** ppsvdList,
+    __in SCA_MIMEMAP** ppsmmList,
+    __in SCA_HTTP_HEADER** ppshhList,
+    __in SCA_WEB_ERROR** ppsweList,
+    __in WCA_WRAPQUERY_HANDLE hUserQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebBaseQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebDirPropQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebAppQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebAppExtQuery,
+    __inout LPWSTR *ppwzCustomActionData
+    );
+
+HRESULT ScaVirtualDirsInstall(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_VDIR* psvdList,
+    __in SCA_APPPOOL * psapList
+    );
+
+HRESULT ScaVirtualDirsUninstall(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_VDIR* psvdList
+    );
+
+void ScaVirtualDirsFreeList(
+    __in SCA_VDIR* psvdList
+    );
diff --git a/src/ca/scavdir7.cpp b/src/ca/scavdir7.cpp
new file mode 100644
index 00000000..3f675357
--- /dev/null
+++ b/src/ca/scavdir7.cpp
@@ -0,0 +1,380 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+// prototypes
+static HRESULT AddVirtualDirToList7(
+    __in SCA_VDIR7** psvdList
+    );
+
+
+HRESULT __stdcall ScaVirtualDirsRead7(
+    __in SCA_WEB7* pswList,
+    __in SCA_VDIR7** ppsvdList,
+    __in SCA_MIMEMAP** ppsmmList,
+    __in SCA_HTTP_HEADER** ppshhList,
+    __in SCA_WEB_ERROR** ppsweList,
+    __in WCA_WRAPQUERY_HANDLE hUserQuery,
+    __in WCA_WRAPQUERY_HANDLE /*hWebBaseQuery*/,
+    __in WCA_WRAPQUERY_HANDLE hWebDirPropQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebAppQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebAppExtQuery,
+    __inout LPWSTR *ppwzCustomActionData
+    )
+{
+    Assert(ppsvdList);
+
+    HRESULT hr = S_OK;
+    MSIHANDLE hRec;
+
+    SCA_VDIR7* pvdir = NULL;
+    LPWSTR pwzData = NULL;
+    WCA_WRAPQUERY_HANDLE hWrapQuery = NULL;
+
+    hr = WcaBeginUnwrapQuery(&hWrapQuery, ppwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap query for ScaAppPoolRead");
+
+    if (0 == WcaGetQueryRecords(hWrapQuery))
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping ScaVirtualDirsRead() because IIsWebVirtualDir table not present");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    // loop through all the vdirs
+    while (S_OK == (hr = WcaFetchWrappedRecord(hWrapQuery, &hRec)))
+    {
+        // Add this record's information into the list of things to process.
+        hr = AddVirtualDirToList7(ppsvdList);
+        ExitOnFailure(hr, "failed to add vdir to vdir list");
+
+        pvdir = *ppsvdList;
+
+        // get the darwin information
+        hr = WcaGetRecordString(hRec, vdqComponent, &pwzData);
+        ExitOnFailure(hr, "failed to get IIsWebVirtualDir.Component");
+
+        hr = WcaGetRecordInteger(hRec, vdqInstalled, (int *)&pvdir->isInstalled);
+        ExitOnFailure(hr, "Failed to get Component installed state for virtual dir");
+
+        hr = WcaGetRecordInteger(hRec, vdqAction, (int *)&pvdir->isAction);
+        ExitOnFailure(hr, "Failed to get Component action state for virtual dir");
+
+        // get vdir properties
+        hr = ::StringCchCopyW(pvdir->wzComponent, countof(pvdir->wzComponent), pwzData);
+        ExitOnFailure(hr, "failed to copy vdir component name: %ls", pwzData);
+
+        hr = WcaGetRecordString(hRec, vdqWeb, &pwzData);
+        ExitOnFailure(hr, "Failed to get Web for VirtualDir");
+
+        hr = ScaWebsGetBase7(pswList, pwzData, pvdir->wzWebName , countof(pvdir->wzWebName));
+        if (S_FALSE == hr)
+        {
+            hr = HRESULT_FROM_WIN32(ERROR_NOT_FOUND);
+            ExitOnFailure(hr, "Failed to get Web Base for VirtualDir");
+        }
+        if (WcaIsUninstalling(pvdir->isInstalled, pvdir->isAction))
+        {
+            // If we're uninstalling, ignore any failure to find the existing web
+            hr = S_OK;
+        }
+
+        hr = WcaGetRecordString(hRec, vdqAlias, &pwzData);
+        ExitOnFailure(hr, "Failed to get Alias for VirtualDir");
+
+        hr = ::StringCchCopyW(pvdir->wzVDirRoot, countof(pvdir->wzVDirRoot), pwzData);
+        ExitOnFailure(hr, "Failed to set VDirRoot for VirtualDir");
+
+        // get the vdir's directory
+        hr = WcaGetRecordString(hRec, vdqDirectory, &pwzData);
+        ExitOnFailure(hr, "Failed to get Directory for VirtualDir");
+
+        // get the web's directory
+        if (INSTALLSTATE_SOURCE == pvdir->isAction)
+        {
+            hr = WcaGetRecordString(hRec, vdqSourcePath, &pwzData);
+        }
+        else
+        {
+            hr = WcaGetRecordString(hRec, vdqTargetPath, &pwzData);
+        }
+        ExitOnFailure(hr, "Failed to get Source/TargetPath for Directory");
+
+        // remove trailing backslash(es)
+        while (lstrlenW(pwzData) > 0 && pwzData[lstrlenW(pwzData)-1] == L'\\')
+        {
+            pwzData[lstrlenW(pwzData)-1] = 0;
+        }
+        hr = ::StringCchCopyW(pvdir->wzDirectory, countof(pvdir->wzDirectory), pwzData);
+        ExitOnFailure(hr, "Failed to copy directory string to vdir object");
+
+        // get the security information for this web
+        hr = WcaGetRecordString(hRec, vdqProperties, &pwzData);
+        ExitOnFailure(hr, "Failed to get web directory identifier for VirtualDir");
+        if (*pwzData)
+        {
+            hr = ScaGetWebDirProperties(pwzData, hUserQuery, hWebDirPropQuery, &pvdir->swp);
+            ExitOnFailure(hr, "Failed to get web directory for VirtualDir");
+
+            pvdir->fHasProperties = TRUE;
+        }
+
+        // get the application information for this web
+        hr = WcaGetRecordString(hRec, vdqApplication, &pwzData);
+        ExitOnFailure(hr, "Failed to get application identifier for VirtualDir");
+        if (*pwzData)
+        {
+            hr = ScaGetWebApplication(NULL, pwzData, hWebAppQuery, hWebAppExtQuery, &pvdir->swapp);
+            ExitOnFailure(hr, "Failed to get application for VirtualDir");
+
+            pvdir->fHasApplication = TRUE;
+        }
+
+        hr = WcaGetRecordString(hRec, vdqVDir, &pwzData);
+        ExitOnFailure(hr, "Failed to get VDir for VirtualDir");
+
+        if (*pwzData && *ppsmmList)
+        {
+            hr = ScaGetMimeMap(mmptVDir, pwzData, ppsmmList, &pvdir->psmm);
+            ExitOnFailure(hr, "Failed to get mimemap for VirtualDir");
+        }
+
+        if (*pwzData && *ppshhList)
+        {
+            hr = ScaGetHttpHeader(hhptVDir, pwzData, ppshhList, &pvdir->pshh);
+            ExitOnFailure(hr, "Failed to get custom HTTP headers for VirtualDir: %ls", pwzData);
+        }
+
+        if (*pwzData && *ppsweList)
+        {
+            hr = ScaGetWebError(weptVDir, pwzData, ppsweList, &pvdir->pswe);
+            ExitOnFailure(hr, "Failed to get custom web errors for VirtualDir: %ls", pwzData);
+        }
+    }
+
+    if (E_NOMOREITEMS == hr)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "Failure while processing VirtualDirs");
+
+LExit:
+    WcaFinishUnwrapQuery(hWrapQuery);
+
+    ReleaseStr(pwzData);
+
+    return hr;
+}
+
+
+HRESULT ScaVirtualDirsInstall7(
+    __in SCA_VDIR7* psvdList,
+    __in SCA_APPPOOL * psapList
+    )
+{
+    HRESULT hr = S_OK;
+    SCA_VDIR7* psvd = psvdList;
+    LPWSTR wzPath = NULL;
+    WCHAR wzAppPoolName[MAX_PATH];
+    while (psvd)
+    {
+        if (WcaIsInstalling(psvd->isInstalled, psvd->isAction))
+        {
+            // First write all applications, this is necessary since vdirs must be nested under the applications.
+            if (psvd->fHasApplication)
+            {
+                //create the application for this vdir application
+                hr = ScaWriteConfigID(IIS_APPLICATION);
+                ExitOnFailure(hr, "Failed to write app ID");
+                hr = ScaWriteConfigID(IIS_CREATE);
+                ExitOnFailure(hr, "Failed to write app action");
+#pragma prefast(suppress:26037, "Source string is null terminated - it is populated as target of ::StringCchCopyW")
+                hr = ScaWriteConfigString(psvd->wzWebName);           //site name key
+                ExitOnFailure(hr, "Failed to write app web key");
+                hr = StrAllocFormatted(&wzPath, L"/%s", psvd->wzVDirRoot);
+                ExitOnFailure(hr, "Failed to create app path");
+                hr = ScaWriteConfigString(wzPath);                    //  App Path
+                ExitOnFailure(hr, "Failed to write app path root ");
+
+                if (!*psvd->swapp.wzAppPool)
+                {
+                    //This Application goes in default appPool
+                    hr = ScaWriteConfigString(L"");                   //  App Pool
+                }
+                else
+                {
+                    //get apppool from WebApplication
+#pragma prefast(suppress:26037, "Source string is null terminated - it is populated as target of ::StringCchCopyW")
+                    hr = ScaFindAppPool7(psvd->swapp.wzAppPool, wzAppPoolName, countof(wzAppPoolName), psapList);
+                    ExitOnFailure(hr, "Failed to read app pool from application");
+                    hr = ScaWriteConfigString(wzAppPoolName);           //  App Pool
+                    ExitOnFailure(hr, "Failed to write appPool for vdir");
+
+                }
+            }
+        }
+
+        psvd = psvd->psvdNext;
+    }
+
+    // Reset our linked list and write all the VDirs
+    psvd = psvdList;
+    while (psvd)
+    {
+        if (WcaIsInstalling(psvd->isInstalled, psvd->isAction))
+        {
+            //create the Vdir
+            hr = ScaWriteConfigID(IIS_VDIR);
+            ExitOnFailure(hr, "Failed write VirDir ID")
+            hr = ScaWriteConfigID(IIS_CREATE);
+            ExitOnFailure(hr, "Failed write VirDir action")
+#pragma prefast(suppress:26037, "Source string is null terminated - it is populated as target of ::StringCchCopyW")
+            hr = ScaWriteConfigString(psvd->wzWebName);         //site name key
+            ExitOnFailure(hr, "Failed write VirDir web name");
+            hr = StrAllocFormatted(&wzPath, L"/%s", psvd->wzVDirRoot);
+            ExitOnFailure(hr, "Failed to create vdir path");
+            hr = ScaWriteConfigString(wzPath);                  //vdir path
+            ExitOnFailure(hr, "Failed write VirDir path")
+#pragma prefast(suppress:26037, "Source string is null terminated - it is populated as target of ::StringCchCopyW")
+            hr = ScaWriteConfigString(psvd->wzDirectory);       //physical dir
+            ExitOnFailure(hr, "Failed write VirDir dir");
+
+            if (psvd->fHasProperties)
+            {
+                ScaWriteWebDirProperties7(psvd->wzWebName, psvd->wzVDirRoot, &psvd->swp);
+                ExitOnFailure(hr, "Failed to write directory properties for VirtualDir");
+            }
+
+            if (psvd->fHasApplication)
+            {
+                hr = ScaWriteWebApplication7(psvd->wzWebName, psvd->wzVDirRoot, &psvd->swapp, psapList);
+                ExitOnFailure(hr, "Failed to write application for VirtualDir");
+            }
+
+            if (psvd->psmm)
+            {
+                hr = ScaWriteMimeMap7(psvd->wzWebName, psvd->wzVDirRoot, psvd->psmm);
+                ExitOnFailure(hr, "Failed to write mimemap for VirtualDir");
+            }
+
+            if (psvd->pshh)
+            {
+                hr = ScaWriteHttpHeader7(psvd->wzWebName, psvd->wzVDirRoot, psvd->pshh);
+                ExitOnFailure(hr, "Failed to write custom HTTP headers for VirtualDir");
+            }
+
+            if (psvd->pswe)
+            {
+                hr = ScaWriteWebError7(psvd->wzWebName, psvd->wzVDirRoot, psvd->pswe);
+                ExitOnFailure(hr, "Failed to write custom web errors for VirtualDir");
+            }
+        }
+
+        psvd = psvd->psvdNext;
+    }
+
+LExit:
+    ReleaseStr(wzPath);
+    return hr;
+}
+
+
+HRESULT ScaVirtualDirsUninstall7(
+                                 __in SCA_VDIR7* psvdList
+                                 )
+{
+
+    HRESULT hr = S_OK;
+    SCA_VDIR7* psvd = psvdList;
+    LPWSTR wzPath = NULL;
+
+    while (psvd)
+    {
+        if (WcaIsUninstalling(psvd->isInstalled, psvd->isAction))
+        {
+            //init path
+            hr = StrAllocFormatted(&wzPath, L"/%s", psvd->wzVDirRoot);
+            ExitOnFailure(hr, "Failed to create vdir path");
+
+            if (psvd->fHasApplication)
+            {
+                //delete Application
+                hr = ScaWriteConfigID(IIS_APPLICATION);
+                ExitOnFailure(hr, "Failed to write app ID ");
+                hr = ScaWriteConfigID(IIS_DELETE);
+                ExitOnFailure(hr, "Failed to write delete app ID ");
+#pragma prefast(suppress:26037, "Source string is null terminated - it is populated as target of ::StringCchCopyW")
+                hr = ScaWriteConfigString(psvd->wzWebName);        //site name key
+                ExitOnFailure(hr, "Failed to write App site Name");
+#pragma prefast(suppress:26037, "Source string is null terminated - it is populated as target of ::StringCchCopyW")
+                hr = ScaWriteConfigString(wzPath);                 //  App Path
+                ExitOnFailure(hr, "Failed to write app path root ");
+                hr = ScaWriteConfigString(L"NOP");                 //  App pool
+                ExitOnFailure(hr, "Failed to write app path app pool ");
+            }
+            else
+            {
+                //delete VDir
+                hr = ScaWriteConfigID(IIS_VDIR);
+                ExitOnFailure(hr, "Failed to write vDir ID ");
+                hr = ScaWriteConfigID(IIS_DELETE);
+#pragma prefast(suppress:26037, "Source string is null terminated - it is populated as target of ::StringCchCopyW")
+                hr = ScaWriteConfigString(psvd->wzWebName);        //site name key
+                ExitOnFailure(hr, "Failed to write App site Name");
+                hr = ScaWriteConfigString(wzPath);                 //  Vdir Path
+                ExitOnFailure(hr, "Failed to write app vdir ");
+                hr = ScaWriteConfigString(L"NOP");                 //  Phy Path
+                ExitOnFailure(hr, "Failed to write vdir path");
+            }
+
+            ExitOnFailure(hr, "Failed to remove VirtualDir '%ls' from config", psvd->wzKey);
+        }
+
+        psvd = psvd->psvdNext;
+    }
+
+LExit:
+    ReleaseStr(wzPath);
+    return hr;
+}
+
+
+void ScaVirtualDirsFreeList7(
+    __in SCA_VDIR7* psvdList
+    )
+{
+    SCA_VDIR7* psvdDelete = psvdList;
+    while (psvdList)
+    {
+        psvdDelete = psvdList;
+        psvdList = psvdList->psvdNext;
+
+        if (psvdDelete->psmm)
+        {
+            ScaMimeMapFreeList(psvdDelete->psmm);
+        }
+
+        if (psvdDelete->pswe)
+        {
+            ScaWebErrorFreeList(psvdDelete->pswe);
+        }
+
+        MemFree(psvdDelete);
+    }
+}
+
+
+static HRESULT AddVirtualDirToList7(
+    __in SCA_VDIR7** ppsvdList
+    )
+{
+    HRESULT hr = S_OK;
+
+    SCA_VDIR7* psvd = static_cast<SCA_VDIR7*>(MemAlloc(sizeof(SCA_VDIR7), TRUE));
+    ExitOnNull(psvd, hr, E_OUTOFMEMORY, "failed to allocate memory for new vdir list element");
+
+    psvd->psvdNext= *ppsvdList;
+    *ppsvdList = psvd;
+
+LExit:
+    return hr;
+}
diff --git a/src/ca/scavdir7.h b/src/ca/scavdir7.h
new file mode 100644
index 00000000..dba25431
--- /dev/null
+++ b/src/ca/scavdir7.h
@@ -0,0 +1,66 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+#include "scawebprop.h"
+#include "scawebapp.h"
+#include "scamimemap.h"
+#include "scaapppool.h"
+
+struct SCA_VDIR7
+{
+    // darwin information
+    WCHAR wzKey[MAX_DARWIN_KEY + 1];
+    WCHAR wzComponent[MAX_DARWIN_KEY + 1];
+    INSTALLSTATE isInstalled;
+    INSTALLSTATE isAction;
+
+    // metabase information
+    WCHAR wzWebKey[MAX_DARWIN_KEY + 1];
+    WCHAR wzWebName[METADATA_MAX_NAME_LEN + 1];
+    WCHAR wzVDirRoot[METADATA_MAX_NAME_LEN + 1];
+
+    // iis configuation information
+    WCHAR wzDirectory[MAX_PATH];
+
+    BOOL fHasProperties;
+    SCA_WEB_PROPERTIES swp;
+
+    BOOL fHasApplication;
+    SCA_WEB_APPLICATION swapp;
+
+    SCA_MIMEMAP* psmm; // mime mappings
+    SCA_HTTP_HEADER* pshh; // custom web errors
+    SCA_WEB_ERROR* pswe; // custom web errors
+
+    SCA_VDIR7* psvdNext;
+};
+
+
+// prototypes
+HRESULT __stdcall ScaVirtualDirsRead7(
+    __in SCA_WEB7* pswList,
+    __in SCA_VDIR7** ppsvdList,
+    __in SCA_MIMEMAP** ppsmmList,
+    __in SCA_HTTP_HEADER** ppshhList,
+    __in SCA_WEB_ERROR** ppsweList,
+    __in WCA_WRAPQUERY_HANDLE hUserQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebBaseQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebDirPropQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebAppQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebAppExtQuery,
+    __inout LPWSTR *ppwzCustomActionData
+    );
+
+HRESULT ScaVirtualDirsInstall7(
+    __in SCA_VDIR7* psvdList,
+    __in SCA_APPPOOL * psapList
+    );
+
+HRESULT ScaVirtualDirsUninstall7(
+    __in SCA_VDIR7* psvdList
+    );
+
+void ScaVirtualDirsFreeList7(
+    __in SCA_VDIR7* psvdList
+    );
diff --git a/src/ca/scaweb.cpp b/src/ca/scaweb.cpp
new file mode 100644
index 00000000..0452fb0b
--- /dev/null
+++ b/src/ca/scaweb.cpp
@@ -0,0 +1,1187 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+//Adding this because delivery doesn't have the updated specstrings.h that windows build does
+#ifndef __in_xcount
+#define __in_xcount(size)
+#endif
+
+// sql queries
+
+enum eWebBaseQuery { wbqWeb = 1, wbqId, wbqIP, wbqPort, wbqHeader, wbqSecure, wbqDescription };
+
+
+// prototypes for private helper functions
+static SCA_WEB* NewWeb();
+static void FreeWeb(SCA_WEB *pswDelete);
+static SCA_WEB* AddWebToList(
+    __in SCA_WEB* pswList,
+    __in SCA_WEB* psw
+    );
+static HRESULT ScaWebFindBase(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_WEB* pswList,
+    __in_z LPCWSTR wzWeb,
+    __in int iSiteId,
+    __in_z LPCWSTR wzIP,
+    __in int iPort,
+    __in_z LPCWSTR wzHeader,
+    __in BOOL fSecure,
+    __in_z LPCWSTR wzDescription,
+    __out_ecount(cchWebBase) LPWSTR wzWebBase,
+    __in DWORD cchWebBase
+    );
+static HRESULT ScaWebFindFreeBase(
+    __in IMSAdminBase* piMetabase,
+    __in_xcount(unknown) SCA_WEB* pswList,
+    __in int iSiteId,
+    __in_z LPCWSTR wzDescription,
+    __out_ecount(cchWebBase) LPWSTR wzWebBase,
+    __in DWORD cchWebBase
+    );
+static HRESULT ScaWebWrite(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_WEB* psw,
+    __in SCA_APPPOOL * psapList
+    );
+static HRESULT ScaWebRemove(
+    __in IMSAdminBase* piMetabase,
+    __in const SCA_WEB* psw);
+static DWORD SiteIdFromDescription(
+    __in_z LPCWSTR wzDescription
+    );
+static void Sort(
+    __in_ecount(cArray) DWORD dwArray[],
+    __in int cArray
+    );
+
+
+HRESULT ScaWebsRead(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_MIMEMAP** ppsmmList,
+    __in SCA_WEB** ppswList,
+    __in SCA_HTTP_HEADER** ppshhList,
+    __in SCA_WEB_ERROR** ppsweList,
+    __in WCA_WRAPQUERY_HANDLE hUserQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebDirPropQuery,
+    __in WCA_WRAPQUERY_HANDLE hSslCertQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebLogQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebAppQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebAppExtQuery,
+    __inout LPWSTR *ppwzCustomActionData
+    )
+{
+    Assert(piMetabase && ppswList);
+
+    HRESULT hr = S_OK;
+
+    MSIHANDLE hRec;
+    MSIHANDLE hRecAddresses;
+
+    SCA_WEB* psw = NULL;
+    LPWSTR pwzData = NULL;
+    int iSiteId;
+
+    DWORD dwLen = 0;
+    WCA_WRAPQUERY_HANDLE hQueryWebSite = NULL;
+    WCA_WRAPQUERY_HANDLE hQueryWebAddress = NULL;
+
+    hr = WcaBeginUnwrapQuery(&hQueryWebSite, ppwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap query for ScaWebsRead");
+
+    hr = WcaBeginUnwrapQuery(&hQueryWebAddress, ppwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap query for ScaWebsRead");
+
+    if (0 == WcaGetQueryRecords(hQueryWebSite))
+    {
+        WcaLog(LOGMSG_VERBOSE, "Required tables not present");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    // loop through all the webs
+    while (S_OK == (hr = WcaFetchWrappedRecord(hQueryWebSite, &hRec)))
+    {
+        psw = NewWeb();
+        ExitOnNull(psw, hr, E_OUTOFMEMORY, "Failed to allocate memory for web object in memory");
+
+        // get the darwin information
+        hr = WcaGetRecordString(hRec, wqWeb, &pwzData);
+        ExitOnFailure(hr, "Failed to get Web");
+        hr = ::StringCchCopyW(psw->wzKey, countof(psw->wzKey), pwzData);
+        ExitOnFailure(hr, "Failed to copy key string to web object");
+
+        if (*pwzData && *ppsmmList)
+        {
+            hr = ScaGetMimeMap(mmptWeb, pwzData, ppsmmList, &psw->psmm);
+            ExitOnFailure(hr, "Failed to get mimemap for VirtualDir");
+        }
+
+        // get component install state
+        hr = WcaGetRecordString(hRec, wqComponent, &pwzData);
+        ExitOnFailure(hr, "Failed to get Component for Web");
+        hr = ::StringCchCopyW(psw->wzComponent, countof(psw->wzComponent), pwzData);
+        ExitOnFailure(hr, "Failed to copy component string to web object");
+        if (*(psw->wzComponent))
+        {
+            psw->fHasComponent = TRUE;
+
+            hr = WcaGetRecordInteger(hRec, wqInstalled, (int *)&psw->isInstalled);
+            ExitOnFailure(hr, "Failed to get web Component's installed state");
+
+            WcaGetRecordInteger(hRec, wqAction, (int *)&psw->isAction);
+            ExitOnFailure(hr, "Failed to get web Component's action state");
+
+            if (!WcaIsInstalling(psw->isInstalled, psw->isAction) && !WcaIsUninstalling(psw->isInstalled, psw->isAction)
+                && !WcaIsReInstalling(psw->isInstalled, psw->isAction))
+            {
+                FreeWeb(psw);
+                psw = NULL;
+
+                continue; // If we aren't acting on this component, skip it
+            }
+        }
+
+        hr = WcaGetRecordInteger(hRec, wqId, &iSiteId);
+        ExitOnFailure(hr, "Failed to get SiteId for Web");
+
+        // Get the web's key address.
+        hr = WcaGetRecordString(hRec, wqAddress, &pwzData);
+        ExitOnFailure(hr, "Failed to get Address for Web");
+        hr = ::StringCchCopyW(psw->swaKey.wzKey, countof(psw->swaKey.wzKey), pwzData);
+        ExitOnFailure(hr, "Failed to copy key string to web object");
+
+        hr = WcaGetRecordString(hRec, wqIP, &pwzData);
+        ExitOnFailure(hr, "Failed to get IP for Web");
+        hr = ::StringCchCopyW(psw->swaKey.wzIP, countof(psw->swaKey.wzIP), pwzData);
+        ExitOnFailure(hr, "Failed to copy IP string to web object");
+
+        hr = WcaGetRecordString(hRec, wqPort, &pwzData);
+        ExitOnFailure(hr, "Failed to get Web Address port");
+        psw->swaKey.iPort = wcstol(pwzData, NULL, 10);
+
+        hr = WcaGetRecordString(hRec, wqHeader, &pwzData);
+        ExitOnFailure(hr, "Failed to get Header for Web");
+        hr = ::StringCchCopyW(psw->swaKey.wzHeader, countof(psw->swaKey.wzHeader), pwzData);
+        ExitOnFailure(hr, "Failed to copy header string to web object");
+
+        hr = WcaGetRecordInteger(hRec, wqSecure, &psw->swaKey.fSecure);
+        ExitOnFailure(hr, "Failed to get if Web is secure");
+        if (S_FALSE == hr)
+        {
+            psw->swaKey.fSecure = FALSE;
+        }
+
+        // Get the web's description.
+        hr = WcaGetRecordString(hRec, wqDescription, &pwzData);
+        ExitOnFailure(hr, "Failed to get Description for Web");
+        hr = ::StringCchCopyW(psw->wzDescription, countof(psw->wzDescription), pwzData);
+        ExitOnFailure(hr, "Failed to copy description string to web object");
+
+        // Try to find the web root in case it already exists.
+        dwLen = METADATA_MAX_NAME_LEN;
+        hr = ScaWebFindBase(piMetabase, *ppswList,
+                            psw->wzKey,
+                            iSiteId,
+                            psw->swaKey.wzIP,
+                            psw->swaKey.iPort,
+                            psw->swaKey.wzHeader,
+                            psw->swaKey.fSecure,
+                            psw->wzDescription,
+                            psw->wzWebBase, dwLen);
+        if (S_OK == hr)
+        {
+            psw->fBaseExists = TRUE;
+        }
+        else if (S_FALSE == hr) // didn't find the web site.
+        {
+            psw->fBaseExists = FALSE;
+
+            // If we're actually configuring the web site.
+            if (psw->fHasComponent)
+            {
+                if (WcaIsInstalling(psw->isInstalled, psw->isAction))
+                {
+                    hr = ScaWebFindFreeBase(piMetabase, *ppswList, iSiteId, psw->wzDescription, psw->wzWebBase, countof(psw->wzWebBase));
+                    ExitOnFailure(hr, "Failed to find free web root.");
+                }
+                else if (WcaIsUninstalling(psw->isInstalled, psw->isAction))
+                {
+                    WcaLog(LOGMSG_VERBOSE, "Web site: '%ls' was already removed, skipping.", psw->wzKey);
+
+                    hr = S_OK;
+                    continue;
+                }
+            }
+        }
+        ExitOnFailure(hr, "Failed to find web root");
+
+        // get any extra web addresses
+        WcaFetchWrappedReset(hQueryWebAddress);
+        while (S_OK == (hr = WcaFetchWrappedRecordWhereString(hQueryWebAddress, 2, psw->wzKey, &hRecAddresses)))
+        {
+            if (MAX_ADDRESSES_PER_WEB <= psw->cExtraAddresses)
+            {
+                hr = HRESULT_FROM_WIN32(ERROR_INSUFFICIENT_BUFFER);
+                ExitOnFailure(hr, "Failure to get more extra web addresses, max exceeded.");
+            }
+
+            hr = WcaGetRecordString(hRecAddresses, waqAddress, &pwzData);
+            ExitOnFailure(hr, "Failed to get extra web Address");
+
+            // if this isn't the key address add it
+            if (0 != lstrcmpW(pwzData, psw->swaKey.wzKey))
+            {
+                hr = ::StringCchCopyW(psw->swaExtraAddresses[psw->cExtraAddresses].wzKey, countof(psw->swaExtraAddresses[psw->cExtraAddresses].wzKey), pwzData);
+                ExitOnFailure(hr, "Failed to copy extra addresses key string to web object");
+
+                hr = WcaGetRecordString(hRecAddresses, waqIP, &pwzData);
+                ExitOnFailure(hr, "Failed to get extra web IP");
+                hr = ::StringCchCopyW(psw->swaExtraAddresses[psw->cExtraAddresses].wzIP, countof(psw->swaExtraAddresses[psw->cExtraAddresses].wzIP), pwzData);
+                ExitOnFailure(hr, "Failed to copy extra addresses IP string to web object");
+
+                hr = WcaGetRecordString(hRecAddresses, waqPort, &pwzData);
+                ExitOnFailure(hr, "Failed to get port for extra web IP");
+                psw->swaExtraAddresses[psw->cExtraAddresses].iPort= wcstol(pwzData, NULL, 10);
+
+                hr = WcaGetRecordString(hRecAddresses, waqHeader, &pwzData);
+                ExitOnFailure(hr, "Failed to get header for extra web IP");
+                hr = ::StringCchCopyW(psw->swaExtraAddresses[psw->cExtraAddresses].wzHeader, countof(psw->swaExtraAddresses[psw->cExtraAddresses].wzHeader), pwzData);
+                ExitOnFailure(hr, "Failed to copy extra addresses header string to web object");
+
+                hr = WcaGetRecordInteger(hRecAddresses, waqSecure, &psw->swaExtraAddresses[psw->cExtraAddresses].fSecure);
+                ExitOnFailure(hr, "Failed to get if secure extra web IP");
+                if (S_FALSE == hr)
+                    psw->swaExtraAddresses[psw->cExtraAddresses].fSecure = FALSE;
+
+                ++psw->cExtraAddresses;
+            }
+        }
+
+        if (E_NOMOREITEMS == hr)
+            hr = S_OK;
+        ExitOnFailure(hr, "Failure occured while getting extra web addresses");
+
+        hr = WcaGetRecordInteger(hRec, wqConnectionTimeout, &psw->iConnectionTimeout);
+        ExitOnFailure(hr, "Failed to get connection timeout for Web");
+
+        if (psw->fHasComponent) // If we're installing it, it needs a dir
+        {
+            // get the web's directory
+            if (INSTALLSTATE_SOURCE == psw->isAction)
+            {
+                hr = WcaGetRecordString(hRec, wqSourcePath, &pwzData);
+            }
+            else
+            {
+                hr = WcaGetRecordString(hRec, wqTargetPath, &pwzData);
+            }
+            ExitOnFailure(hr, "Failed to get Source/TargetPath for Directory");
+
+            // remove trailing backslashes
+            while (lstrlenW(pwzData) > 0 && pwzData[lstrlenW(pwzData)-1] == L'\\')
+            {
+                pwzData[lstrlenW(pwzData)-1] = 0;
+            }
+            hr = ::StringCchCopyW(psw->wzDirectory, countof(psw->wzDirectory), pwzData);
+            ExitOnFailure(hr, "Failed to copy directory string to web object");
+        }
+
+        hr = WcaGetRecordInteger(hRec, wqState, &psw->iState);
+        ExitOnFailure(hr, "Failed to get state for Web");
+
+        hr = WcaGetRecordInteger(hRec, wqAttributes, &psw->iAttributes);
+        ExitOnFailure(hr, "Failed to get attributes for Web");
+
+        // get the dir properties for this web
+        hr = WcaGetRecordString(hRec, wqProperties, &pwzData);
+        ExitOnFailure(hr, "Failed to get directory property record for Web");
+        if (*pwzData)
+        {
+            hr = ScaGetWebDirProperties(pwzData, hUserQuery, hWebDirPropQuery, &psw->swp);
+            ExitOnFailure(hr, "Failed to get directory properties for Web");
+
+            psw->fHasProperties = TRUE;
+        }
+
+        // get the application information for this web
+        hr = WcaGetRecordString(hRec, wqApplication, &pwzData);
+        ExitOnFailure(hr, "Failed to get application identifier for Web");
+        if (*pwzData)
+        {
+            hr = ScaGetWebApplication(NULL, pwzData, hWebAppQuery, hWebAppExtQuery, &psw->swapp);
+            ExitOnFailure(hr, "Failed to get application for Web");
+
+            psw->fHasApplication = TRUE;
+        }
+
+        // get the SSL certificates
+        hr = ScaSslCertificateRead(psw->wzKey, hSslCertQuery, &(psw->pswscList));
+        ExitOnFailure(hr, "Failed to get SSL Certificates.");
+
+        // get the custom headers
+        if (*ppshhList)
+        {
+            hr = ScaGetHttpHeader(hhptWeb, psw->wzKey, ppshhList, &(psw->pshhList));
+            ExitOnFailure(hr, "Failed to get Custom HTTP Headers");
+        }
+
+        // get the errors
+        if (*ppsweList)
+        {
+            hr = ScaGetWebError(weptWeb, psw->wzKey, ppsweList, &(psw->psweList));
+            ExitOnFailure(hr, "Failed to get Custom Errors");
+        }
+
+        // get the log information for this web
+        hr = WcaGetRecordString(hRec, wqLog, &pwzData);
+        ExitOnFailure(hr, "Failed to get log identifier for Web");
+        if (*pwzData)
+        {
+            hr = ScaGetWebLog(piMetabase, pwzData, hWebLogQuery, &psw->swl);
+            ExitOnFailure(hr, "Failed to get Log for Web.");
+
+            psw->fHasLog = TRUE;
+        }
+
+        *ppswList = AddWebToList(*ppswList, psw);
+        psw = NULL; // set the web NULL so it doesn't accidentally get freed below
+    }
+
+    if (E_NOMOREITEMS == hr)
+    {
+        hr = S_OK;
+    }
+
+LExit:
+    // if anything was left over after an error clean it all up
+    WcaFinishUnwrapQuery(hQueryWebSite);
+    WcaFinishUnwrapQuery(hQueryWebAddress);
+
+    if (psw)
+    {
+        ScaWebsFreeList(psw);
+    }
+
+    ReleaseStr(pwzData);
+
+    return hr;
+}
+
+
+HRESULT ScaWebsGetBase(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_WEB* pswList,
+    __in LPCWSTR wzWeb,
+    __out_ecount(cchWebBase) LPWSTR wzWebBase,
+    __in DWORD cchWebBase,
+    __in WCA_WRAPQUERY_HANDLE hWrapQuery
+    )
+{
+    HRESULT hr = S_OK;
+    MSIHANDLE hRec;
+
+    int iSiteId;
+    WCHAR wzIP[MAX_PATH];
+    int iPort = -1;
+    WCHAR wzHeader[MAX_PATH];
+    BOOL fSecure = FALSE;
+
+    LPWSTR pwzData = NULL;
+
+    // get the web information
+    WcaFetchWrappedReset(hWrapQuery);
+
+    hr = WcaFetchWrappedRecordWhereString(hWrapQuery, 1, wzWeb, &hRec);
+    if (S_OK == hr)
+    {
+        // get the data to search for
+        hr = WcaGetRecordInteger(hRec, wbqId, &iSiteId);
+        ExitOnFailure(hr, "Failed to get SiteId for Web for VirtualDir");
+
+        hr = WcaGetRecordString(hRec, wbqIP, &pwzData);
+        ExitOnFailure(hr, "Failed to get IP for Web for VirtualDir");
+        hr = ::StringCchCopyW(wzIP, countof(wzIP), pwzData);
+        ExitOnFailure(hr, "Failed to copy IP for Web for VirtualDir");
+
+        hr = WcaGetRecordString(hRec, wbqPort, &pwzData);
+        ExitOnFailure(hr, "Failed to get port for extra web IP");
+        iPort = wcstol(pwzData, NULL, 10);
+
+        hr = WcaGetRecordString(hRec, wbqHeader, &pwzData);
+        ExitOnFailure(hr, "Failed to get Header for Web for VirtualDir");
+        hr = ::StringCchCopyW(wzHeader, countof(wzHeader), pwzData);
+        ExitOnFailure(hr, "Failed to copy Header for Web for VirtualDir");
+
+        hr = WcaGetRecordInteger(hRec, wbqSecure, &fSecure);
+        if (S_FALSE == hr)
+            fSecure = FALSE;
+
+        hr = WcaGetRecordString(hRec, wbqDescription, &pwzData);
+        ExitOnFailure(hr, "Failed to get Description for Web");
+
+        // find the web or find the next free web location
+        hr = ScaWebFindBase(piMetabase, pswList, wzWeb, iSiteId, wzIP, iPort, wzHeader, fSecure, pwzData, wzWebBase, cchWebBase);
+        if (S_FALSE == hr)
+            hr = HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND);
+        ExitOnFailure(hr, "Failed to find Web base");
+    }
+    else if (S_FALSE == hr)
+        hr = HRESULT_FROM_WIN32(ERROR_NOT_FOUND);
+
+    // Let's check that there isn't more than one record found - if there is, throw an assert like WcaFetchSingleRecord() would
+    HRESULT hrTemp = WcaFetchWrappedRecordWhereString(hWrapQuery, 1, wzWeb, &hRec);
+    if (SUCCEEDED(hrTemp))
+    {
+        AssertSz(E_NOMOREITEMS == hrTemp, "ScaWebsGetBase found more than one record");
+    }
+
+LExit:
+    ReleaseStr(pwzData);
+
+    return hr;
+}
+
+
+HRESULT ScaWebsInstall(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_WEB* pswList,
+    __in SCA_APPPOOL * psapList
+    )
+{
+    HRESULT hr = S_OK;
+    SCA_WEB* psw = pswList;
+
+    while (psw)
+    {
+        // if we are installing the web site
+        if (psw->fHasComponent && WcaIsInstalling(psw->isInstalled, psw->isAction))
+        {
+            hr = ScaWebWrite(piMetabase, psw, psapList);
+            ExitOnFailure(hr, "failed to write web '%ls' to metabase", psw->wzKey);
+        }
+
+        psw = psw->pswNext;
+    }
+
+LExit:
+    return hr;
+}
+
+
+HRESULT ScaWebsUninstall(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_WEB* pswList
+    )
+{
+    HRESULT hr = S_OK;
+    SCA_WEB* psw = pswList;
+
+    while (psw)
+    {
+        // if we are uninstalling the web site
+        if (psw->fHasComponent && WcaIsUninstalling(psw->isInstalled, psw->isAction))
+        {
+            hr = ScaWebRemove(piMetabase, psw);
+            ExitOnFailure(hr, "Failed to remove web '%ls' from metabase", psw->wzKey);
+        }
+
+        psw = psw->pswNext;
+    }
+
+LExit:
+    return hr;
+}
+
+
+void ScaWebsFreeList(
+    __in SCA_WEB* pswList
+    )
+{
+    SCA_WEB* pswDelete = pswList;
+    while (pswList)
+    {
+        pswDelete = pswList;
+        pswList = pswList->pswNext;
+
+        // Free the SSL, headers and errors list first
+        FreeWeb(pswDelete);
+    }
+}
+
+
+// private helper functions
+
+static void FreeWeb(SCA_WEB *pswDelete)
+{
+    ScaSslCertificateFreeList(pswDelete->pswscList);
+    ScaHttpHeaderFreeList(pswDelete->pshhList);
+    ScaWebErrorFreeList(pswDelete->psweList);
+    MemFree(pswDelete);
+}
+
+static SCA_WEB* NewWeb()
+{
+    SCA_WEB* psw = static_cast<SCA_WEB*>(MemAlloc(sizeof(SCA_WEB), TRUE));
+    Assert(psw);
+    return psw;
+}
+
+
+static SCA_WEB* AddWebToList(
+    __in SCA_WEB* pswList,
+    __in SCA_WEB* psw
+    )
+{
+    if (pswList)
+    {
+        SCA_WEB* pswTemp = pswList;
+        while (pswTemp->pswNext)
+        {
+            pswTemp = pswTemp->pswNext;
+        }
+
+        pswTemp->pswNext = psw;
+    }
+    else
+    {
+        pswList = psw;
+    }
+
+    return pswList;
+}
+
+
+static HRESULT ScaWebFindBase(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_WEB* pswList,
+    __in_z LPCWSTR wzWeb,
+    __in int iSiteId,
+    __in_z LPCWSTR wzIP,
+    __in int iPort,
+    __in_z LPCWSTR wzHeader,
+    __in BOOL fSecure,
+    __in_z LPCWSTR wzDescription,
+    __out_ecount(cchWebBase) LPWSTR wzWebBase,
+    __in DWORD cchWebBase
+    )
+{
+    Assert(piMetabase);
+
+    HRESULT hr = S_OK;
+
+    WCHAR wzKey[METADATA_MAX_NAME_LEN];
+    WCHAR wzSubkey[METADATA_MAX_NAME_LEN];
+    LPWSTR wzFoundKey = NULL;
+
+    METADATA_RECORD mr;
+    ::ZeroMemory(&mr, sizeof(mr));
+
+    METADATA_RECORD mrCompare;
+    ::ZeroMemory(&mrCompare, sizeof(mrCompare));
+
+    // try to find the web in memory first
+    for (SCA_WEB* psw = pswList; psw; psw = psw->pswNext)
+    {
+        if (0 == lstrcmpW(wzWeb, psw->wzKey))
+        {
+            if ((0 == lstrcmpW(wzIP, psw->swaKey.wzIP) || 0 == lstrcmpW(wzIP, L"*") || 0 == lstrcmpW(psw->swaKey.wzIP, L"*")) &&
+                iPort == psw->swaKey.iPort &&
+                0 == lstrcmpW(wzHeader, psw->swaKey.wzHeader) &&
+                fSecure == psw->swaKey.fSecure)
+            {
+                if (0 == lstrlenW(psw->wzWebBase))
+                {
+                    WcaLog(LOGMSG_STANDARD, "A matching web object in memory was found, but the web object in memory has no associated base");
+                    ExitFunction1(hr = S_FALSE);
+                }
+
+                hr = ::StringCchCopyW(wzKey, countof(wzKey), psw->wzWebBase);
+                ExitOnFailure(hr, "Failed to copy web base into key.");
+
+                wzFoundKey = wzKey;
+                break;
+            }
+            else
+            {
+                WcaLog(LOGMSG_STANDARD, "Found web `%ls` but data did not match.", wzWeb);
+                hr = E_UNEXPECTED;
+                break;
+            }
+        }
+    }
+    ExitOnFailure(hr, "Failure occured while searching for web in memory");
+
+    // If we didn't find a web in memory matching look in the metabase.
+    if (!wzFoundKey)
+    {
+        mr.dwMDIdentifier = MD_KEY_TYPE;
+        mr.dwMDAttributes = METADATA_INHERIT;
+        mr.dwMDUserType = IIS_MD_UT_SERVER;
+        mr.dwMDDataType = ALL_METADATA;
+        mr.dwMDDataLen = 0;
+        mr.pbMDData = NULL;
+
+        // If we're looking based on the old WebAddress detection (NULL) or the new
+        // Web description detection (-1)
+        if (MSI_NULL_INTEGER == iSiteId || -1 == iSiteId)
+        {
+            if (MSI_NULL_INTEGER == iSiteId)
+            {
+                mrCompare.dwMDIdentifier = (fSecure) ? MD_SECURE_BINDINGS : MD_SERVER_BINDINGS;
+            }
+            else
+            {
+                mrCompare.dwMDIdentifier = MD_SERVER_COMMENT;
+            }
+            mrCompare.dwMDAttributes = METADATA_INHERIT;
+            mrCompare.dwMDUserType = IIS_MD_UT_SERVER;
+            mrCompare.dwMDDataType = ALL_METADATA;
+            mrCompare.dwMDDataLen = 0;
+            mrCompare.pbMDData = NULL;
+
+            // Loop through the "web keys" looking for the "IIsWebServer" key that matches our search criteria.
+            for (DWORD dwIndex = 0; SUCCEEDED(hr); ++dwIndex)
+            {
+                hr = piMetabase->EnumKeys(METADATA_MASTER_ROOT_HANDLE, L"/LM/W3SVC", wzSubkey, dwIndex);
+                if (SUCCEEDED(hr))
+                {
+                    hr = ::StringCchPrintfW(wzKey, countof(wzKey), L"/LM/W3SVC/%s", wzSubkey);
+                    ExitOnFailure(hr, "Failed to copy web subkey.");
+
+                    hr = MetaGetValue(piMetabase, METADATA_MASTER_ROOT_HANDLE, wzKey, &mr);
+                    if (MD_ERROR_DATA_NOT_FOUND == hr || HRESULT_FROM_WIN32(ERROR_PATH_NOT_FOUND) == hr)
+                    {
+                        hr = S_FALSE;  // didn't find anything, try next one
+                        continue;
+                    }
+                    ExitOnFailure(hr, "Failed to get key from metabase while searching for web servers");
+
+                    // If we have an IIsWebServer check to see if this is the site we are searching for.
+                    if (0 == lstrcmpW(L"IIsWebServer", (LPCWSTR)mr.pbMDData))
+                    {
+                        hr = MetaGetValue(piMetabase, METADATA_MASTER_ROOT_HANDLE, wzKey, &mrCompare);
+                        if (MD_ERROR_DATA_NOT_FOUND == hr || NULL == mrCompare.pbMDData)
+                        {
+                            hr = S_FALSE;
+                            continue;
+                        }
+                        ExitOnFailure(hr, "Failed to get address/description from metabase while searching for web servers");
+
+                        LPWSTR pwzExists = (LPWSTR)mrCompare.pbMDData;
+                        if (MSI_NULL_INTEGER == iSiteId)
+                        {
+                            // Break down the address into its constituent parts (IP:Port:Header).
+                            while (S_OK == hr && *pwzExists)
+                            {
+                                LPCWSTR pwzIPExists = pwzExists;
+                                pwzExists = const_cast<LPWSTR>(wcsstr(pwzIPExists, L":"));
+                                ExitOnNull(pwzExists, hr, E_INVALIDARG, "Invalid web address. IP was not separated by a colon.");
+                                *pwzExists = L'\0';
+
+                                LPCWSTR pwzPortExists = pwzExists + 1;
+                                pwzExists = const_cast<LPWSTR>(wcsstr(pwzPortExists, L":"));
+                                ExitOnNull(pwzExists, hr, E_INVALIDARG, "Invalid web address. Port was not separated by a colon.");
+                                *pwzExists = L'\0';
+                                int iPortExists = wcstol(pwzPortExists, NULL, 10);
+
+                                LPCWSTR pwzHeaderExists = pwzExists + 1;
+
+                                // compare the passed in address with the address listed for this web
+                                if ((0 == lstrcmpW(wzIP, pwzIPExists) || 0 == lstrcmpW(wzIP, L"*")) &&
+                                    iPort == iPortExists &&
+                                    0 == lstrcmpW(wzHeader, pwzHeaderExists))
+                                {
+                                    wzFoundKey = wzKey;
+                                    break;
+                                }
+
+                                // move to the next block of data, this may move beyond the available
+                                // data and exit the while loop above.
+                                pwzExists = const_cast<LPWSTR>(pwzHeaderExists + lstrlenW(pwzHeaderExists) + 1);
+                            }
+                        }
+                        else
+                        {
+                            if (0 == lstrcmpW(wzDescription, pwzExists))
+                            {
+                                wzFoundKey = wzKey;
+                            }
+                        }
+
+                        // If we found the key we were looking for, no point in continuing to search.
+                        if (wzFoundKey)
+                        {
+                            break;
+                        }
+                    }
+                }
+            }
+
+            if (E_NOMOREITEMS == hr)
+            {
+                Assert(!wzFoundKey);
+                hr = S_FALSE;
+            }
+        }
+        else // we're looking a specific SiteId
+        {
+            hr = ::StringCchPrintfW(wzKey, countof(wzKey), L"/LM/W3SVC/%d", iSiteId);
+            ExitOnFailure(hr, "Failed to allocate metabase key string.");
+
+            // if we have an IIsWebServer store the key
+            hr = MetaGetValue(piMetabase, METADATA_MASTER_ROOT_HANDLE, wzKey, &mr);
+
+            if (SUCCEEDED(hr) && NULL != mr.pbMDData && 0 == lstrcmpW(L"IIsWebServer", (LPCWSTR)mr.pbMDData))
+            {
+                wzFoundKey = wzKey;
+            }
+            else if (MD_ERROR_DATA_NOT_FOUND == hr || NULL == mrCompare.pbMDData || NULL == mr.pbMDData)
+            {
+                hr = S_FALSE;
+            }
+        }
+    }
+
+    if (wzFoundKey)
+    {
+        Assert(S_OK == hr);
+
+        hr = ::StringCchCopyW(wzWebBase, cchWebBase, wzFoundKey);
+        ExitOnFailure(hr, "Buffer not larger enough for found base key.");
+    }
+
+LExit:
+    MetaFreeValue(&mr);
+    MetaFreeValue(&mrCompare);
+
+    if (!wzFoundKey && SUCCEEDED(hr))
+    {
+        hr = S_FALSE;
+    }
+
+    return hr;
+}
+
+
+static HRESULT ScaWebFindFreeBase(
+    __in IMSAdminBase* piMetabase,
+    __in_xcount(unknown) SCA_WEB* pswList,
+    __in int iSiteId,
+    __in_z LPCWSTR wzDescription,
+    __out_ecount(cchWebBase) LPWSTR wzWebBase,
+    __in DWORD cchWebBase
+    )
+{
+    Assert(piMetabase);
+
+    HRESULT hr = S_OK;
+
+    WCHAR wzKey[METADATA_MAX_NAME_LEN];
+    WCHAR wzSubkey[METADATA_MAX_NAME_LEN];
+    DWORD* prgdwSubKeys = NULL;
+    DWORD cSubKeys = 128;
+    DWORD cSubKeysFilled = 0;
+
+    DWORD dwKey;
+
+    METADATA_RECORD mr;
+    ::ZeroMemory(&mr, sizeof(METADATA_RECORD));
+    mr.dwMDIdentifier = MD_KEY_TYPE;
+    mr.dwMDAttributes = 0;
+    mr.dwMDUserType = IIS_MD_UT_SERVER;
+    mr.dwMDDataType = STRING_METADATA;
+    mr.dwMDDataLen = 0;
+    mr.pbMDData = NULL;
+
+    if (MSI_NULL_INTEGER == iSiteId || -1 == iSiteId)
+    {
+        prgdwSubKeys = static_cast<DWORD*>(MemAlloc(cSubKeys * sizeof(DWORD), TRUE));
+        ExitOnNull(prgdwSubKeys, hr, E_OUTOFMEMORY, "failed to allocate space for web site keys");
+
+        // loop through the "web keys" looking for the "IIsWebServer" key that matches wzWeb
+        for (DWORD dwIndex = 0; SUCCEEDED(hr); ++dwIndex)
+        {
+            hr = piMetabase->EnumKeys(METADATA_MASTER_ROOT_HANDLE, L"/LM/W3SVC", wzSubkey, dwIndex);
+            if (SUCCEEDED(hr))
+            {
+                hr = ::StringCchPrintfW(wzKey, countof(wzKey), L"/LM/W3SVC/%s", wzSubkey);
+                ExitOnFailure(hr, "Failed remember key.");
+
+                hr = MetaGetValue(piMetabase, METADATA_MASTER_ROOT_HANDLE, wzKey, &mr);
+                if (MD_ERROR_DATA_NOT_FOUND == hr || HRESULT_FROM_WIN32(ERROR_PATH_NOT_FOUND) == hr)
+                {
+                    hr = S_FALSE;  // didn't find anything, try next one
+                    continue;
+                }
+                ExitOnFailure(hr, "Failed to get key from metabase while searching for free web root");
+
+                // if we have a IIsWebServer get the address information
+                if (0 == lstrcmpW(L"IIsWebServer", (LPCWSTR)mr.pbMDData))
+                {
+                    if (cSubKeysFilled >= cSubKeys)
+                    {
+                        cSubKeys = cSubKeys * 2;
+                        prgdwSubKeys = static_cast<DWORD*>(MemReAlloc(prgdwSubKeys, cSubKeys * sizeof(DWORD), FALSE));
+                        ExitOnNull(prgdwSubKeys, hr, E_OUTOFMEMORY, "failed to allocate space for web site keys");
+                    }
+
+                    prgdwSubKeys[cSubKeysFilled] = wcstol(wzSubkey, NULL, 10);
+                    ++cSubKeysFilled;
+                    Sort(prgdwSubKeys, cSubKeysFilled);
+                }
+            }
+        }
+
+        if (E_NOMOREITEMS == hr)
+        {
+            hr = S_OK;
+        }
+        ExitOnFailure(hr, "Failed to find free web root");
+
+        // Add all the webs created in memory.
+        CONST WCHAR *pcchSlash;
+        for (SCA_WEB* psw = pswList; psw; psw = psw->pswNext)
+        {
+            // Don't process webs that don't have a base
+            if (!*psw->wzWebBase)
+            {
+                continue;
+            }
+
+            // find the last slash in the web root because the root # is after it
+            pcchSlash = NULL;
+            for (CONST WCHAR *pcch = psw->wzWebBase; pcch && *pcch; ++pcch)
+            {
+                if (L'/' == *pcch)
+                {
+                    pcchSlash = pcch;
+                }
+            }
+            // In case we don't find a slash, error out
+            ExitOnNull(pcchSlash, hr, E_INVALIDARG, "Failed to find a slash in the web root: %ls", psw->wzWebBase);
+
+            prgdwSubKeys[cSubKeysFilled] = wcstol(pcchSlash + 1, NULL, 10);
+            ++cSubKeysFilled;
+            Sort(prgdwSubKeys, cSubKeysFilled);
+
+            if (cSubKeysFilled >= cSubKeys)
+            {
+                cSubKeys = cSubKeys * 2;
+                prgdwSubKeys = static_cast<DWORD*>(MemReAlloc(prgdwSubKeys, cSubKeys * sizeof(DWORD), FALSE));
+                ExitOnNull(prgdwSubKeys, hr, E_OUTOFMEMORY, "failed to allocate space for web site keys");
+            }
+        }
+
+        // Find the lowest free web root.
+        dwKey = (-1 == iSiteId) ? SiteIdFromDescription(wzDescription) : 1;
+        for (DWORD i = 0; i < cSubKeysFilled; ++i)
+        {
+            if (dwKey == prgdwSubKeys[i])
+            {
+                ++dwKey;
+            }
+            else if (dwKey < prgdwSubKeys[i])
+            {
+                break;
+            }
+        }
+    }
+    else
+    {
+        dwKey = iSiteId;
+    }
+
+    hr = ::StringCchPrintfW(wzWebBase, cchWebBase, L"/LM/W3SVC/%u", dwKey);
+    ExitOnFailure(hr, "failed to format web base with key: %u", dwKey);
+
+LExit:
+    MetaFreeValue(&mr);
+
+    if (prgdwSubKeys)
+    {
+        MemFree(prgdwSubKeys);
+    }
+
+    return hr;
+}
+
+
+static HRESULT ScaWebWrite(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_WEB* psw,
+    __in SCA_APPPOOL * psapList)
+{
+    HRESULT hr = S_OK;
+
+    UINT ui = 0;
+    WCHAR wzIP[64];
+    WCHAR wzBindings[1024];
+    WCHAR wzSecureBindings[1024];
+    WCHAR* pcchNext;        // used to properly create the MULTI_SZ
+    DWORD cchPcchNext;
+    WCHAR* pcchSecureNext ; // used to properly create the MULTI_SZ
+    DWORD cchPcchSecureNext;
+
+    // if the web root doesn't exist create it
+    if (!psw->fBaseExists)
+    {
+        hr = ScaCreateWeb(piMetabase, psw->wzKey, psw->wzWebBase);
+        ExitOnFailure(hr, "Failed to create web");
+    }
+    else if (psw->iAttributes & SWATTRIB_NOCONFIGUREIFEXISTS) // if we're not supposed to configure existing webs, bail
+    {
+        Assert(psw->fBaseExists);
+
+        hr = S_FALSE;
+        WcaLog(LOGMSG_VERBOSE, "Skipping configuration of existing web: %ls", psw->wzKey);
+        ExitFunction();
+    }
+
+    // put the secure and non-secure bindings together as MULTI_SZs
+    ::ZeroMemory(wzBindings, sizeof(wzBindings));
+    pcchNext = wzBindings;
+    cchPcchNext = countof(wzBindings);
+    ::ZeroMemory(wzSecureBindings, sizeof(wzSecureBindings));
+    pcchSecureNext = wzSecureBindings;
+    cchPcchSecureNext = countof(wzSecureBindings);
+
+    // set the IP address appropriately
+    if (0 == lstrcmpW(psw->swaKey.wzIP, L"*"))
+    {
+        ::ZeroMemory(wzIP, sizeof(wzIP));
+    }
+    else
+    {
+        hr = ::StringCchCopyW(wzIP, countof(wzIP), psw->swaKey.wzIP);
+        ExitOnFailure(hr, "Failed to copy IP string");
+    }
+
+    WCHAR wzBinding[256];
+    hr = ::StringCchPrintfW(wzBinding, countof(wzBinding), L"%s:%d:%s", wzIP, psw->swaKey.iPort, psw->swaKey.wzHeader);
+    ExitOnFailure(hr, "Failed to format IP:Port:Header binding string");
+    if (psw->swaKey.fSecure)
+    {
+        hr = ::StringCchCopyW(pcchSecureNext, cchPcchSecureNext, wzBinding);
+        ExitOnFailure(hr, "Failed to copy binding string to securenext string");
+        pcchSecureNext += lstrlenW(wzBinding) + 1;
+        cchPcchSecureNext -= lstrlenW(wzBinding) + 1;
+    }
+    else
+    {
+        hr = ::StringCchCopyW(pcchNext, cchPcchNext, wzBinding);
+        ExitOnFailure(hr, "Failed to copy binding string to next string");
+        pcchNext += lstrlenW(wzBinding) + 1;
+        cchPcchNext -= lstrlenW(wzBinding) + 1;
+    }
+
+    for (ui = 0; ui < psw->cExtraAddresses; ++ui)
+    {
+        // set the IP address appropriately
+        if (0 == lstrcmpW(psw->swaExtraAddresses[ui].wzIP, L"*"))
+        {
+            ::ZeroMemory(wzIP, sizeof(wzIP));
+        }
+        else
+        {
+            hr = ::StringCchCopyW(wzIP, countof(wzIP), psw->swaExtraAddresses[ui].wzIP);
+            ExitOnFailure(hr, "Failed to copy extra addresses IP to IP string");
+        }
+
+        hr = ::StringCchPrintfW(wzBinding, countof(wzBinding), L"%s:%d:%s", wzIP, psw->swaExtraAddresses[ui].iPort, psw->swaExtraAddresses[ui].wzHeader);
+        ExitOnFailure(hr, "Failed to format IP:Port:Header binding string for extra address");
+        if (psw->swaExtraAddresses[ui].fSecure)
+        {
+            hr = ::StringCchCopyW(pcchSecureNext, cchPcchSecureNext, wzBinding);
+            ExitOnFailure(hr, "Failed to copy binding string to securenext string for extra address");
+            pcchSecureNext += lstrlenW(wzBinding) + 1;
+            cchPcchSecureNext -= lstrlenW(wzBinding) + 1;
+        }
+        else
+        {
+            hr = ::StringCchCopyW(pcchNext, cchPcchNext, wzBinding);
+            ExitOnFailure(hr, "Failed to copy binding string to next string for extra address");
+            pcchNext += lstrlenW(wzBinding) + 1;
+            cchPcchNext -= lstrlenW(wzBinding) + 1;
+        }
+    }
+
+    // Delete the existing secure bindings metabase value, as having one while SSLCertHash and SSLStoreName aren't both set correctly can result in
+    // 0x80070520 (ERROR_NO_SUCH_LOGON_SESSION) errors in some situations on IIS7. Clearing this value first and then setting it after the install has completed
+    // allows the two aforementioned properties to exist in an intermediate state without errors
+    hr = ScaDeleteMetabaseValue(piMetabase, psw->wzWebBase, L"", MD_SECURE_BINDINGS, MULTISZ_METADATA);
+    ExitOnFailure(hr, "Failed to temporarily delete secure bindings for Web");
+
+    // now write the bindings to the metabase
+    hr = ScaWriteMetabaseValue(piMetabase, psw->wzWebBase, L"", MD_SERVER_BINDINGS, METADATA_NO_ATTRIBUTES, IIS_MD_UT_SERVER, MULTISZ_METADATA, wzBindings);
+    ExitOnFailure(hr, "Failed to write server bindings for Web");
+
+    // write the target path for the web's directory to the metabase
+    hr = ScaWriteMetabaseValue(piMetabase, psw->wzWebBase, L"/Root", MD_VR_PATH, METADATA_INHERIT, IIS_MD_UT_FILE, STRING_METADATA, psw->wzDirectory);
+    ExitOnFailure(hr, "Failed to write virtual root path for Web");
+
+    // write the description for the web to the metabase
+    hr = ScaWriteMetabaseValue(piMetabase, psw->wzWebBase, L"", MD_SERVER_COMMENT, METADATA_INHERIT, IIS_MD_UT_SERVER, STRING_METADATA, psw->wzDescription);
+    ExitOnFailure(hr, "Failed to write description for Web");
+
+    ui = psw->iConnectionTimeout;
+    if (MSI_NULL_INTEGER != ui)
+    {
+        hr = ScaWriteMetabaseValue(piMetabase, psw->wzWebBase, L"", MD_CONNECTION_TIMEOUT, METADATA_NO_ATTRIBUTES, IIS_MD_UT_SERVER, DWORD_METADATA, (LPVOID)((DWORD_PTR)ui));
+        ExitOnFailure(hr, "Failed to write connection timeout for Web");
+    }
+
+    ui = psw->iState;
+    if (MSI_NULL_INTEGER != ui)
+    {
+        if (2 == ui)
+        {
+            ui = 1;
+            hr = ScaWriteMetabaseValue(piMetabase, psw->wzWebBase, L"", MD_SERVER_AUTOSTART, METADATA_INHERIT, IIS_MD_UT_SERVER, DWORD_METADATA, (LPVOID)((DWORD_PTR)ui));
+            ExitOnFailure(hr, "Failed to write auto start flag for Web");
+            ui = 2;
+        }
+
+        if (1 == ui || 2 == ui)
+        {
+            ui = 1; // start command
+            hr = ScaWriteMetabaseValue(piMetabase, psw->wzWebBase, L"", MD_SERVER_COMMAND, METADATA_NO_ATTRIBUTES, IIS_MD_UT_SERVER, DWORD_METADATA, (LPVOID)((DWORD_PTR)ui));
+            ExitOnFailure(hr, "Failed to start Web");
+        }
+        else if (0 == ui)
+        {
+            ui = 2; // stop command
+            hr = ScaWriteMetabaseValue(piMetabase, psw->wzWebBase, L"", MD_SERVER_COMMAND, METADATA_NO_ATTRIBUTES, IIS_MD_UT_SERVER, DWORD_METADATA, (LPVOID)((DWORD_PTR)ui));
+            ExitOnFailure(hr, "Failed to stop Web");
+        }
+        else
+        {
+            hr = E_UNEXPECTED;
+            ExitOnFailure(hr, "Unexpected value for Web State");
+        }
+    }
+
+    WCHAR wzRootOfWeb[METADATA_MAX_NAME_LEN];
+    hr = ::StringCchPrintfW(wzRootOfWeb, countof(wzRootOfWeb), L"%s/Root", psw->wzWebBase);
+    ExitOnFailure(hr, "Failed to allocate WebBase/Root string for root of web");
+
+    // write the web dirproperties information
+    if (psw->fHasProperties)
+    {
+        hr = ScaWriteWebDirProperties(piMetabase, wzRootOfWeb, &psw->swp);
+        ExitOnFailure(hr, "Failed to write web security information to metabase");
+    }
+
+    // write the application information
+    if (psw->fHasApplication)
+    {
+        // On reinstall, we have to uninstall the old application, otherwise a duplicate will be created
+        if (WcaIsReInstalling(psw->isInstalled, psw->isAction))
+        {
+            hr = ScaDeleteApp(piMetabase, wzRootOfWeb);
+            ExitOnFailure(hr, "Failed to remove application for WebDir as part of a reinstall");
+        }
+
+        hr = ScaWriteWebApplication(piMetabase, wzRootOfWeb, &psw->swapp, psapList);
+        ExitOnFailure(hr, "Failed to write web application information to metabase");
+    }
+
+    // write the SSL certificate information
+    if (psw->pswscList)
+    {
+        hr = ScaSslCertificateWriteMetabase(piMetabase, psw->wzWebBase, psw->pswscList);
+        ExitOnFailure(hr, "Failed to write SSL certificates for Web site: %ls", psw->wzKey);
+    }
+
+    hr = ScaWriteMetabaseValue(piMetabase, psw->wzWebBase, L"", MD_SECURE_BINDINGS, METADATA_NO_ATTRIBUTES, IIS_MD_UT_SERVER, MULTISZ_METADATA, wzSecureBindings);
+    ExitOnFailure(hr, "Failed to write secure bindings for Web");
+
+    // write the headers
+    if (psw->pshhList)
+    {
+        hr = ScaWriteHttpHeader(piMetabase, wzRootOfWeb, psw->pshhList);
+        ExitOnFailure(hr, "Failed to write custom HTTP headers for Web site: %ls", psw->wzKey);
+    }
+
+    // write the errors
+    if (psw->psweList)
+    {
+        hr = ScaWriteWebError(piMetabase, weptWeb, psw->wzWebBase, psw->psweList);
+        ExitOnFailure(hr, "Failed to write custom web errors for Web site: %ls", psw->wzKey);
+    }
+
+    // write the mimetypes
+    if (psw->psmm)
+    {
+        hr = ScaWriteMimeMap(piMetabase, wzRootOfWeb, psw->psmm);
+        ExitOnFailure(hr, "Failed to write mimemap for Web site: %ls", psw->wzKey);
+    }
+
+    // write the log information to the metabase
+    if (psw->fHasLog)
+    {
+        hr = ScaWriteWebLog(piMetabase, psw->wzWebBase, &psw->swl);
+        ExitOnFailure(hr, "Failed to write web log information to metabase");
+    }
+
+LExit:
+    return hr;
+}
+
+
+static HRESULT ScaWebRemove(
+    __in IMSAdminBase* piMetabase,
+    __in const SCA_WEB* psw
+    )
+{
+    HRESULT hr = S_OK;
+
+    // simply remove the root key and everything else is pulled at the same time
+    hr = ScaDeleteMetabaseKey(piMetabase, psw->wzWebBase, L"");
+    ExitOnFailure(hr, "Failed to remove web '%ls' from metabase", psw->wzKey);
+
+LExit:
+    return hr;
+}
+
+
+static DWORD SiteIdFromDescription(
+    __in_z LPCWSTR wzDescription
+    )
+{
+    LPCWSTR pwz = wzDescription;
+    DWORD dwSiteId = 0;
+    while (pwz && *pwz)
+    {
+        WCHAR ch = *pwz & 0xdf;
+        dwSiteId = (dwSiteId * 101) + ch;
+        ++pwz;
+    }
+
+    return (dwSiteId % INT_MAX) + 1;
+}
+
+
+// insertion sort
+static void Sort(
+    __in_ecount(cArray) DWORD dwArray[],
+    __in int cArray
+    )
+{
+    int i, j;
+    DWORD dwData;
+
+    for (i = 1; i < cArray; ++i)
+    {
+        dwData = dwArray[i];
+
+        j = i - 1;
+        while (0 <= j && dwArray[j] > dwData)
+        {
+            dwArray[j + 1] = dwArray[j];
+            j--;
+        }
+
+        dwArray[j + 1] = dwData;
+    }
+}
diff --git a/src/ca/scaweb.h b/src/ca/scaweb.h
new file mode 100644
index 00000000..294030b4
--- /dev/null
+++ b/src/ca/scaweb.h
@@ -0,0 +1,123 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+#include "scawebapp.h"
+#include "scawebprop.h"
+#include "scahttpheader.h"
+#include "scaweberr.h"
+#include "scassl.h"
+#include "scaapppool.h"
+#include "scaweblog.h"
+#include "scamimemap.h"
+
+// globals
+#define MAX_ADDRESSES_PER_WEB 10
+
+enum eWebQuery { wqWeb = 1, wqComponent, wqId, wqDescription, wqConnectionTimeout, wqDirectory,
+                 wqState, wqAttributes, wqProperties, wqApplication, wqAddress, wqIP, wqPort, wqHeader, wqSecure, wqLog, wqInstalled, wqAction, wqSourcePath, wqTargetPath};
+
+enum eWebAddressQuery { waqAddress = 1, waqWeb, waqIP, waqPort, waqHeader, waqSecure };
+
+enum SCA_WEB_ATTRIBUTES
+{
+    SWATTRIB_NOCONFIGUREIFEXISTS = 2
+};
+
+// structs
+struct SCA_WEB_ADDRESS
+{
+    WCHAR wzKey [MAX_DARWIN_KEY + 1];
+
+    WCHAR wzIP[MAX_DARWIN_COLUMN + 1];
+    int iPort;
+    WCHAR wzHeader[MAX_DARWIN_COLUMN + 1];
+    BOOL fSecure;
+};
+
+struct SCA_WEB
+{
+    // darwin information
+    WCHAR wzKey[MAX_DARWIN_KEY + 1];
+    WCHAR wzComponent[MAX_DARWIN_KEY + 1];
+    BOOL fHasComponent;
+    INSTALLSTATE isInstalled;
+    INSTALLSTATE isAction;
+
+    // metabase information
+    WCHAR wzWebBase[METADATA_MAX_NAME_LEN + 1];
+    BOOL fBaseExists;
+
+    // iis configuation information
+    SCA_WEB_ADDRESS swaKey;
+
+    SCA_WEB_ADDRESS swaExtraAddresses[MAX_ADDRESSES_PER_WEB + 1];
+    DWORD cExtraAddresses;
+
+    WCHAR wzDirectory[MAX_PATH];
+    WCHAR wzDescription[MAX_DARWIN_COLUMN + 1];
+
+    int iState;
+    int iAttributes;
+
+    BOOL fHasProperties;
+    SCA_WEB_PROPERTIES swp;
+
+    BOOL fHasApplication;
+    SCA_WEB_APPLICATION swapp;
+
+    BOOL fHasSecurity;
+    int dwAccessPermissions;
+    int iConnectionTimeout;
+
+    SCA_MIMEMAP* psmm; // mime mappings
+    SCA_WEB_SSL_CERTIFICATE* pswscList;
+    SCA_HTTP_HEADER* pshhList;
+    SCA_WEB_ERROR* psweList;
+
+    BOOL fHasLog;
+    SCA_WEB_LOG swl;
+
+    SCA_WEB* pswNext;
+};
+
+
+// prototypes
+HRESULT ScaWebsRead(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_MIMEMAP** ppsmmList,
+    __in SCA_WEB** ppswList,
+    __in SCA_HTTP_HEADER** pshhList,
+    __in SCA_WEB_ERROR** psweList,
+    __in WCA_WRAPQUERY_HANDLE hUserQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebDirPropQuery,
+    __in WCA_WRAPQUERY_HANDLE hSslCertQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebLogQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebAppQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebAppExtQuery,
+    __inout LPWSTR *ppwzCustomActionData
+    );
+
+HRESULT ScaWebsGetBase(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_WEB* pswList,
+    __in LPCWSTR wzWeb,
+    __out_ecount(cchWebBase) LPWSTR wzWebBase,
+    __in DWORD cchWebBase,
+    __in WCA_WRAPQUERY_HANDLE hWrapQuery
+    );
+
+HRESULT ScaWebsInstall(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_WEB* pswList,
+    __in SCA_APPPOOL * psapList
+    );
+
+HRESULT ScaWebsUninstall(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_WEB* pswList
+    );
+
+void ScaWebsFreeList(
+    __in SCA_WEB* pswHead
+    );
diff --git a/src/ca/scaweb7.cpp b/src/ca/scaweb7.cpp
new file mode 100644
index 00000000..e1893782
--- /dev/null
+++ b/src/ca/scaweb7.cpp
@@ -0,0 +1,952 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+//Adding this because delivery doesn't have the updated specstrings.h that windows build does
+#ifndef __in_xcount
+#define __in_xcount(size)
+#endif
+
+// prototypes for private helper functions
+static SCA_WEB7* NewWeb7();
+static SCA_WEB7* AddWebToList7(
+    __in SCA_WEB7* pswList,
+    __in SCA_WEB7* psw
+    );
+
+static HRESULT ScaWebFindBase7(
+    __in SCA_WEB7* pswList,
+    LPCWSTR wzDescription
+    );
+
+static HRESULT ScaWebWrite7(
+    __in SCA_WEB7* psw,
+    __in SCA_APPPOOL * psapList
+    );
+
+static HRESULT ScaWebRemove7(__in const SCA_WEB7* psw);
+
+
+HRESULT ScaWebsRead7(
+    __in SCA_WEB7** ppswList,
+    __in SCA_HTTP_HEADER** ppshhList,
+    __in SCA_WEB_ERROR** ppsweList,
+    __in WCA_WRAPQUERY_HANDLE hUserQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebDirPropQuery,
+    __in WCA_WRAPQUERY_HANDLE hSslCertQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebLogQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebAppQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebAppExtQuery,
+    __inout LPWSTR *ppwzCustomActionData
+    )
+{
+    Assert(ppswList);
+    WcaLog(LOGMSG_VERBOSE, "Entering ScaWebsRead7()");
+
+    HRESULT hr = S_OK;
+
+    MSIHANDLE hRec;
+    MSIHANDLE hRecAddresses;
+
+    WCA_WRAPQUERY_HANDLE hQueryWebSite = NULL;
+    WCA_WRAPQUERY_HANDLE hQueryWebAddress = NULL;
+
+    SCA_WEB7* psw = NULL;
+    LPWSTR pwzData = NULL;
+
+    DWORD dwLen = 0;
+    errno_t error = EINVAL;
+
+    // check to see what tables are available
+    hr = WcaBeginUnwrapQuery(&hQueryWebSite, ppwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap query for ScaWebsRead");
+
+    hr = WcaBeginUnwrapQuery(&hQueryWebAddress, ppwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap query for ScaWebsRead");
+
+
+    if (0 == WcaGetQueryRecords(hQueryWebSite) || 0 == WcaGetQueryRecords(hQueryWebAddress))
+    {
+        WcaLog(LOGMSG_VERBOSE, "Required tables not present");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    // loop through all the webs
+    while (S_OK == (hr = WcaFetchWrappedRecord(hQueryWebSite, &hRec)))
+    {
+        psw = NewWeb7();
+        if (!psw)
+        {
+            hr = E_OUTOFMEMORY;
+            break;
+        }
+
+        // get the darwin information
+        hr = WcaGetRecordString(hRec, wqWeb, &pwzData);
+        ExitOnFailure(hr, "Failed to get Web");
+        hr = ::StringCchCopyW(psw->wzKey, countof(psw->wzKey), pwzData);
+        ExitOnFailure(hr, "Failed to copy key string to web object");
+
+        // get component install state
+        hr = WcaGetRecordString(hRec, wqComponent, &pwzData);
+        ExitOnFailure(hr, "Failed to get Component for Web");
+        hr = ::StringCchCopyW(psw->wzComponent, countof(psw->wzComponent), pwzData);
+        ExitOnFailure(hr, "Failed to copy component string to web object");
+        if (*(psw->wzComponent))
+        {
+            psw->fHasComponent = TRUE;
+
+            hr = WcaGetRecordInteger(hRec, wqInstalled, (int *)&psw->isInstalled);
+            ExitOnFailure(hr, "Failed to get web Component's installed state");
+
+            WcaGetRecordInteger(hRec, wqAction, (int *)&psw->isAction);
+            ExitOnFailure(hr, "Failed to get web Component's action state");
+        }
+
+        // Get the web's description.
+        hr = WcaGetRecordString(hRec, wqDescription, &pwzData);
+        ExitOnFailure(hr, "Failed to get Description for Web");
+        hr = ::StringCchCopyW(psw->wzDescription, countof(psw->wzDescription), pwzData);
+        ExitOnFailure(hr, "Failed to copy description string to web object");
+
+        //get web's site Id
+        hr = WcaGetRecordInteger(hRec, wqId, &psw->iSiteId);
+        ExitOnFailure(hr, "Failed to get SiteId for Web");
+
+        // get the web's key address (Bindings)
+        hr = WcaGetRecordString(hRec, wqAddress, &pwzData);
+        ExitOnFailure(hr, "Failed to get Address for Web");
+        hr = ::StringCchCopyW(psw->swaBinding.wzKey, countof(psw->swaBinding.wzKey), pwzData);
+        ExitOnFailure(hr, "Failed to copy web binding key");
+
+        hr = WcaGetRecordString(hRec, wqIP, &pwzData);
+        ExitOnFailure(hr, "Failed to get IP for Web");
+        hr = ::StringCchCopyW(psw->swaBinding.wzIP, countof(psw->swaBinding.wzIP), pwzData);
+        ExitOnFailure(hr, "Failed to copy web IP");
+
+        hr = WcaGetRecordString(hRec, wqPort, &pwzData);
+        ExitOnFailure(hr, "Failed to get Web Address port");
+        psw->swaBinding.iPort = wcstol(pwzData, NULL, 10);
+
+        hr = WcaGetRecordString(hRec, wqHeader, &pwzData);
+        ExitOnFailure(hr, "Failed to get Header for Web");
+        hr = ::StringCchCopyW(psw->swaBinding.wzHeader, countof(psw->swaBinding.wzHeader), pwzData);
+        ExitOnFailure(hr, "Failed to copy web header");
+
+        hr = WcaGetRecordInteger(hRec, wqSecure, &psw->swaBinding.fSecure);
+        ExitOnFailure(hr, "Failed to get if Web is secure");
+        if (S_FALSE == hr)
+        {
+            psw->swaBinding.fSecure = FALSE;
+        }
+
+        // look to see if site exists
+        dwLen = METADATA_MAX_NAME_LEN;
+        hr = ScaWebFindBase7(*ppswList, psw->wzDescription);
+
+        // If we didn't find a web in memory, ignore it - during execute CA
+        // if the site truly does not exist then there will be an error.
+        if (S_OK == hr)
+        {
+            // site exists in config
+            psw->fBaseExists = TRUE;
+        }
+        else if (HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND) == hr)
+        {
+            hr = S_OK;
+
+            // site does not exists in config
+            psw->fBaseExists = FALSE;
+        }
+        ExitOnFailure(hr, "Failed to find web site");
+
+        // get any extra web addresses
+        WcaFetchWrappedReset(hQueryWebAddress);
+
+        while (S_OK == (hr = WcaFetchWrappedRecordWhereString(hQueryWebAddress, 2, psw->wzKey, &hRecAddresses)))
+        {
+            if (MAX_ADDRESSES_PER_WEB <= psw->cExtraAddresses)
+            {
+                hr = HRESULT_FROM_WIN32(ERROR_INSUFFICIENT_BUFFER);
+                ExitOnFailure(hr, "Failure to get more extra web addresses, max exceeded.");
+            }
+
+            hr = WcaGetRecordString(hRecAddresses, waqAddress, &pwzData);
+            ExitOnFailure(hr, "Failed to get extra web Address");
+
+            // if this isn't the key address add it
+            if (0 != lstrcmpW(pwzData, psw->swaBinding.wzKey))
+            {
+                hr = ::StringCchCopyW(psw->swaExtraAddresses[psw->cExtraAddresses].wzKey,
+                    countof(psw->swaExtraAddresses[psw->cExtraAddresses].wzKey), pwzData);
+                ExitOnFailure(hr, "Failed to copy web binding key");
+
+                hr = WcaGetRecordString(hRecAddresses, waqIP, &pwzData);
+                ExitOnFailure(hr, "Failed to get extra web IP");
+                hr = ::StringCchCopyW(psw->swaExtraAddresses[psw->cExtraAddresses].wzIP, countof(psw->swaExtraAddresses[psw->cExtraAddresses].wzIP), pwzData);
+                ExitOnFailure(hr, "Failed to copy web binding IP");
+
+                hr = WcaGetRecordString(hRecAddresses, waqPort, &pwzData);
+                ExitOnFailure(hr, "Failed to get port for extra web IP");
+                psw->swaExtraAddresses[psw->cExtraAddresses].iPort= wcstol(pwzData, NULL, 10);
+
+                // errno is set to ERANGE if overflow or underflow occurs
+                _get_errno(&error);
+
+                if (ERANGE == error)
+                {
+                    hr = E_INVALIDARG;
+                    ExitOnFailure(hr, "Failed to convert web Port address");
+                }
+
+                hr = WcaGetRecordString(hRecAddresses, waqHeader, &pwzData);
+                ExitOnFailure(hr, "Failed to get header for extra web IP");
+                hr = ::StringCchCopyW(psw->swaExtraAddresses[psw->cExtraAddresses].wzHeader, countof(psw->swaExtraAddresses[psw->cExtraAddresses].wzHeader), pwzData);
+                ExitOnFailure(hr, "Failed to copy web binding header");
+
+                hr = WcaGetRecordInteger(hRecAddresses, waqSecure, &psw->swaExtraAddresses[psw->cExtraAddresses].fSecure);
+                ExitOnFailure(hr, "Failed to get if secure extra web IP");
+                if (S_FALSE == hr)
+                {
+                    psw->swaExtraAddresses[psw->cExtraAddresses].fSecure = FALSE;
+                }
+
+                ++psw->cExtraAddresses;
+            }
+        }
+
+        if (E_NOMOREITEMS == hr)
+        {
+            hr = S_OK;
+        }
+        ExitOnFailure(hr, "Failure occured while getting extra web addresses");
+
+        //
+        // Connection time out
+        //
+        hr = WcaGetRecordInteger(hRec, wqConnectionTimeout, &psw->iConnectionTimeout);
+        ExitOnFailure(hr, "Failed to get connection timeout for Web");
+
+        if (psw->fHasComponent) // If we're installing it, it needs a dir
+        {
+            // get the web's directory
+            if (INSTALLSTATE_SOURCE == psw->isAction)
+            {
+                hr = WcaGetRecordString(hRec, wqSourcePath, &pwzData);
+            }
+            else
+            {
+                hr = WcaGetRecordString(hRec, wqTargetPath, &pwzData);
+            }
+            ExitOnFailure(hr, "Failed to get Source/TargetPath for Directory");
+
+            dwLen = lstrlenW(pwzData);
+            // remove trailing backslash
+            if (dwLen > 0 && pwzData[dwLen-1] == L'\\')
+            {
+                pwzData[dwLen-1] = 0;
+            }
+            hr = ::StringCchCopyW(psw->wzDirectory, countof(psw->wzDirectory), pwzData);
+            ExitOnFailure(hr, "Failed to copy web dir: '%ls'", pwzData);
+
+        }
+
+        hr = WcaGetRecordInteger(hRec, wqState, &psw->iState);
+        ExitOnFailure(hr, "Failed to get state for Web");
+
+        hr = WcaGetRecordInteger(hRec, wqAttributes, &psw->iAttributes);
+        ExitOnFailure(hr, "Failed to get attributes for Web");
+
+        // get the dir properties for this web
+        hr = WcaGetRecordString(hRec, wqProperties, &pwzData);
+        ExitOnFailure(hr, "Failed to get directory properties for Web");
+        if (*pwzData)
+        {
+            hr = ScaGetWebDirProperties(pwzData, hUserQuery, hWebDirPropQuery, &psw->swp);
+            ExitOnFailure(hr, "Failed to get directory properties for Web");
+
+            psw->fHasProperties = TRUE;
+        }
+
+        // get the application information for this web
+        hr = WcaGetRecordString(hRec, wqApplication, &pwzData);
+        ExitOnFailure(hr, "Failed to get application identifier for Web");
+        if (*pwzData)
+        {
+            hr = ScaGetWebApplication(NULL, pwzData, hWebAppQuery, hWebAppExtQuery, &psw->swapp);
+            ExitOnFailure(hr, "Failed to get application for Web");
+
+            psw->fHasApplication = TRUE;
+        }
+
+        // get the SSL certificates
+        hr = ScaSslCertificateRead(psw->wzKey, hSslCertQuery, &(psw->pswscList));
+        ExitOnFailure(hr, "Failed to get SSL Certificates.");
+
+        // get the custom headers
+        if (*ppshhList)
+        {
+            hr = ScaGetHttpHeader(hhptWeb, psw->wzKey, ppshhList, &(psw->pshhList));
+            ExitOnFailure(hr, "Failed to get Custom HTTP Headers");
+        }
+
+        // get the errors
+        if (*ppsweList)
+        {
+            hr = ScaGetWebError(weptWeb, psw->wzKey, ppsweList, &(psw->psweList));
+            ExitOnFailure(hr, "Failed to get Custom Errors");
+        }
+
+        // get the log information for this web
+        hr = WcaGetRecordString(hRec, wqLog, &pwzData);
+        ExitOnFailure(hr, "Failed to get log identifier for Web");
+        if (*pwzData)
+        {
+            hr = ScaGetWebLog7(pwzData, hWebLogQuery, &psw->swl);
+            ExitOnFailure(hr, "Failed to get Log for Web.");
+            psw->fHasLog = TRUE;
+        }
+
+        *ppswList = AddWebToList7(*ppswList, psw);
+        psw = NULL; // set the web NULL so it doesn't accidentally get freed below
+    }
+
+    if (E_NOMOREITEMS == hr)
+    {
+        hr = S_OK;
+    }
+
+LExit:
+    // if anything was left over after an error clean it all up
+    WcaFinishUnwrapQuery(hQueryWebSite);
+    WcaFinishUnwrapQuery(hQueryWebAddress);
+
+    ScaWebsFreeList7(psw);
+
+    ReleaseStr(pwzData);
+    WcaLog(LOGMSG_VERBOSE, "Exiting ScaWebsRead7()");
+
+    return hr;
+}
+
+BOOL CompareBinding(
+    __in IAppHostElement* pBinding,
+    __in LPVOID pContext
+    )
+{
+    BOOL fFound = FALSE;
+    HRESULT hr = S_OK;
+    LPWSTR pwzBindingInfo = NULL;
+    SCA_WEB7* psw = (SCA_WEB7*)pContext;
+
+    hr = Iis7GetPropertyString(pBinding, IIS_CONFIG_BINDINGINFO, &pwzBindingInfo);
+    ExitOnFailure(hr, "Failed to get bindinginfo for binding element");
+
+    LPWSTR pwzExists = pwzBindingInfo;
+    // Break down the address into its constituent parts (IP:Port:Header).
+    // Taken from IIS6 CA code for compatibility
+    while (S_OK == hr && *pwzExists)
+    {
+        LPCWSTR pwzIPExists = pwzExists;
+        pwzExists = const_cast<LPWSTR>(wcsstr(pwzIPExists, L":"));
+        if (NULL == pwzExists)
+        {
+            ExitFunction();
+        }
+        *pwzExists = L'\0';
+
+        LPCWSTR pwzPortExists = pwzExists + 1;
+        pwzExists = const_cast<LPWSTR>(wcsstr(pwzPortExists, L":"));
+        if (NULL == pwzExists)
+        {
+            ExitFunction();
+        }
+        *pwzExists = L'\0';
+        int iPortExists = wcstol(pwzPortExists, NULL, 10);
+
+        LPCWSTR pwzHeaderExists = pwzExists + 1;
+
+        BOOL fIpMatches = (0 == lstrcmpW(psw->swaBinding.wzIP, pwzIPExists));   // Explicit IP match
+        fIpMatches |= (0 == lstrcmpW(psw->swaBinding.wzIP, L"*"));              // Authored * matches any IP
+        fIpMatches |= ('\0' != psw->swaBinding.wzIP) &&                         // Unauthored IP
+                      (0 == lstrcmpW(pwzIPExists, L"*"));                       // matches the All Unassigned IP : '*'
+
+        // compare the passed in address with the address listed for this web
+        if (fIpMatches && psw->swaBinding.iPort == iPortExists &&
+            0 == lstrcmpW(psw->swaBinding.wzHeader, pwzHeaderExists))
+        {
+            fFound = TRUE;
+            break;
+        }
+
+        // move to the next block of data, this may move beyond the available
+        // data and exit the while loop above.
+        pwzExists = const_cast<LPWSTR>(pwzHeaderExists + lstrlenW(pwzHeaderExists));
+    }
+
+LExit:
+    WcaLog(LOGMSG_VERBOSE, "Site with binding %ls %s a match", pwzBindingInfo, fFound ? "is" : "is not");
+    ReleaseNullStr(pwzBindingInfo);
+    return fFound;
+}
+
+BOOL EnumSiteCompareBinding(
+    __in IAppHostElement* pSite,
+    __in LPVOID pContext
+    )
+{
+    BOOL fFound = FALSE;
+    HRESULT hr = S_OK;
+    SCA_WEB7* psw = (SCA_WEB7*)pContext;
+    IAppHostChildElementCollection *pSiteChildren = NULL;
+    IAppHostElement *pBindings = NULL;
+    IAppHostElementCollection *pBindingsCollection = NULL;
+    IAppHostElement *pBinding = NULL;
+    VARIANT vtProp;
+    VariantInit(&vtProp);
+
+    hr = pSite->get_ChildElements(&pSiteChildren);
+    ExitOnFailure(hr, "Failed get site child elements collection");
+
+    vtProp.vt = VT_BSTR;
+    vtProp.bstrVal = ::SysAllocString(IIS_CONFIG_BINDINGS);
+    hr = pSiteChildren->get_Item(vtProp, &pBindings);
+    ExitOnFailure(hr, "Failed get bindings element");
+
+    hr = pBindings->get_Collection(&pBindingsCollection);
+    ExitOnFailure(hr, "Failed get bindings collection");
+
+    WcaLog(LOGMSG_VERBOSE, "Searching for site with binding %ls:%d:%ls", psw->swaBinding.wzIP, psw->swaBinding.iPort, psw->swaBinding.wzHeader);
+
+    hr = Iis7EnumAppHostElements(pBindingsCollection, CompareBinding, psw, &pBinding, NULL);
+    ExitOnFailure(hr, "Failed search bindings collection");
+
+    fFound = NULL != pBinding;
+LExit:
+    VariantClear(&vtProp);
+    ReleaseNullObject(pSiteChildren);
+    ReleaseNullObject(pBindings);
+    ReleaseNullObject(pBindingsCollection);
+    ReleaseNullObject(pBinding);
+    return fFound;
+}
+
+HRESULT ScaWebSearch7(
+    __in SCA_WEB7* psw,
+    __deref_out_z_opt LPWSTR* pswWeb,
+    __out_opt BOOL* pfFound
+    )
+{
+    HRESULT hr = S_OK;
+    BOOL fInitializedCom = FALSE;
+    BSTR bstrSites = NULL;
+    BSTR bstrAppHostRoot = NULL;
+    IAppHostAdminManager *pAdminMgr = NULL;
+    IAppHostElement *pSites = NULL;
+    IAppHostElementCollection *pCollection = NULL;
+    IAppHostElement *pSite = NULL;
+
+    if (NULL != pswWeb)
+    {
+        ReleaseNullStr(*pswWeb);
+    }
+
+    if (NULL != pfFound)
+    {
+        *pfFound = FALSE;
+    }
+
+    hr = ::CoInitialize(NULL);
+    ExitOnFailure(hr, "Failed to initialize COM");
+    fInitializedCom = TRUE;
+
+    hr = CoCreateInstance(__uuidof(AppHostAdminManager), NULL, CLSCTX_INPROC_SERVER, __uuidof(IAppHostAdminManager), reinterpret_cast<void**> (&pAdminMgr));
+    if (REGDB_E_CLASSNOTREG == hr)
+    {
+        WcaLog(LOGMSG_VERBOSE, "AppHostAdminManager was not registered, cannot find site.");
+        hr = S_OK;
+        ExitFunction();
+    }
+    ExitOnFailure(hr, "Failed to CoCreate IAppHostAdminManager");
+
+    bstrSites = ::SysAllocString(IIS_CONFIG_SITES_SECTION);
+    ExitOnNull(bstrSites, hr, E_OUTOFMEMORY, "Failed to allocate sites string.");
+
+    bstrAppHostRoot = ::SysAllocString(IIS_CONFIG_APPHOST_ROOT);
+    ExitOnNull(bstrAppHostRoot, hr, E_OUTOFMEMORY, "Failed to allocate host root string.");
+
+    hr = pAdminMgr->GetAdminSection(bstrSites, bstrAppHostRoot, &pSites);
+    ExitOnFailure(hr, "Failed get sites section");
+    ExitOnNull(pSites, hr, ERROR_FILE_NOT_FOUND, "Failed get sites section object");
+
+    hr = pSites->get_Collection(&pCollection);
+    ExitOnFailure(hr, "Failed get sites collection");
+
+    // not explicitly doing a Description search
+    if (-1 != psw->iSiteId)
+    {
+        if (MSI_NULL_INTEGER == psw->iSiteId)
+        {
+            // Enumerate sites & determine if the binding matches
+            hr = Iis7EnumAppHostElements(pCollection, EnumSiteCompareBinding, psw, &pSite, NULL);
+            ExitOnFailure(hr, "Failed locate site by ID");
+        }
+        else
+        {
+            // Find a site with ID matches
+            hr = Iis7FindAppHostElementInteger(pCollection, IIS_CONFIG_SITE, IIS_CONFIG_ID, psw->iSiteId, &pSite, NULL);
+            ExitOnFailure(hr, "Failed locate site by ID");
+        }
+    }
+
+    if (NULL == pSite)
+    {
+        // Find a site with Name that matches
+        hr = Iis7FindAppHostElementString(pCollection, IIS_CONFIG_SITE, IIS_CONFIG_NAME, psw->wzDescription, &pSite, NULL);
+        ExitOnFailure(hr, "Failed locate site by ID");
+    }
+
+    if (NULL != pSite)
+    {
+        if (NULL != pfFound)
+        {
+            *pfFound = TRUE;
+        }
+
+        if (NULL != pswWeb)
+        {
+            // We found a site, return its description
+            hr = Iis7GetPropertyString(pSite, IIS_CONFIG_NAME, pswWeb);
+            ExitOnFailure(hr, "Failed get site name");
+        }
+    }
+LExit:
+    ReleaseNullObject(pAdminMgr);
+    ReleaseNullObject(pSites);
+    ReleaseNullObject(pCollection);
+    ReleaseNullObject(pSite);
+    ReleaseBSTR(bstrAppHostRoot);
+    ReleaseBSTR(bstrSites);
+
+    if (fInitializedCom)
+    {
+        ::CoUninitialize();
+    }
+    return hr;
+}
+
+
+HRESULT ScaWebsGetBase7(
+    __in SCA_WEB7* pswList,
+    __in LPCWSTR pswWebKey,
+    __out_ecount(cchDest) LPWSTR pswWeb,
+    __in DWORD_PTR cchDest
+    )
+{
+    HRESULT hr = S_OK;
+    BOOL fFound = FALSE;
+    SCA_WEB7* psw = pswList;
+    LPWSTR wzSiteName = NULL;
+
+    *pswWeb = '/0';
+
+    //looking for psw->wzKey == pswWebKey
+    while(psw)
+    {
+        if (0 == wcscmp(pswWebKey, psw->wzKey))
+        {
+            fFound = TRUE;
+            break;
+        }
+        psw = psw->pswNext;
+    }
+
+    if (!fFound)
+    {
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    // Search if we're not installing the site
+    if (!psw->fHasComponent || (psw->iAttributes & SWATTRIB_NOCONFIGUREIFEXISTS))
+    {
+        // We are not installing this website.  Search for it in IIS config
+        hr = ScaWebSearch7(psw, &wzSiteName, NULL);
+        ExitOnFailure(hr, "Failed to search for Website");
+
+        if (NULL != wzSiteName)
+        {
+            hr = ::StringCchCopyW(pswWeb, cchDest, wzSiteName);
+            ExitOnFailure(hr, "Failed to set Website description for located Website");
+        }
+    }
+
+    if ('/0' == *pswWeb)
+    {
+        WcaLog(LOGMSG_VERBOSE, "Could not find Web: %ls, defaulting to %ls", psw->wzKey, psw->wzDescription);
+        // Default to the provided description, the Exec CA will locate by description
+        hr = ::StringCchCopyW(pswWeb, cchDest, psw->wzDescription);
+        ExitOnFailure(hr, "Failed to set Website description to default");
+    }
+LExit:
+    ReleaseNullStr(wzSiteName);
+    return hr;
+}
+
+HRESULT ScaWebsInstall7(
+    __in SCA_WEB7* pswList,
+    __in SCA_APPPOOL * psapList
+    )
+{
+    HRESULT hr = S_OK;
+    SCA_WEB7* psw = pswList;
+
+    while (psw)
+    {
+        // if we are installing the web site
+        if (psw->fHasComponent && WcaIsInstalling(psw->isInstalled, psw->isAction))
+        {
+            hr = ScaWebWrite7(psw, psapList);
+            ExitOnFailure(hr, "failed to write web '%ls' to metabase", psw->wzKey);
+        }
+
+        psw = psw->pswNext;
+    }
+
+LExit:
+    return hr;
+}
+
+
+HRESULT ScaWebsUninstall7(
+    __in SCA_WEB7* pswList
+    )
+{
+    HRESULT hr = S_OK;
+    SCA_WEB7* psw = pswList;
+
+    while (psw)
+    {
+        if (psw->fHasComponent && WcaIsUninstalling(psw->isInstalled, psw->isAction))
+        {
+            // If someone
+            hr = ScaWebRemove7(psw);
+            ExitOnFailure(hr, "Failed to remove web '%ls' ", psw->wzKey);
+        }
+
+        psw = psw->pswNext;
+    }
+
+LExit:
+    return hr;
+}
+
+
+void ScaWebsFreeList7(__in SCA_WEB7* pswList)
+{
+    SCA_WEB7* pswDelete = pswList;
+    while (pswList)
+    {
+        pswDelete = pswList;
+        pswList = pswList->pswNext;
+
+        // Free the SSL, headers and errors list first
+        ScaSslCertificateFreeList(pswDelete->pswscList);
+        ScaHttpHeaderFreeList(pswDelete->pshhList);
+        ScaWebErrorFreeList(pswDelete->psweList);
+
+        MemFree(pswDelete);
+    }
+}
+
+
+// private helper functions
+
+static SCA_WEB7* NewWeb7()
+{
+    SCA_WEB7* psw = (SCA_WEB7*)MemAlloc(sizeof(SCA_WEB7), TRUE);
+    Assert(psw);
+    return psw;
+}
+
+
+static SCA_WEB7* AddWebToList7(
+    __in SCA_WEB7* pswList,
+    __in SCA_WEB7* psw
+    )
+{
+    if (pswList)
+    {
+        SCA_WEB7* pswTemp = pswList;
+        while (pswTemp->pswNext)
+        {
+            pswTemp = pswTemp->pswNext;
+        }
+
+        pswTemp->pswNext = psw;
+    }
+    else
+    {
+        pswList = psw;
+    }
+
+    return pswList;
+}
+
+
+static HRESULT ScaWebFindBase7(
+    __in SCA_WEB7* pswList,
+    __in_z LPCWSTR wzDescription
+    )
+{
+    HRESULT hr = S_OK;
+    BOOL fFound = FALSE;
+
+    // try to find the web in memory first
+    for (SCA_WEB7* psw = pswList; psw; psw = psw->pswNext)
+    {
+        if (0 == wcscmp(wzDescription, psw->wzDescription))
+        {
+            fFound = TRUE;
+            break;
+        }
+    }
+
+    if (!fFound)
+    {
+        hr = HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND);
+    }
+
+    return hr;
+}
+
+
+static HRESULT ScaWebWrite7(
+    __in SCA_WEB7* psw,
+    __in SCA_APPPOOL * psapList
+    )
+{
+    HRESULT hr = S_OK;
+
+    BOOL fExists = FALSE;
+    UINT ui = 0;
+    WCHAR wzIP[64];
+    WCHAR wzBinding[1024];
+    WCHAR wzAppPoolName[MAX_PATH];
+
+    //
+    // determine if site must be new
+    //
+    if (psw->iAttributes & SWATTRIB_NOCONFIGUREIFEXISTS)
+    {
+        // Check if site already exists.
+        hr = ScaWebSearch7(psw, NULL, &fExists);
+        ExitOnFailure(hr, "Failed to search for web: %ls", psw->wzKey);
+
+        if (fExists)
+        {
+            hr = S_FALSE;
+            WcaLog(LOGMSG_VERBOSE, "Skipping configuration of existing web: %ls", psw->wzKey);
+            ExitFunction();
+        }
+    }
+
+    //create a site
+    hr = ScaWriteConfigID(IIS_SITE);
+    ExitOnFailure(hr, "Failed write site ID");
+
+    hr = ScaWriteConfigID(IIS_CREATE);
+    ExitOnFailure(hr, "Failed write site ID create action");
+
+    //Site Name
+    hr = ScaWriteConfigString(psw->wzDescription);                  //Site Name
+    ExitOnFailure(hr, "Failed write site desc");
+
+    //Site Id -- value is MSI_NULL_INTEGER if not set in WIX
+    hr = ScaWriteConfigInteger(psw->iSiteId);                        //SiteID
+    ExitOnFailure(hr, "Failed write site id value");
+
+    //Site Auto Start -- value is MSI_NULL_INTEGER if not set in WIX
+    hr = ScaWriteConfigInteger(psw->iState);                        // serverAutoStart
+    ExitOnFailure(hr, "Failed write site autostart");
+
+    hr = ScaWriteConfigInteger(psw->iConnectionTimeout);            //limits/connectionTimeout
+    ExitOnFailure(hr, "Failed write site timeout");
+
+    //create default application
+    hr = ScaWriteConfigID(IIS_APPLICATION);
+    ExitOnFailure(hr, "Failed write app ID");
+    hr = ScaWriteConfigID(IIS_CREATE);
+    ExitOnFailure(hr, "Failed write app action ID");
+    hr = ScaWriteConfigString(psw->wzDescription);      //site name key
+    ExitOnFailure(hr, "Failed write app desc");
+    hr = ScaWriteConfigString(L"/");                    //  App Path (default)
+    ExitOnFailure(hr, "Failed write app def path /");
+
+    if (psw->fHasApplication && *psw->swapp.wzAppPool)
+    {
+        hr = ScaFindAppPool7(psw->swapp.wzAppPool, wzAppPoolName, countof(wzAppPoolName), psapList);
+        ExitOnFailure(hr, "Failed to read app pool from application");
+
+        hr = ScaWriteConfigString(wzAppPoolName);
+        ExitOnFailure(hr, "Failed write app appPool");
+    }
+    else
+    {
+        hr = ScaWriteConfigString(L"");
+        ExitOnFailure(hr, "Failed write app appPool");
+    }
+
+    //create vdir for default application
+    hr = ScaWriteConfigID(IIS_VDIR);
+    ExitOnFailure(hr, "Failed write vdir ID");
+    hr = ScaWriteConfigID(IIS_CREATE);
+    ExitOnFailure(hr, "Failed write vdir action");
+    hr = ScaWriteConfigString(psw->wzDescription);      //site name key
+    ExitOnFailure(hr, "Failed write vdir desc");
+    hr = ScaWriteConfigString(L"/");                    //vdir path (default)
+    ExitOnFailure(hr, "Failed write vdir app");
+    hr = ScaWriteConfigString(psw->wzDirectory);         //physical dir
+    ExitOnFailure(hr, "Failed write vdir dir");
+
+    //create bindings for site
+    hr = ScaWriteConfigID(IIS_BINDING);
+    ExitOnFailure(hr, "Failed write binding ID");
+    hr = ScaWriteConfigID(IIS_CREATE);
+    ExitOnFailure(hr, "Failed write binding action ID");
+    hr = ScaWriteConfigString(psw->wzDescription);      //site name key
+    ExitOnFailure(hr, "Failed write binding site key");
+
+    if (psw->swaBinding.fSecure)
+    {
+        hr = ScaWriteConfigString(L"https");            // binding protocol
+        ExitOnFailure(hr, "Failed write binding https");
+    }
+    else
+    {
+        hr = ScaWriteConfigString(L"http");             // binding protocol
+        ExitOnFailure(hr, "Failed write binding http");
+    }
+
+    // set the IP address appropriately
+    if (0 == wcscmp(psw->swaBinding.wzIP, L"*"))
+    {
+        ::ZeroMemory(wzIP, sizeof(wzIP));
+    }
+    else
+    {
+#pragma prefast(suppress:26037, "Source string is null terminated - it is populated as target of ::StringCchCopyW")
+        hr = ::StringCchCopyW(wzIP, countof(wzIP), psw->swaBinding.wzIP);
+        ExitOnFailure(hr, "Failed to copy IP string");
+    }
+
+    hr = ::StringCchPrintfW(wzBinding, countof(wzBinding), L"%s:%d:%s", wzIP, psw->swaBinding.iPort, psw->swaBinding.wzHeader);
+    ExitOnFailure(hr, "Failed to format IP:Port:Header binding string");
+
+    // write bindings CAData
+    hr = ScaWriteConfigString(wzBinding) ;            //binding info
+    ExitOnFailure(hr, "Failed to create web bindings");
+
+    for (ui = 0; (ui < MAX_ADDRESSES_PER_WEB) && (ui < psw->cExtraAddresses); ++ui)
+    {
+        // set the IP address appropriately
+        if (0 == wcscmp(psw->swaExtraAddresses[ui].wzIP, L"*"))
+        {
+            ::ZeroMemory(wzIP, sizeof(wzIP));
+        }
+        else
+        {
+#pragma prefast(suppress:26037, "Source string is null terminated - it is populated as target of ::StringCchCopyW")
+            hr = ::StringCchCopyW(wzIP, countof(wzIP), psw->swaExtraAddresses[ui].wzIP);
+            ExitOnFailure(hr, "Failed to copy web IP");
+        }
+        hr = ::StringCchPrintfW(wzBinding, countof(wzBinding), L"%s:%d:%s", wzIP, psw->swaExtraAddresses[ui].iPort, psw->swaExtraAddresses[ui].wzHeader);
+        ExitOnFailure(hr, "Failed to copy web IP");
+
+        //create bindings for site
+        hr = ScaWriteConfigID(IIS_BINDING);
+        ExitOnFailure(hr, "Failed write binding ID");
+        hr = ScaWriteConfigID(IIS_CREATE);
+        ExitOnFailure(hr, "Failed write binding action");
+        hr = ScaWriteConfigString(psw->wzDescription);      //site name key
+        ExitOnFailure(hr, "Failed write binding web name");
+
+        if (psw->swaExtraAddresses[ui].fSecure)
+        {
+            hr = ScaWriteConfigString(L"https");            // binding protocol
+        }
+        else
+        {
+            hr = ScaWriteConfigString(L"http");             // binding protocol
+        }
+        ExitOnFailure(hr, "Failed write binding http(s)");
+
+        // write bindings CAData
+        hr = ScaWriteConfigString(wzBinding) ;              //binding info
+        ExitOnFailure(hr, "Failed write binding info");
+    }
+
+    // write the web dirproperties information
+    if (psw->fHasProperties)
+    {
+        // dir properties are for the default application of the web
+        // with location '/'
+        hr = ScaWriteWebDirProperties7(psw->wzDescription, L"/", &psw->swp);
+        ExitOnFailure(hr, "Failed to write web security information to metabase");
+    }
+
+    //// write the application information
+    if (psw->fHasApplication)
+    {
+        hr = ScaWriteWebApplication7(psw->wzDescription, L"/", &psw->swapp, psapList);
+        ExitOnFailure(hr, "Failed to write web application information to metabase");
+    }
+
+    // write the SSL certificate information
+    if (psw->pswscList)
+    {
+        hr = ScaSslCertificateWrite7(psw->wzDescription, psw->pswscList);
+        ExitOnFailure(hr, "Failed to write SSL certificates for Web site: %ls", psw->wzKey);
+    }
+
+    // write the headers
+    if (psw->pshhList)
+    {
+        hr = ScaWriteHttpHeader7(psw->wzDescription, L"/", psw->pshhList);
+        ExitOnFailure(hr, "Failed to write custom HTTP headers for Web site: %ls", psw->wzKey);
+    }
+
+    // write the errors
+    if (psw->psweList)
+    {
+        hr = ScaWriteWebError7(psw->wzDescription, L"/", psw->psweList);
+        ExitOnFailure(hr, "Failed to write custom web errors for Web site: %ls", psw->wzKey);
+    }
+
+    // write the log information to the metabase
+    if (psw->fHasLog)
+    {
+        hr = ScaWriteWebLog7(psw->wzDescription, &psw->swl);
+        ExitOnFailure(hr, "Failed to write web log information to metabase");
+    }
+
+LExit:
+    return hr;
+}
+
+
+static HRESULT ScaWebRemove7(
+    __in const SCA_WEB7* psw
+    )
+{
+    HRESULT hr = S_OK;
+
+    hr = ScaWriteConfigID(IIS_SITE);
+    ExitOnFailure(hr, "Failed write site ID");
+    hr = ScaWriteConfigID(IIS_DELETE);
+    ExitOnFailure(hr, "Failed write site action");
+    hr = ScaWriteConfigString(psw->wzDescription);  //Site Name
+    ExitOnFailure(hr, "Failed write site name");
+
+LExit:
+    return hr;
+}
diff --git a/src/ca/scaweb7.h b/src/ca/scaweb7.h
new file mode 100644
index 00000000..78946756
--- /dev/null
+++ b/src/ca/scaweb7.h
@@ -0,0 +1,97 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+#include "scawebapp.h"
+#include "scawebprop.h"
+#include "scahttpheader.h"
+#include "scaweberr.h"
+#include "scassl.h"
+#include "scaapppool.h"
+#include "scaweblog.h"
+
+// globals
+#define MAX_ADDRESSES_PER_WEB 10
+
+// structs
+struct SCA_WEB7
+{
+    // darwin information
+    WCHAR wzKey[MAX_DARWIN_KEY + 1];
+    WCHAR wzComponent[MAX_DARWIN_KEY + 1];
+    BOOL fHasComponent;
+    INSTALLSTATE isInstalled;
+    INSTALLSTATE isAction;
+
+    int iSiteId;
+
+    // metabase information
+    WCHAR wzWebBase[METADATA_MAX_NAME_LEN + 1];
+    BOOL fBaseExists;
+
+    // iis configuation information
+    SCA_WEB_ADDRESS swaBinding;
+
+    SCA_WEB_ADDRESS swaExtraAddresses[MAX_ADDRESSES_PER_WEB + 1];
+    DWORD cExtraAddresses;
+
+    WCHAR wzDirectory[MAX_PATH];
+    WCHAR wzDescription[MAX_DARWIN_COLUMN + 1];
+
+    int iState;
+    int iAttributes;
+
+    BOOL fHasProperties;
+    SCA_WEB_PROPERTIES swp;
+
+    BOOL fHasApplication;
+    SCA_WEB_APPLICATION swapp;
+
+    BOOL fHasSecurity;
+    int dwAccessPermissions;
+    int iConnectionTimeout;
+
+    SCA_WEB_SSL_CERTIFICATE* pswscList;
+    SCA_HTTP_HEADER* pshhList;
+    SCA_WEB_ERROR* psweList;
+
+    BOOL fHasLog;
+    SCA_WEB_LOG swl;
+
+    SCA_WEB7* pswNext;
+};
+
+
+// prototypes
+HRESULT ScaWebsRead7(
+    __in SCA_WEB7** ppswList,
+    __in SCA_HTTP_HEADER** ppshhList,
+    __in SCA_WEB_ERROR** ppsweList,
+    __in WCA_WRAPQUERY_HANDLE hUserQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebDirPropQuery,
+    __in WCA_WRAPQUERY_HANDLE hSslCertQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebLogQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebAppQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebAppExtQuery,
+    __inout LPWSTR *ppwzCustomActionData
+    );
+
+HRESULT ScaWebsGetBase7(
+    __in SCA_WEB7* pswList,
+    __in LPCWSTR pswWebKey,
+    __out_ecount(cchDest) LPWSTR pswWeb,
+    __in DWORD_PTR cchDest
+    );
+
+HRESULT ScaWebsInstall7(
+    __in SCA_WEB7* pswList,
+    __in SCA_APPPOOL * psapList
+    );
+
+HRESULT ScaWebsUninstall7(
+    __in SCA_WEB7* pswList
+    );
+
+void ScaWebsFreeList7(
+    __in SCA_WEB7* pswHead
+    );
diff --git a/src/ca/scawebapp.cpp b/src/ca/scawebapp.cpp
new file mode 100644
index 00000000..a7e9cf82
--- /dev/null
+++ b/src/ca/scawebapp.cpp
@@ -0,0 +1,194 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+// sql queries
+enum eWebApplicationQuery { wappqName = 1, wappqIsolation, wappqAllowSession,
+                            wappqSessionTimeout, wappqBuffer, wappqParentPaths,
+                            wappqDefaultScript, wappqScriptTimeout,
+                            wappqServerDebugging, wappqClientDebugging, wappqAppPool, wappqApplication};
+
+
+HRESULT ScaGetWebApplication(MSIHANDLE /*hViewApplications*/, 
+                             LPCWSTR pwzApplication,
+                             __in WCA_WRAPQUERY_HANDLE hWebAppQuery,
+                             __in WCA_WRAPQUERY_HANDLE hWebAppExtQuery,
+                             SCA_WEB_APPLICATION* pswapp)
+{
+    HRESULT hr = S_OK;
+
+    MSIHANDLE hRec;
+    LPWSTR pwzData = NULL;
+
+    // Reset back to the first record
+    WcaFetchWrappedReset(hWebAppQuery);
+
+    // get the application information
+    hr = WcaFetchWrappedRecordWhereString(hWebAppQuery, wappqApplication, pwzApplication, &hRec);
+    if (S_OK == hr)
+    {
+        // application name
+        hr = WcaGetRecordString(hRec, wappqName, &pwzData);
+        ExitOnFailure(hr, "Failed to get Name of App");
+        hr = ::StringCchCopyW(pswapp->wzName, countof(pswapp->wzName), pwzData);
+        if (HRESULT_FROM_WIN32(ERROR_INSUFFICIENT_BUFFER) == hr)
+        {
+            // The application name is sometimes truncated to IIS's supported length, so ignore insufficient buffer errors here
+            WcaLog(LOGMSG_VERBOSE, "Application name \"%ls\" truncated to fit IIS's supported %d-character length", pwzData, MAX_APP_NAME);
+            hr = S_OK;
+        }
+        ExitOnFailure(hr, "Failed to copy name string to webapp object");
+
+        hr = WcaGetRecordInteger(hRec, wappqIsolation, &pswapp->iIsolation);
+        ExitOnFailure(hr, "Failed to get App isolation: '%ls'", pswapp->wzName);
+
+        hr = WcaGetRecordInteger(hRec, wappqAllowSession, &pswapp->fAllowSessionState);
+
+        hr = WcaGetRecordInteger(hRec, wappqSessionTimeout, &pswapp->iSessionTimeout);
+
+        hr = WcaGetRecordInteger(hRec, wappqBuffer, &pswapp->fBuffer);
+
+        hr = WcaGetRecordInteger(hRec, wappqParentPaths, &pswapp->fParentPaths);
+
+        hr = WcaGetRecordString(hRec, wappqDefaultScript, &pwzData);
+        ExitOnFailure(hr, "Failed to get default scripting language for App: '%ls'", pswapp->wzName);
+        hr = ::StringCchCopyW(pswapp->wzDefaultScript, countof(pswapp->wzDefaultScript), pwzData);
+        ExitOnFailure(hr, "Failed to copy default script string to webapp object");
+
+        // asp script timeout
+        hr = WcaGetRecordInteger(hRec, wappqScriptTimeout, &pswapp->iScriptTimeout);
+        ExitOnFailure(hr, "Failed to get scripting timeout for App: '%ls'", pswapp->wzName);
+
+        // asp server-side script debugging
+        hr = WcaGetRecordInteger(hRec, wappqServerDebugging, &pswapp->fServerDebugging);
+
+        // asp client-side script debugging
+        hr = WcaGetRecordInteger(hRec, wappqClientDebugging, &pswapp->fClientDebugging);
+
+        hr = WcaGetRecordString(hRec, wappqAppPool, &pwzData);
+        ExitOnFailure(hr, "Failed to get AppPool for App: '%ls'", pswapp->wzName);
+        hr = ::StringCchCopyW(pswapp->wzAppPool, countof(pswapp->wzAppPool), pwzData);
+        ExitOnFailure(hr, "failed to copy AppPool: '%ls' for App: '%ls'", pwzData, pswapp->wzName);
+
+        // app extensions
+         hr = ScaWebAppExtensionsRead(pwzApplication, hWebAppExtQuery, &pswapp->pswappextList);
+        ExitOnFailure(hr, "Failed to read AppExtensions for App: '%ls'", pswapp->wzName);
+
+        hr = S_OK;
+    }
+    else if (E_NOMOREITEMS == hr)
+    {
+        WcaLog(LOGMSG_STANDARD, "Error: Cannot locate IIsWebApplication.Application='%ls'", pwzApplication);
+        hr = E_FAIL;
+    }
+    else
+        ExitOnFailure(hr, "Error matching Application rows");
+
+    // Let's check that there isn't more than one record found - if there is, throw an assert like WcaFetchSingleRecord() would
+    HRESULT hrTemp = WcaFetchWrappedRecordWhereString(hWebAppQuery, wappqApplication, pwzApplication, &hRec);
+    if (SUCCEEDED(hrTemp))
+    {
+        AssertSz(E_NOMOREITEMS == hrTemp, "ScaGetWebApplication found more than one record");
+    }
+
+LExit:
+    ReleaseStr(pwzData);
+
+    return hr;
+}
+
+
+HRESULT ScaWriteWebApplication(IMSAdminBase* piMetabase, LPCWSTR wzRootOfWeb, 
+                               SCA_WEB_APPLICATION* pswapp, SCA_APPPOOL * psapList)
+{
+    HRESULT hr = S_OK;
+    WCHAR wzAppPoolName[MAX_PATH];
+
+    hr = ScaCreateApp(piMetabase, wzRootOfWeb, pswapp->iIsolation);
+    ExitOnFailure(hr, "Failed to create ASP App");
+
+    // Medium Isolation seems to have to be set through the metabase
+    if (2 == pswapp->iIsolation)
+    {
+        hr = ScaWriteMetabaseValue(piMetabase, wzRootOfWeb, NULL, MD_APP_ISOLATED, METADATA_INHERIT, IIS_MD_UT_WAM, DWORD_METADATA, (LPVOID)((DWORD_PTR)pswapp->iIsolation));
+        ExitOnFailure(hr, "Failed to write isolation value for App: '%ls'", pswapp->wzName);
+    }
+
+    // application name
+    hr = ScaWriteMetabaseValue(piMetabase, wzRootOfWeb, NULL, MD_APP_FRIENDLY_NAME, METADATA_INHERIT, IIS_MD_UT_WAM, STRING_METADATA, pswapp->wzName);
+    ExitOnFailure(hr, "Failed to write Name of App: '%ls'", pswapp->wzName);
+
+    // allow session state
+    if (MSI_NULL_INTEGER != pswapp->fAllowSessionState)
+    {
+        hr = ScaWriteMetabaseValue(piMetabase, wzRootOfWeb, NULL, MD_ASP_ALLOWSESSIONSTATE, METADATA_INHERIT, ASP_MD_UT_APP, DWORD_METADATA, (LPVOID)((DWORD_PTR)pswapp->fAllowSessionState));
+        ExitOnFailure(hr, "Failed to write allow session information for App: '%ls'", pswapp->wzName);
+    }
+
+    // session timeout
+    if (MSI_NULL_INTEGER != pswapp->iSessionTimeout)
+    {
+        hr = ScaWriteMetabaseValue(piMetabase, wzRootOfWeb, NULL, MD_ASP_SESSIONTIMEOUT, METADATA_INHERIT, ASP_MD_UT_APP, DWORD_METADATA, (LPVOID)((DWORD_PTR)pswapp->iSessionTimeout));
+        ExitOnFailure(hr, "Failed to write session timeout for App: '%ls'", pswapp->wzName);
+    }
+
+    // asp buffering
+    if (MSI_NULL_INTEGER != pswapp->fBuffer)
+    {
+        hr = ScaWriteMetabaseValue(piMetabase, wzRootOfWeb, NULL, MD_ASP_BUFFERINGON, METADATA_INHERIT, ASP_MD_UT_APP, DWORD_METADATA, (LPVOID)((DWORD_PTR)pswapp->fBuffer));
+        ExitOnFailure(hr, "Failed to write buffering flag for App: '%ls'", pswapp->wzName);
+    }
+
+    // asp parent paths
+    if (MSI_NULL_INTEGER != pswapp->fParentPaths)
+    {
+        hr = ScaWriteMetabaseValue(piMetabase, wzRootOfWeb, NULL, MD_ASP_ENABLEPARENTPATHS, METADATA_INHERIT, ASP_MD_UT_APP, DWORD_METADATA, (LPVOID)((DWORD_PTR)pswapp->fParentPaths));
+        ExitOnFailure(hr, "Failed to write parent paths flag for App: '%ls'", pswapp->wzName);
+    }
+
+    // default scripting language
+    if (*pswapp->wzDefaultScript)
+    {
+        hr = ScaWriteMetabaseValue(piMetabase, wzRootOfWeb, NULL, MD_ASP_SCRIPTLANGUAGE, METADATA_INHERIT, ASP_MD_UT_APP, STRING_METADATA, pswapp->wzDefaultScript);
+        ExitOnFailure(hr, "Failed to write default scripting language for App: '%ls'", pswapp->wzName);
+    }
+
+    // asp script timeout
+    if (MSI_NULL_INTEGER != pswapp->iScriptTimeout)
+    {
+        hr = ScaWriteMetabaseValue(piMetabase, wzRootOfWeb, NULL, MD_ASP_SCRIPTTIMEOUT, METADATA_INHERIT, ASP_MD_UT_APP, DWORD_METADATA, (LPVOID)((DWORD_PTR)pswapp->iScriptTimeout));
+        ExitOnFailure(hr, "Failed to write script timeout for App: '%ls'", pswapp->wzName);
+    }
+
+    // asp server-side script debugging
+    if (MSI_NULL_INTEGER != pswapp->fServerDebugging)
+    {
+        hr = ScaWriteMetabaseValue(piMetabase, wzRootOfWeb, NULL, MD_ASP_ENABLESERVERDEBUG, METADATA_INHERIT, ASP_MD_UT_APP, DWORD_METADATA, (LPVOID)((DWORD_PTR)pswapp->fServerDebugging));
+        ExitOnFailure(hr, "Failed to write ASP server-side script debugging flag for App: '%ls'", pswapp->wzName);
+    }
+
+    // asp server-side script debugging
+    if (MSI_NULL_INTEGER != pswapp->fClientDebugging)
+    {
+        hr = ScaWriteMetabaseValue(piMetabase, wzRootOfWeb, NULL, MD_ASP_ENABLECLIENTDEBUG, METADATA_INHERIT, ASP_MD_UT_APP, DWORD_METADATA, (LPVOID)((DWORD_PTR)pswapp->fClientDebugging));
+        ExitOnFailure(hr, "Failed to write ASP client-side script debugging flag for App: '%ls'", pswapp->wzName);
+    }
+
+    // AppPool
+    if (*pswapp->wzAppPool && NULL != psapList)
+    {
+        hr = ScaFindAppPool(piMetabase, pswapp->wzAppPool, wzAppPoolName, countof(wzAppPoolName), psapList);
+        ExitOnFailure(hr, "failed to find app pool: %ls", pswapp->wzAppPool);
+        hr = ScaWriteMetabaseValue(piMetabase, wzRootOfWeb, NULL, MD_APP_APPPOOL_ID, METADATA_INHERIT, IIS_MD_UT_SERVER, STRING_METADATA, wzAppPoolName);
+        ExitOnFailure(hr, "Failed to write default AppPool for App: '%ls'", pswapp->wzName);
+    }
+
+    if (pswapp->pswappextList)
+    {
+        hr = ScaWebAppExtensionsWrite(piMetabase, wzRootOfWeb, pswapp->pswappextList);
+        ExitOnFailure(hr, "Failed to write AppExtensions for App: '%ls'", pswapp->wzName);
+    }
+
+LExit:
+    return hr;
+}
diff --git a/src/ca/scawebapp.h b/src/ca/scawebapp.h
new file mode 100644
index 00000000..a4152116
--- /dev/null
+++ b/src/ca/scawebapp.h
@@ -0,0 +1,42 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+#include "scaapppool.h"
+#include "scawebappext.h"
+
+// global sql queries provided for optimization
+extern LPCWSTR vcsWebApplicationQuery;
+const int MAX_APP_NAME = 255;
+
+// structs
+struct SCA_WEB_APPLICATION
+{
+        WCHAR wzName[MAX_APP_NAME + 1];
+
+        int iIsolation;
+        BOOL fAllowSessionState;
+        int iSessionTimeout;
+        BOOL fBuffer;
+        BOOL fParentPaths;
+
+        WCHAR wzDefaultScript[MAX_DARWIN_COLUMN + 1];
+        int iScriptTimeout;
+        BOOL fServerDebugging;
+        BOOL fClientDebugging;
+        WCHAR wzAppPool[MAX_DARWIN_COLUMN + 1];
+
+        SCA_WEB_APPLICATION_EXTENSION* pswappextList;
+};
+
+
+// prototypes
+HRESULT ScaGetWebApplication(MSIHANDLE hViewApplications, 
+                             LPCWSTR pwzApplication,
+                             __in WCA_WRAPQUERY_HANDLE hWebAppQuery,
+                             __in WCA_WRAPQUERY_HANDLE hWebAppExtQuery,
+                             SCA_WEB_APPLICATION* pswapp);
+
+HRESULT ScaWriteWebApplication(IMSAdminBase* piMetabase, LPCWSTR wzRootOfWeb, 
+                               SCA_WEB_APPLICATION* pswapp, SCA_APPPOOL * psapList);
+
diff --git a/src/ca/scawebapp7.cpp b/src/ca/scawebapp7.cpp
new file mode 100644
index 00000000..94e6bb18
--- /dev/null
+++ b/src/ca/scawebapp7.cpp
@@ -0,0 +1,120 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+HRESULT ScaWriteWebApplication7(
+    __in_z LPCWSTR wzWebName,
+    __in_z LPCWSTR wzRootOfWeb,
+    SCA_WEB_APPLICATION* pswapp,
+    SCA_APPPOOL * /*psapList*/
+    )
+{
+    HRESULT hr = S_OK;
+
+    //all go to same web/root location tag
+    hr = ScaWriteConfigID(IIS_ASP_BEGIN);
+    ExitOnFailure(hr, "Failed to write WebApp ASP begin id");
+    hr = ScaWriteConfigString(wzWebName);                //site name key
+    ExitOnFailure(hr, "Failed to write app web key");
+    hr = ScaWriteConfigString(wzRootOfWeb);               //app path key
+    ExitOnFailure(hr, "Failed to write app web root");
+
+    // IIS7 Not Supported: Isolation
+    if (MSI_NULL_INTEGER != pswapp->iIsolation)
+    {
+        WcaLog(LOGMSG_TRACEONLY, "Not supported by IIS7: Isolation Mode, ignoring");
+    }
+
+    // allow session state
+    if (MSI_NULL_INTEGER != pswapp->fAllowSessionState)
+    {
+        //system.webServer/asp /session | allowSessionState
+        hr = ScaWriteConfigID(IIS_ASP_SESSIONSTATE);
+        ExitOnFailure(hr, "Failed to write WebApp ASP sessionstate id");
+        hr = ScaWriteConfigInteger(pswapp->fAllowSessionState);
+        ExitOnFailure(hr, "Failed to write allow session information for App: '%ls'", pswapp->wzName);
+    }
+
+    // session timeout
+    if (MSI_NULL_INTEGER != pswapp->iSessionTimeout)
+    {
+        //system.webServer/asp /session | timeout
+        hr = ScaWriteConfigID(IIS_ASP_SESSIONTIMEOUT);
+        ExitOnFailure(hr, "Failed to write WebApp ASP sessiontimepot id");
+        hr = ScaWriteConfigInteger(pswapp->iSessionTimeout);
+        ExitOnFailure(hr, "Failed to write session timeout for App: '%ls'", pswapp->wzName);
+    }
+
+    // asp buffering
+    if (MSI_NULL_INTEGER != pswapp->fBuffer)
+    {
+        //system.webServer/asp | bufferingOn
+        hr = ScaWriteConfigID(IIS_ASP_BUFFER);
+        ExitOnFailure(hr, "Failed to write WebApp ASP buffer id");
+        hr = ScaWriteConfigInteger(pswapp->fBuffer);
+        ExitOnFailure(hr, "Failed to write buffering flag for App: '%ls'", pswapp->wzName);
+    }
+
+    // asp parent paths
+    if (MSI_NULL_INTEGER != pswapp->fParentPaths)
+    {
+        //system.webServer/asp | enableParentPaths
+        hr = ScaWriteConfigID(IIS_ASP_PARENTPATHS);
+        ExitOnFailure(hr, "Failed to write WebApp ASP parentpaths id");
+        hr = ScaWriteConfigInteger(pswapp->fParentPaths);
+        ExitOnFailure(hr, "Failed to write parent paths flag for App: '%ls'", pswapp->wzName);
+    }
+
+    // default scripting language
+    if (*pswapp->wzDefaultScript)
+    {
+        //system.webServer/asp | scriptLanguage
+        hr = ScaWriteConfigID(IIS_ASP_SCRIPTLANG);
+        ExitOnFailure(hr, "Failed to write WebApp ASP script lang id");
+        hr = ScaWriteConfigString(pswapp->wzDefaultScript);
+        ExitOnFailure(hr, "Failed to write default scripting language for App: '%ls'", pswapp->wzName);
+    }
+
+    // asp script timeout
+    if (MSI_NULL_INTEGER != pswapp->iScriptTimeout)
+    {
+        //system.webServer/asp /limits | scriptTimeout
+        hr = ScaWriteConfigID(IIS_ASP_SCRIPTTIMEOUT);
+        ExitOnFailure(hr, "Failed to write WebApp ASP script timeout id");
+        hr = ScaWriteConfigInteger(pswapp->iScriptTimeout);
+        ExitOnFailure(hr, "Failed to write script timeout for App: '%ls'", pswapp->wzName);
+    }
+
+    // asp server-side script debugging
+    if (MSI_NULL_INTEGER != pswapp->fServerDebugging)
+    {
+        //system.webServer/asp | appAllowDebugging
+        hr = ScaWriteConfigID(IIS_ASP_SCRIPTSERVERDEBUG);
+        ExitOnFailure(hr, "Failed to write WebApp ASP script debug id");
+        hr = ScaWriteConfigInteger(pswapp->fServerDebugging);
+        ExitOnFailure(hr, "Failed to write ASP server-side script debugging flag for App: '%ls'", pswapp->wzName);
+    }
+
+    // asp client-side script debugging
+    if (MSI_NULL_INTEGER != pswapp->fClientDebugging)
+    {
+        //system.webServer/asp | appAllowClientDebug
+        hr = ScaWriteConfigID(IIS_ASP_SCRIPTCLIENTDEBUG);
+        ExitOnFailure(hr, "Failed to write WebApp ASP script debug id");
+        hr = ScaWriteConfigInteger(pswapp->fClientDebugging);
+        ExitOnFailure(hr, "Failed to write ASP client-side script debugging flag for App: '%ls'", pswapp->wzName);
+    }
+
+    //done with ASP application properties
+    hr = ScaWriteConfigID(IIS_ASP_END);
+    ExitOnFailure(hr, "Failed to write WebApp ASP begin id");
+
+    //write out app estensions
+    if (pswapp->pswappextList)
+    {
+        hr = ScaWebAppExtensionsWrite7(wzWebName, wzRootOfWeb, pswapp->pswappextList);
+        ExitOnFailure(hr, "Failed to write AppExtensions for App: '%ls'", pswapp->wzName);
+    }
+
+LExit:
+    return hr;
+}
diff --git a/src/ca/scawebapp7.h b/src/ca/scawebapp7.h
new file mode 100644
index 00000000..e1d87f53
--- /dev/null
+++ b/src/ca/scawebapp7.h
@@ -0,0 +1,10 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+HRESULT ScaWriteWebApplication7(
+    __in_z LPCWSTR wzWebName,
+    __in_z LPCWSTR wzRootOfWeb,
+    SCA_WEB_APPLICATION* pswapp,
+    SCA_APPPOOL * psapList
+    );
diff --git a/src/ca/scawebappext.cpp b/src/ca/scawebappext.cpp
new file mode 100644
index 00000000..cf3b9dd3
--- /dev/null
+++ b/src/ca/scawebappext.cpp
@@ -0,0 +1,207 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+enum eWebAppExtensionQuery { wappextqExtension = 1, wappextqVerbs, wappextqExecutable, wappextqAttributes, wappextqApplication };
+
+// prototypes for private helper functions
+static HRESULT NewAppExt(
+    __out SCA_WEB_APPLICATION_EXTENSION** ppswappext
+    );
+static SCA_WEB_APPLICATION_EXTENSION* AddAppExtToList(
+    __in SCA_WEB_APPLICATION_EXTENSION* pswappextList,
+    __in SCA_WEB_APPLICATION_EXTENSION* pswappext
+    );
+
+
+
+HRESULT ScaWebAppExtensionsRead(
+    __in LPCWSTR wzApplication,
+    __in WCA_WRAPQUERY_HANDLE hWebAppExtQuery,
+    __inout SCA_WEB_APPLICATION_EXTENSION** ppswappextList
+    )
+{
+    HRESULT hr = S_OK;
+    MSIHANDLE hRec;
+
+    SCA_WEB_APPLICATION_EXTENSION* pswappext = NULL;
+    LPWSTR pwzData = NULL;
+
+    // Reset back to the first record
+    WcaFetchWrappedReset(hWebAppExtQuery);
+
+    // get the application extension information
+    while (S_OK == (hr = WcaFetchWrappedRecordWhereString(hWebAppExtQuery, wappextqApplication, wzApplication, &hRec)))
+    {
+        hr = NewAppExt(&pswappext);
+        ExitOnFailure(hr, "failed to create new web app extension");
+
+        // get the extension
+        hr = WcaGetRecordString(hRec, wappextqExtension, &pwzData);
+        ExitOnFailure(hr, "Failed to get Web Application Extension");
+        hr = ::StringCchCopyW(pswappext->wzExtension, countof(pswappext->wzExtension), pwzData);
+        ExitOnFailure(hr, "Failed to copy extension string to webappext object");
+
+        // application extension verbs
+        hr = WcaGetRecordString(hRec, wappextqVerbs, &pwzData);
+        ExitOnFailure(hr, "Failed to get Verbs for Application: '%ls'", wzApplication);
+        hr = ::StringCchCopyW(pswappext->wzVerbs, countof(pswappext->wzVerbs), pwzData);
+        ExitOnFailure(hr, "Failed to copy verbs string to webappext object");
+
+        // extension executeable
+        hr = WcaGetRecordString(hRec, wappextqExecutable, &pwzData);
+        ExitOnFailure(hr, "Failed to get Executable for Application: '%ls'", wzApplication);
+        hr = ::StringCchCopyW(pswappext->wzExecutable, countof(pswappext->wzExecutable), pwzData);
+        ExitOnFailure(hr, "Failed to copy executable string to webappext object");
+
+        hr = WcaGetRecordInteger(hRec, wappextqAttributes, &pswappext->iAttributes);
+        if (S_FALSE == hr)
+        {
+            pswappext->iAttributes = 0;
+            hr = S_OK;
+        }
+        ExitOnFailure(hr, "Failed to get App isolation");
+
+        *ppswappextList = AddAppExtToList(*ppswappextList, pswappext);
+        pswappext = NULL; // set the appext NULL so it doesn't accidentally get freed below
+    }
+
+    if (E_NOMOREITEMS == hr)
+    {
+        hr = S_OK;
+    }
+
+LExit:
+    // if anything was left over after an error clean it all up
+    if (pswappext)
+    {
+        ScaWebAppExtensionsFreeList(pswappext);
+    }
+
+    ReleaseStr(pwzData);
+
+    return hr;
+}
+
+
+
+HRESULT ScaWebAppExtensionsWrite(
+    __in IMSAdminBase* piMetabase,
+    __in LPCWSTR wzRootOfWeb,
+    __in SCA_WEB_APPLICATION_EXTENSION* pswappextList
+    )
+{
+    HRESULT hr = S_OK;
+
+    LPWSTR wzAppExt = NULL;
+    DWORD cchAppExt;
+    WCHAR wzAppExtension[1024];
+    WCHAR wzAppExtensions[65536];
+    SCA_WEB_APPLICATION_EXTENSION* pswappext = NULL;
+
+    if (!pswappextList)
+    {
+        ExitFunction();
+    }
+
+    ::ZeroMemory(wzAppExtensions, sizeof(wzAppExtensions));
+    wzAppExt = wzAppExtensions;
+    cchAppExt = countof(wzAppExtensions);
+    pswappext = pswappextList;
+
+    while (pswappext)
+    {
+        // if all (represented by "*" or blank)
+        if (0 == lstrcmpW(pswappext->wzExtension, L"*") || 0 == lstrlenW(pswappext->wzExtension))
+        {
+            hr = ::StringCchPrintfW(wzAppExtension, countof(wzAppExtension), L"*,%s,%d", pswappext->wzExecutable, pswappext->iAttributes);
+            ExitOnFailure(hr, "Failed to format *,executable,attributes string");
+        }
+        else
+        {
+            hr = ::StringCchPrintfW(wzAppExtension, countof(wzAppExtension), L".%s,%s,%d", pswappext->wzExtension, pswappext->wzExecutable, pswappext->iAttributes);
+            ExitOnFailure(hr, "Failed to format extension,executable,attributes string");
+        }
+
+        // if verbs were specified and not the keyword "all"
+        if (pswappext->wzVerbs[0] && CSTR_EQUAL != CompareStringW(LOCALE_INVARIANT, NORM_IGNORECASE, pswappext->wzVerbs, -1, L"all", -1))
+        {
+            hr = ::StringCchCatW(wzAppExtension, countof(wzAppExtension), L",");
+            ExitOnFailure(hr, "Failed to concatenate comma to app extension string");
+            hr = ::StringCchCatW(wzAppExtension, countof(wzAppExtension), pswappext->wzVerbs);
+            ExitOnFailure(hr, "Failed to concatenate verb to app extension string");
+        }
+
+        hr = ::StringCchCopyW(wzAppExt, cchAppExt, wzAppExtension);
+        ExitOnFailure(hr, "Failed to copy app extension string");
+        wzAppExt += lstrlenW(wzAppExtension) + 1;
+        cchAppExt -= lstrlenW(wzAppExtension) + 1;
+        pswappext = pswappext->pswappextNext;
+    }
+
+    if (*wzAppExtensions)
+    {
+        hr = ScaWriteMetabaseValue(piMetabase, wzRootOfWeb, NULL, MD_SCRIPT_MAPS, METADATA_INHERIT, IIS_MD_UT_FILE, MULTISZ_METADATA, wzAppExtensions);
+        ExitOnFailure(hr, "Failed to write AppExtension: '%ls'", wzAppExtension);
+    }
+
+LExit:
+    return hr;
+}
+
+
+void ScaWebAppExtensionsFreeList(
+    __in SCA_WEB_APPLICATION_EXTENSION* pswappextList
+    )
+{
+    SCA_WEB_APPLICATION_EXTENSION* pswappextDelete = pswappextList;
+    while (pswappextList)
+    {
+        pswappextDelete = pswappextList;
+        pswappextList = pswappextList->pswappextNext;
+
+        MemFree(pswappextDelete);
+    }
+}
+
+
+
+// private helper functions
+
+static HRESULT NewAppExt(
+    __out SCA_WEB_APPLICATION_EXTENSION** ppswappext
+    )
+{
+    HRESULT hr = S_OK;
+    SCA_WEB_APPLICATION_EXTENSION* pswappext = static_cast<SCA_WEB_APPLICATION_EXTENSION*>(MemAlloc(sizeof(SCA_WEB_APPLICATION_EXTENSION), TRUE));
+    ExitOnNull(pswappext, hr, E_OUTOFMEMORY, "failed to allocate memory for new web app ext element");
+
+    *ppswappext = pswappext;
+
+LExit:
+    return hr;
+}
+
+
+static SCA_WEB_APPLICATION_EXTENSION* AddAppExtToList(
+    __in SCA_WEB_APPLICATION_EXTENSION* pswappextList,
+    __in SCA_WEB_APPLICATION_EXTENSION* pswappext
+    )
+{
+    if (pswappextList)
+    {
+        SCA_WEB_APPLICATION_EXTENSION* pswappextT = pswappextList;
+        while (pswappextT->pswappextNext)
+        {
+            pswappextT = pswappextT->pswappextNext;
+        }
+
+        pswappextT->pswappextNext = pswappext;
+    }
+    else
+    {
+        pswappextList = pswappext;
+    }
+
+    return pswappextList;
+}
diff --git a/src/ca/scawebappext.h b/src/ca/scawebappext.h
new file mode 100644
index 00000000..71adfd00
--- /dev/null
+++ b/src/ca/scawebappext.h
@@ -0,0 +1,32 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+struct SCA_WEB_APPLICATION_EXTENSION
+{
+    WCHAR wzExtension[MAX_DARWIN_COLUMN + 1];
+
+    WCHAR wzVerbs[MAX_DARWIN_COLUMN + 1];
+    WCHAR wzExecutable[MAX_DARWIN_COLUMN + 1];
+    int iAttributes;
+
+    SCA_WEB_APPLICATION_EXTENSION* pswappextNext;
+};
+
+
+// prototypes
+HRESULT ScaWebAppExtensionsRead(
+    __in LPCWSTR wzApplication,
+    __in WCA_WRAPQUERY_HANDLE hWebAppExtQuery,
+    __inout SCA_WEB_APPLICATION_EXTENSION** ppswappextList
+    );
+
+HRESULT ScaWebAppExtensionsWrite(
+    __in IMSAdminBase* piMetabase,
+    __in LPCWSTR wzRootOfWeb,
+    __in SCA_WEB_APPLICATION_EXTENSION* pswappextList
+    );
+
+void ScaWebAppExtensionsFreeList(
+    __in SCA_WEB_APPLICATION_EXTENSION* pswappextList
+    );
diff --git a/src/ca/scawebappext7.cpp b/src/ca/scawebappext7.cpp
new file mode 100644
index 00000000..50d3172f
--- /dev/null
+++ b/src/ca/scawebappext7.cpp
@@ -0,0 +1,61 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+HRESULT ScaWebAppExtensionsWrite7(
+    __in_z LPCWSTR wzWebName,
+    __in_z LPCWSTR wzRootOfWeb,
+    __in SCA_WEB_APPLICATION_EXTENSION* pswappextList
+    )
+{
+    HRESULT hr = S_OK;
+    SCA_WEB_APPLICATION_EXTENSION* pswappext = NULL;
+
+    if (!pswappextList)
+    {
+        ExitFunction1(hr = S_OK);
+    }
+
+    //create the Extension for this vdir application
+    //all go to same web/root location tag
+    hr = ScaWriteConfigID(IIS_APPEXT_BEGIN);
+    ExitOnFailure(hr, "Failed to write webappext begin id");
+    hr = ScaWriteConfigString(wzWebName);                //site name key
+    ExitOnFailure(hr, "Failed to write app web key");
+    hr = ScaWriteConfigString(wzRootOfWeb);               //app path key
+    ExitOnFailure(hr, "Failed to write app web key");
+
+    pswappext = pswappextList;
+
+    while (pswappext)
+    {
+        //create the Extension for this vdir application
+        hr = ScaWriteConfigID(IIS_APPEXT);
+        ExitOnFailure(hr, "Failed to write webappext begin id");
+
+        if (*pswappext->wzExtension)
+        {
+            hr = ScaWriteConfigString(pswappext->wzExtension);
+        }
+        else   // blank means "*" (all)
+        {
+            hr = ScaWriteConfigString(L"*");
+        }
+        ExitOnFailure(hr, "Failed to write extension");
+
+        hr = ScaWriteConfigString(pswappext->wzExecutable);
+        ExitOnFailure(hr, "Failed to write extension executable");
+
+        hr = ScaWriteConfigString(pswappext->wzVerbs);
+        ExitOnFailure(hr, "Failed to write extension verbs");
+
+        pswappext = pswappext->pswappextNext;
+    }
+
+    hr = ScaWriteConfigID(IIS_APPEXT_END);
+    ExitOnFailure(hr, "Failed to write webappext begin id");
+
+LExit:
+    return hr;
+}
+
diff --git a/src/ca/scawebappext7.h b/src/ca/scawebappext7.h
new file mode 100644
index 00000000..55c8b5fc
--- /dev/null
+++ b/src/ca/scawebappext7.h
@@ -0,0 +1,9 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+HRESULT ScaWebAppExtensionsWrite7(
+    __in_z LPCWSTR wzWebName,
+    __in_z LPCWSTR wzRootOfWeb,
+    __in SCA_WEB_APPLICATION_EXTENSION* pswappextList
+    );
diff --git a/src/ca/scawebdir.cpp b/src/ca/scawebdir.cpp
new file mode 100644
index 00000000..26a7b32b
--- /dev/null
+++ b/src/ca/scawebdir.cpp
@@ -0,0 +1,241 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+// sql queries
+enum eWebDirQuery { wdqWeb = 1, wdqWebDir, wdqComponent , wdqPath, wdqProperties, wdqApplication, wdqInstalled, wdqAction };
+
+// prototypes
+static void AddWebDirToList(SCA_WEBDIR** ppswdList, SCA_WEBDIR *pswd);
+
+static SCA_WEBDIR* NewWebDir();
+static void FreeWebDir(SCA_WEBDIR *pswd);
+
+
+UINT __stdcall ScaWebDirsRead(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_WEB* pswList,
+    __in WCA_WRAPQUERY_HANDLE hUserQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebBaseQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebDirPropQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebAppQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebAppExtQuery,
+    __inout LPWSTR *ppwzCustomActionData,
+    __out SCA_WEBDIR** ppswdList
+    )
+{
+    Assert(piMetabase && ppswdList);
+
+    HRESULT hr = S_OK;
+    MSIHANDLE hRec;
+
+    LPWSTR pwzData = NULL;
+    SCA_WEBDIR* pswd;
+    WCA_WRAPQUERY_HANDLE hWrapQuery = NULL;
+
+    hr = WcaBeginUnwrapQuery(&hWrapQuery, ppwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap query for ScaWebDirsRead");
+
+    if (0 == WcaGetQueryRecords(hWrapQuery))
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping ScaInstallWebDirs() because IIsWebDir table not present");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    // loop through all the web directories
+    while (S_OK == (hr = WcaFetchWrappedRecord(hWrapQuery, &hRec)))
+    {
+        pswd = NewWebDir();
+        ExitOnNull(pswd, hr, E_OUTOFMEMORY, "Failed to allocate memory for web dir object in memory");
+
+        // get component install state
+        hr = WcaGetRecordString(hRec, wdqComponent, &pwzData);
+        ExitOnFailure(hr, "Failed to get Component for WebDirs");
+        hr = ::StringCchCopyW(pswd->wzComponent, countof(pswd->wzComponent), pwzData);
+        ExitOnFailure(hr, "Failed to copy component string to webdir object");
+
+        hr = WcaGetRecordInteger(hRec, wdqInstalled, (int *)&pswd->isInstalled);
+        ExitOnFailure(hr, "Failed to get Component installed state for webdir");
+
+        hr = WcaGetRecordInteger(hRec, wdqAction, (int *)&pswd->isAction);
+        ExitOnFailure(hr, "Failed to get Component action state for webdir");
+
+        // If this record has a component and no action is being taken for it, skip processing it entirely
+        if (0 < lstrlenW(pswd->wzComponent) && !WcaIsInstalling(pswd->isInstalled, pswd->isAction)
+            && !WcaIsUninstalling(pswd->isInstalled, pswd->isAction) && !WcaIsReInstalling(pswd->isInstalled, pswd->isAction))
+        {
+            FreeWebDir(pswd);
+            pswd = NULL;
+            continue;
+        }
+
+        hr = WcaGetRecordString(hRec, wdqWeb, &pwzData);
+        ExitOnFailure(hr, "Failed to get Web for WebDir");
+
+        hr = ScaWebsGetBase(piMetabase, pswList, pwzData, pswd->wzWebBase, countof(pswd->wzWebBase), hWebBaseQuery);
+        if (WcaIsUninstalling(pswd->isInstalled, pswd->isAction))
+        {
+            // If we're uninstalling, ignore any failure to find the existing web
+            hr = S_OK;
+        }
+
+        ExitOnFailure(hr, "Failed to get base of web for WebDir");
+
+        hr = WcaGetRecordString(hRec, wdqPath, &pwzData);
+        ExitOnFailure(hr, "Failed to get Path for WebDir");
+
+        hr = ::StringCchPrintfW(pswd->wzWebDirRoot, countof(pswd->wzWebDirRoot), L"%s/Root/%s", pswd->wzWebBase, pwzData);
+        ExitOnFailure(hr, "Failed to format webdir root string");
+
+        // get the directory properties for this web
+        hr = WcaGetRecordString(hRec, wdqProperties, &pwzData);
+        ExitOnFailure(hr, "Failed to get security identifier for WebDir");
+        if (*pwzData)
+        {
+            hr = ScaGetWebDirProperties(pwzData, hUserQuery, hWebDirPropQuery, &pswd->swp);
+            ExitOnFailure(hr, "Failed to get properties for WebDir");
+
+            pswd->fHasProperties = TRUE;
+        }
+
+        // get the application information for this web directory
+        hr = WcaGetRecordString(hRec, wdqApplication, &pwzData);
+        ExitOnFailure(hr, "Failed to get application identifier for WebDir");
+        if (*pwzData)
+        {
+            hr = ScaGetWebApplication(NULL, pwzData, hWebAppQuery, hWebAppExtQuery, &pswd->swapp);
+            ExitOnFailure(hr, "Failed to get application for WebDir");
+
+            pswd->fHasApplication = TRUE;
+        }
+
+        AddWebDirToList(ppswdList, pswd);
+    }
+
+    if (E_NOMOREITEMS == hr)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "Failure while processing WebDirs");
+
+LExit:
+    WcaFinishUnwrapQuery(hWrapQuery);
+
+    ReleaseStr(pwzData);
+
+    return hr;
+}
+
+
+HRESULT ScaWebDirsInstall(IMSAdminBase* piMetabase, SCA_WEBDIR* pswdList, SCA_APPPOOL * psapList)
+{
+    HRESULT hr = S_OK;
+    SCA_WEBDIR* pswd = pswdList;
+    int i;
+
+    while (pswd)
+    {
+        // On reinstall, we have to uninstall the old application, otherwise a duplicate will be created
+        if (WcaIsReInstalling(pswd->isInstalled, pswd->isAction))
+        {
+            if (pswd->fHasApplication)
+            {
+                hr = ScaDeleteApp(piMetabase, pswd->wzWebDirRoot);
+                ExitOnFailure(hr, "Failed to remove application for WebDir as part of a reinstall");
+            }
+        }
+
+        // if we are installing the web site
+        if (WcaIsInstalling(pswd->isInstalled, pswd->isAction))
+        {
+            hr = ScaCreateMetabaseKey(piMetabase, pswd->wzWebDirRoot, L"");
+            ExitOnFailure(hr, "Failed to create key for WebDir");
+            hr = ScaWriteMetabaseValue(piMetabase, pswd->wzWebDirRoot, L"", MD_KEY_TYPE, METADATA_NO_ATTRIBUTES, IIS_MD_UT_SERVER, STRING_METADATA, (LPVOID)L"IIsWebDirectory");
+            ExitOnFailure(hr, "Failed to write key type for for WebDir");
+            i = 0x4000003e; // 1073741886: default directory browsing rights
+            hr = ScaWriteMetabaseValue(piMetabase, pswd->wzWebDirRoot, L"", MD_DIRECTORY_BROWSING, METADATA_INHERIT, IIS_MD_UT_FILE, DWORD_METADATA, (LPVOID)((DWORD_PTR)i));
+            ExitOnFailure(hr, "Failed to set directory browsing for WebDir");
+
+            // get the security information for this web
+            if (pswd->fHasProperties)
+            {
+                ScaWriteWebDirProperties(piMetabase, pswd->wzWebDirRoot, &pswd->swp);
+                ExitOnFailure(hr, "Failed to write properties for WebDir");
+            }
+
+            // get the application information for this web directory
+            if (pswd->fHasApplication)
+            {
+                hr = ScaWriteWebApplication(piMetabase, pswd->wzWebDirRoot, &pswd->swapp, psapList);
+                ExitOnFailure(hr, "Failed to write application for WebDir");
+            }
+        }
+
+        pswd = pswd->pswdNext;
+    }
+
+LExit:
+    return hr;
+}
+
+
+HRESULT ScaWebDirsUninstall(IMSAdminBase* piMetabase, SCA_WEBDIR* pswdList)
+{
+    Assert(piMetabase);
+
+    HRESULT hr = S_OK;
+    SCA_WEBDIR* pswd = pswdList;
+
+    while (pswd)
+    {
+        if (WcaIsUninstalling(pswd->isInstalled, pswd->isAction))
+        {
+            // remove the application from this web directory
+            if (pswd->fHasApplication)
+            {
+                hr = ScaDeleteApp(piMetabase, pswd->wzWebDirRoot);
+                ExitOnFailure(hr, "Failed to remove application for WebDir");
+            }
+
+            hr = ScaDeleteMetabaseKey(piMetabase, pswd->wzWebDirRoot, L"");
+            ExitOnFailure(hr, "Failed to remove WebDir '%ls' from metabase", pswd->wzKey);
+        }
+
+        pswd = pswd->pswdNext;
+    }
+
+LExit:
+    return hr;
+}
+
+
+static SCA_WEBDIR* NewWebDir()
+{
+    SCA_WEBDIR* pswd = static_cast<SCA_WEBDIR*>(MemAlloc(sizeof(SCA_WEBDIR), TRUE));
+    Assert(pswd);
+    return pswd;
+}
+
+static void FreeWebDir(SCA_WEBDIR *pswd)
+{
+    MemFree(pswd);
+}
+
+void ScaWebDirsFreeList(SCA_WEBDIR* pswdList)
+{
+    SCA_WEBDIR* pswdDelete = pswdList;
+    while (pswdList)
+    {
+        pswdDelete = pswdList;
+        pswdList = pswdList->pswdNext;
+
+        FreeWebDir(pswdDelete);
+    }
+}
+
+
+static void AddWebDirToList(SCA_WEBDIR** ppswdList, SCA_WEBDIR *pswd)
+{
+    pswd->pswdNext = *ppswdList;
+    *ppswdList = pswd;
+}
diff --git a/src/ca/scawebdir.h b/src/ca/scawebdir.h
new file mode 100644
index 00000000..0b594532
--- /dev/null
+++ b/src/ca/scawebdir.h
@@ -0,0 +1,57 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+struct SCA_WEBDIR
+{
+    // darwin information
+    WCHAR wzKey[MAX_DARWIN_KEY + 1];
+    WCHAR wzComponent[MAX_DARWIN_KEY + 1];
+    INSTALLSTATE isInstalled;
+    INSTALLSTATE isAction;
+
+    // metabase information
+    WCHAR wzWebKey[MAX_DARWIN_KEY + 1];
+    WCHAR wzWebBase[METADATA_MAX_NAME_LEN + 1];
+    WCHAR wzWebDirRoot[METADATA_MAX_NAME_LEN + 1];
+
+    // iis configuation information
+    WCHAR wzDirectory[MAX_PATH];
+
+    BOOL fHasProperties;
+    SCA_WEB_PROPERTIES swp;
+
+    BOOL fHasApplication;
+    SCA_WEB_APPLICATION swapp;
+
+    SCA_WEBDIR* pswdNext;
+};
+
+
+// prototypes
+UINT __stdcall ScaWebDirsRead(
+    __in IMSAdminBase* piMetabase, 
+    __in SCA_WEB* pswList,
+    __in WCA_WRAPQUERY_HANDLE hUserQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebBaseQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebDirPropQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebAppQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebAppExtQuery,
+    __inout LPWSTR *ppwzCustomActionData,
+    __out SCA_WEBDIR** ppswdList
+    );
+
+HRESULT ScaWebDirsInstall(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_WEBDIR* pswdList,
+    __in SCA_APPPOOL* psapList
+    );
+
+HRESULT ScaWebDirsUninstall(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_WEBDIR* pswdList
+    );
+
+void ScaWebDirsFreeList(
+    __in SCA_WEBDIR* pswdList
+    );
diff --git a/src/ca/scawebdir7.cpp b/src/ca/scawebdir7.cpp
new file mode 100644
index 00000000..5ead0470
--- /dev/null
+++ b/src/ca/scawebdir7.cpp
@@ -0,0 +1,219 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+// sql queries
+static LPCWSTR vcsWebDirQuery7 = L"SELECT `Web_`, `WebDir`, `Component_`, `Path`, `DirProperties_`, `Application_`"
+                                       L"FROM `IIsWebDir`";
+
+enum eWebDirQuery { wdqWeb = 1, wdqWebDir, wdqComponent , wdqPath, wdqProperties, wdqApplication, wdqInstalled, wdqAction };
+
+// prototypes
+static HRESULT AddWebDirToList(SCA_WEBDIR7** ppswdList);
+
+
+UINT __stdcall ScaWebDirsRead7(
+    __in SCA_WEB7* pswList,
+    __in WCA_WRAPQUERY_HANDLE hUserQuery,
+    __in WCA_WRAPQUERY_HANDLE /*hWebBaseQuery*/,
+    __in WCA_WRAPQUERY_HANDLE hWebDirPropQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebAppQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebAppExtQuery,
+    __inout LPWSTR *ppwzCustomActionData,
+    __out SCA_WEBDIR7** ppswdList
+    )
+{
+    HRESULT hr = S_OK;
+    MSIHANDLE hRec;
+
+    LPWSTR pwzData = NULL;
+    SCA_WEBDIR7* pswd;
+    WCA_WRAPQUERY_HANDLE hWrapQuery = NULL;
+
+    hr = WcaBeginUnwrapQuery(&hWrapQuery, ppwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap query for ScaWebDirsRead7");
+
+    if (0 == WcaGetQueryRecords(hWrapQuery))
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping ScaInstallWebDirs7() because IIsWebDir table not present");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    // loop through all the web directories
+    while (S_OK == (hr = WcaFetchWrappedRecord(hWrapQuery, &hRec)))
+    {
+        hr = AddWebDirToList(ppswdList);
+        ExitOnFailure(hr, "failed to add web dir to list");
+
+        pswd = *ppswdList;
+        ExitOnNull(pswd, hr, E_INVALIDARG, "No web dir provided");
+
+        // get component install state
+        hr = WcaGetRecordString(hRec, wdqComponent, &pwzData);
+        ExitOnFailure(hr, "Failed to get Component for WebDirs");
+        hr = ::StringCchCopyW(pswd->wzComponent, countof(pswd->wzComponent), pwzData);
+        ExitOnFailure(hr, "Failed to copy component string to webdir object");
+
+        hr = WcaGetRecordInteger(hRec, wdqInstalled, (int *)&pswd->isInstalled);
+        ExitOnFailure(hr, "Failed to get Component installed state for webdir");
+
+        hr = WcaGetRecordInteger(hRec, wdqAction, (int *)&pswd->isAction);
+        ExitOnFailure(hr, "Failed to get Component action state for webdir");
+
+        hr = WcaGetRecordString(hRec, wdqWeb, &pwzData);
+        ExitOnFailure(hr, "Failed to get Web for WebDir");
+
+        // get the web key
+        hr = ScaWebsGetBase7(pswList, pwzData, pswd->wzWebSite, countof(pswd->wzWebSite));
+        if (S_FALSE == hr)
+        {
+            hr = HRESULT_FROM_WIN32(ERROR_NOT_FOUND);
+            ExitOnFailure(hr, "Failed to get base of web for WebDir");
+        }
+        ExitOnFailure(hr, "Failed to format webdir root string");
+
+        hr = WcaGetRecordString(hRec, wdqPath, &pwzData);
+        ExitOnFailure(hr, "Failed to get Path for WebDir");
+
+        hr = ::StringCchCopyW(pswd->wzPath, countof(pswd->wzPath), pwzData);
+        ExitOnFailure(hr, "Failed to copy path for WebDir");
+
+        // get the directory properties for this web
+        hr = WcaGetRecordString(hRec, wdqProperties, &pwzData);
+        ExitOnFailure(hr, "Failed to get security identifier for WebDir");
+        if (*pwzData)
+        {
+            hr = ScaGetWebDirProperties(pwzData, hUserQuery, hWebDirPropQuery, &pswd->swp);
+            ExitOnFailure(hr, "Failed to get properties for WebDir");
+
+            pswd->fHasProperties = TRUE;
+        }
+
+        // get the application information for this web directory
+        hr = WcaGetRecordString(hRec, wdqApplication, &pwzData);
+        ExitOnFailure(hr, "Failed to get application identifier for WebDir");
+        if (*pwzData)
+        {
+            hr = ScaGetWebApplication(NULL, pwzData, hWebAppQuery, hWebAppExtQuery, &pswd->swapp);
+            ExitOnFailure(hr, "Failed to get application for WebDir");
+
+            pswd->fHasApplication = TRUE;
+        }
+    }
+
+    if (E_NOMOREITEMS == hr)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "Failure while processing WebDirs");
+
+LExit:
+    WcaFinishUnwrapQuery(hWrapQuery);
+
+    ReleaseStr(pwzData);
+
+    return hr;
+}
+
+
+HRESULT ScaWebDirsInstall7(SCA_WEBDIR7* pswdList, SCA_APPPOOL * psapList)
+{
+    HRESULT hr = S_OK;
+    SCA_WEBDIR7* pswd = pswdList;
+
+    while (pswd)
+    {
+        // if we are installing the web site
+        if (WcaIsInstalling(pswd->isInstalled, pswd->isAction))
+        {
+            hr = ScaWriteConfigID(IIS_WEBDIR);
+            ExitOnFailure(hr, "Failed to write WebDir ID");
+
+            hr = ScaWriteConfigID(IIS_CREATE);
+            ExitOnFailure(hr, "Failed to write WebDir action ID");
+
+            hr = ScaWriteConfigString(pswd->wzWebSite);
+            ExitOnFailure(hr, "Failed to write WebDir site");
+
+            hr = ScaWriteConfigString(pswd->wzPath);
+            ExitOnFailure(hr, "Failed to write WebDir path");
+
+            // get the security information for this web
+            if (pswd->fHasProperties)
+            {
+                ScaWriteWebDirProperties7(pswd->wzWebSite, pswd->wzPath, &pswd->swp);
+                ExitOnFailure(hr, "Failed to write properties for WebDir");
+            }
+
+            // get the application information for this web directory
+            if (pswd->fHasApplication)
+            {
+                hr = ScaWriteWebApplication7(pswd->wzWebSite, pswd->wzPath, &pswd->swapp, psapList);
+                ExitOnFailure(hr, "Failed to write application for WebDir");
+            }
+        }
+
+        pswd = pswd->pswdNext;
+    }
+
+LExit:
+    return hr;
+}
+
+
+HRESULT ScaWebDirsUninstall7(SCA_WEBDIR7* pswdList)
+{
+    HRESULT hr = S_OK;
+    SCA_WEBDIR7* pswd = pswdList;
+
+    while (pswd)
+    {
+        if (WcaIsUninstalling(pswd->isInstalled, pswd->isAction))
+        {
+            hr = ScaWriteConfigID(IIS_WEBDIR);
+            ExitOnFailure(hr, "Failed to write WebDir ID");
+
+            hr = ScaWriteConfigID(IIS_DELETE);
+            ExitOnFailure(hr, "Failed to write WebDir action ID");
+
+            hr = ScaWriteConfigString(pswd->wzWebSite);
+            ExitOnFailure(hr, "Failed to write WebDir site");
+
+            hr = ScaWriteConfigString(pswd->wzPath);
+            ExitOnFailure(hr, "Failed to write WebDir path");
+        }
+
+        pswd = pswd->pswdNext;
+    }
+
+LExit:
+    return hr;
+}
+
+
+void ScaWebDirsFreeList7(SCA_WEBDIR7* pswdList)
+{
+    SCA_WEBDIR7* pswdDelete = pswdList;
+    while (pswdList)
+    {
+        pswdDelete = pswdList;
+        pswdList = pswdList->pswdNext;
+
+        MemFree(pswdDelete);
+    }
+}
+
+
+static HRESULT AddWebDirToList(SCA_WEBDIR7** ppswdList)
+{
+    HRESULT hr = S_OK;
+
+    SCA_WEBDIR7* pswd = static_cast<SCA_WEBDIR7*>(MemAlloc(sizeof(SCA_WEBDIR7), TRUE));
+    ExitOnNull(pswd, hr, E_OUTOFMEMORY, "failed to allocate element for web dir list");
+
+    pswd->pswdNext = *ppswdList;
+    *ppswdList = pswd;
+
+LExit:
+    return hr;
+}
diff --git a/src/ca/scawebdir7.h b/src/ca/scawebdir7.h
new file mode 100644
index 00000000..c5c87e17
--- /dev/null
+++ b/src/ca/scawebdir7.h
@@ -0,0 +1,51 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+struct SCA_WEBDIR7
+{
+    // darwin information
+    WCHAR wzKey[MAX_DARWIN_KEY + 1];
+    WCHAR wzComponent[MAX_DARWIN_KEY + 1];
+    INSTALLSTATE isInstalled;
+    INSTALLSTATE isAction;
+
+
+    // iis configuation information
+    WCHAR wzPath[MAX_PATH];
+    WCHAR wzWebSite[MAX_PATH];
+
+    BOOL fHasProperties;
+    SCA_WEB_PROPERTIES swp;
+
+    BOOL fHasApplication;
+    SCA_WEB_APPLICATION swapp;
+
+    SCA_WEBDIR7* pswdNext;
+};
+
+
+// prototypes
+UINT __stdcall ScaWebDirsRead7(
+    __in SCA_WEB7* pswList,
+    __in WCA_WRAPQUERY_HANDLE hUserQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebBaseQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebDirPropQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebAppQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebAppExtQuery,
+    __inout LPWSTR *ppwzCustomActionData,
+    __out SCA_WEBDIR7** ppswdList
+    );
+
+HRESULT ScaWebDirsInstall7(
+    __in SCA_WEBDIR7* pswdList,
+    __in SCA_APPPOOL* psapList
+    );
+
+HRESULT ScaWebDirsUninstall7(
+    __in SCA_WEBDIR7* pswdList
+    );
+
+void ScaWebDirsFreeList7(
+    __in SCA_WEBDIR7* pswdList
+    );
diff --git a/src/ca/scaweberr.cpp b/src/ca/scaweberr.cpp
new file mode 100644
index 00000000..2441f006
--- /dev/null
+++ b/src/ca/scaweberr.cpp
@@ -0,0 +1,371 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+enum eWebErrorQuery { weqErrorCode = 1, weqSubCode, weqParentType, weqParentValue, weqFile, weqURL };
+
+static HRESULT AddWebErrorToList(SCA_WEB_ERROR** ppsweList);
+
+void ScaWebErrorFreeList(SCA_WEB_ERROR *psweList)
+{
+    SCA_WEB_ERROR *psweDelete = psweList;
+    while (psweList)
+    {
+        psweDelete = psweList;
+        psweList = psweList->psweNext;
+
+        MemFree(psweDelete);
+    }
+}
+
+HRESULT ScaWebErrorRead(
+                        SCA_WEB_ERROR **ppsweList,
+                        __inout LPWSTR *ppwzCustomActionData
+                        )
+{
+//    AssertSz(0, "Debug ScaWebErrorRead here");
+    HRESULT hr = S_OK;
+    MSIHANDLE hRec;
+    LPWSTR pwzData = NULL;
+    SCA_WEB_ERROR* pswe;
+    WCA_WRAPQUERY_HANDLE hWrapQuery = NULL;
+
+    ExitOnNull(ppsweList, hr, E_INVALIDARG, "Failed to read web error, because no web error was provided to read");
+
+    hr = WcaBeginUnwrapQuery(&hWrapQuery, ppwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap query for ScaAppPoolRead");
+
+    if (0 == WcaGetQueryRecords(hWrapQuery))
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping ScaWebErrorRead() - required tables not present.");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    // loop through all the web errors
+    while (S_OK == (hr = WcaFetchWrappedRecord(hWrapQuery, &hRec)))
+    {
+        hr = AddWebErrorToList(ppsweList);
+        ExitOnFailure(hr, "failed to add web error to list");
+
+        pswe = *ppsweList;
+
+        hr = WcaGetRecordInteger(hRec, weqErrorCode, &(pswe->iErrorCode));
+        ExitOnFailure(hr, "failed to get IIsWebError.ErrorCode");
+
+        hr = WcaGetRecordInteger(hRec, weqSubCode, &(pswe->iSubCode));
+        ExitOnFailure(hr, "failed to get IIsWebError.SubCode");
+
+        hr = WcaGetRecordInteger(hRec, weqParentType, &(pswe->iParentType));
+        ExitOnFailure(hr, "failed to get IIsWebError.ParentType");
+
+        hr = WcaGetRecordString(hRec, weqParentValue, &pwzData);
+        ExitOnFailure(hr, "Failed to get IIsWebError.ParentValue");
+        hr = ::StringCchCopyW(pswe->wzParentValue, countof(pswe->wzParentValue), pwzData);
+        ExitOnFailure(hr, "Failed to copy IIsWebError.ParentValue");
+
+        hr = WcaGetRecordString(hRec, weqFile, &pwzData);
+        ExitOnFailure(hr, "Failed to get IIsWebError.File");
+        hr = ::StringCchCopyW(pswe->wzFile, countof(pswe->wzFile), pwzData);
+        ExitOnFailure(hr, "Failed to copy IIsWebError.File");
+
+        hr = WcaGetRecordString(hRec, weqURL, &pwzData);
+        ExitOnFailure(hr, "Failed to get IIsWebError.URL");
+        hr = ::StringCchCopyW(pswe->wzURL, countof(pswe->wzURL), pwzData);
+        ExitOnFailure(hr, "Failed to copy IIsWebError.URL");
+
+        // If they've specified both a file and a URL, that's invalid
+        if (*(pswe->wzFile) && *(pswe->wzURL))
+            ExitOnFailure(hr = HRESULT_FROM_WIN32(ERROR_INVALID_DATA), "Both File and URL specified for web error.  File: %ls, URL: %ls", pswe->wzFile, pswe->wzURL);
+    }
+
+    if (E_NOMOREITEMS == hr)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "Failure while processing web errors");
+
+LExit:
+    WcaFinishUnwrapQuery(hWrapQuery);
+
+    ReleaseStr(pwzData);
+
+    return hr;
+}
+
+HRESULT ScaGetWebError(int iParentType, LPCWSTR wzParentValue, SCA_WEB_ERROR **ppsweList, SCA_WEB_ERROR **ppsweOut)
+{
+    HRESULT hr = S_OK;
+    SCA_WEB_ERROR* psweAdd = NULL;
+    SCA_WEB_ERROR* psweLast = NULL;
+
+    *ppsweOut = NULL;
+    
+    if (!*ppsweList)
+        return hr;
+
+    SCA_WEB_ERROR* pswe = *ppsweList;
+    while (pswe)
+    {
+        if (iParentType == pswe->iParentType && 0 == lstrcmpW(wzParentValue, pswe->wzParentValue))
+        {
+            // Found a match, take this one out of the list and add it to the matched out list
+            psweAdd = pswe;
+
+            if (psweLast)
+            {
+                // If we're not at the beginning of the list tell the last node about it's new next (since we're taking away it's current next)
+                psweLast->psweNext = psweAdd->psweNext;
+            }
+            else
+            {
+                // If we are at the beginning (no psweLast) update the beginning (since we're taking it)
+                *ppsweList = pswe->psweNext;
+            }
+            pswe = pswe->psweNext; // move on
+
+            // Add the one we've removed to the beginning of the out list
+            psweAdd->psweNext = *ppsweOut;
+            *ppsweOut = psweAdd;
+        }
+        else
+        {
+            psweLast = pswe; // remember the last we that didn't match
+            pswe = pswe->psweNext; // move on
+        }
+    }
+
+    return hr;
+}
+
+HRESULT ScaWriteWebError(IMSAdminBase* piMetabase, int iParentType, LPCWSTR wzRoot, SCA_WEB_ERROR* psweList)
+{
+//    AssertSz(0, "Debug ScaWriteWebError here");
+    Assert(*wzRoot && psweList);
+
+    HRESULT hr = S_OK;
+
+    DWORD cchData = 0;
+    LPWSTR pwzSearchKey = NULL;
+    LPWSTR pwz = NULL;
+    LPWSTR pwzErrors = NULL;
+
+    LPWSTR pwzCodeSubCode = NULL;
+    LPWSTR pwzAcceptableCodeSubCode = NULL;
+    LPCWSTR wzFoundCodeSubCode = NULL;
+    DWORD_PTR dwFoundCodeSubCodeIndex = 0xFFFFFFFF;
+    BOOL fOldValueFound = FALSE;
+    LPWSTR pwzAcceptableErrors = NULL;
+
+    LPWSTR pwzNewError = NULL;
+
+    METADATA_RECORD mr;
+    ::ZeroMemory(&mr, sizeof(mr));
+
+    ExitOnNull(piMetabase, hr, E_INVALIDARG, "Failed to write web error, because no metabase was provided");
+    ExitOnNull(wzRoot, hr, E_INVALIDARG, "Failed to write web error, because no root was provided");
+
+    // get the set of all valid custom errors from the metabase
+    mr.dwMDIdentifier = MD_CUSTOM_ERROR_DESC;
+    mr.dwMDAttributes = METADATA_INHERIT;
+    mr.dwMDUserType = IIS_MD_UT_SERVER;
+    mr.dwMDDataType = ALL_METADATA;
+    mr.dwMDDataLen = cchData = 0;
+    mr.pbMDData = NULL;
+
+    hr = MetaGetValue(piMetabase, METADATA_MASTER_ROOT_HANDLE, L"/LM/W3SVC/Info", &mr);
+    ExitOnFailure(hr, "Unable to get set of acceptable error codes for this server.");
+
+    pwzAcceptableErrors = reinterpret_cast<LPWSTR>(mr.pbMDData);
+
+    // Check if web errors already exist here
+    mr.dwMDIdentifier = MD_CUSTOM_ERROR;
+    mr.dwMDAttributes = METADATA_INHERIT;
+    mr.dwMDUserType = IIS_MD_UT_SERVER;
+    mr.dwMDDataType = ALL_METADATA;
+    mr.dwMDDataLen = cchData = 0;
+    mr.pbMDData = NULL;
+
+    hr = MetaGetValue(piMetabase, METADATA_MASTER_ROOT_HANDLE, wzRoot, &mr);
+    if (HRESULT_FROM_WIN32(ERROR_PATH_NOT_FOUND) == hr || MD_ERROR_DATA_NOT_FOUND == hr)
+    {
+        //
+        // If we don't have one already, find an appropriate one to start with
+        //
+
+        // we can walk up key by key and look for custom errors to inherit
+
+        hr = StrAllocConcat(&pwzSearchKey, wzRoot, 0);
+        ExitOnFailure(hr, "Failed to copy root string: %ls", wzRoot);
+
+        pwz = pwzSearchKey + lstrlenW(pwzSearchKey);
+
+        while (NULL == pwzErrors)
+        {
+            // find the last slash
+            while (*pwz != '/' && pwz != pwzSearchKey)
+                pwz --;
+
+            if (pwz == pwzSearchKey)
+                break;
+
+            *pwz = L'\0';
+
+            // Try here.  If it's not found, keep walking up the path
+            hr = MetaGetValue(piMetabase, METADATA_MASTER_ROOT_HANDLE, pwzSearchKey, &mr);
+            if (HRESULT_FROM_WIN32(ERROR_PATH_NOT_FOUND) == hr || MD_ERROR_DATA_NOT_FOUND == hr)
+                hr = S_FALSE;
+            ExitOnFailure(hr, "failed to discover default error values to start with for web root: %ls while walking up the tree", wzRoot);
+
+            if (S_OK == hr)
+            {
+                pwzErrors = reinterpret_cast<LPWSTR>(mr.pbMDData);
+                break;
+            }
+
+            // Don't keep going if we're at the root
+            if (0 == lstrcmpW(pwz + 1, L"W3SVC"))
+                break;
+        }
+    }
+    else
+    {
+        pwzErrors = reinterpret_cast<LPWSTR>(mr.pbMDData);
+    }
+    ExitOnFailure(hr, "failed to discover default error values to start with for web root: %ls", wzRoot);
+
+    // The above code should have come up with some value to start pwzErrors off with.  Make sure it did.
+    if (NULL == pwzErrors)
+    {
+        ExitOnFailure(hr = E_UNEXPECTED, "failed to discover default error values to start with for web root: %ls", wzRoot);
+    }
+
+    // Loop through the web errors
+    for (SCA_WEB_ERROR* pswe = psweList; pswe; pswe = pswe->psweNext)
+    {
+        // Assume that we will have to replace 
+        fOldValueFound = TRUE;
+
+        // If the subcode is 0, that means "*" in MD_CUSTOM_ERROR (thus the special formatting logic)
+        if (0 == pswe->iSubCode)
+        {
+            hr = StrAllocFormatted(&pwzCodeSubCode, L"%d,*", pswe->iErrorCode);
+            ExitOnFailure(hr, "failed to create error code string while installing web error");
+        }
+        else
+        {
+            hr = StrAllocFormatted(&pwzCodeSubCode, L"%d,%d", pswe->iErrorCode, pswe->iSubCode);
+            ExitOnFailure(hr, "failed to create error code,subcode string while installing web error");
+        }
+
+        hr = MultiSzFindSubstring(pwzErrors, pwzCodeSubCode, &dwFoundCodeSubCodeIndex, &wzFoundCodeSubCode);
+        ExitOnFailure(hr, "failed to find existing error code,subcode: %ls", pwzCodeSubCode);
+
+        // If we didn't find this error code/sub code pair in the list already, make sure it's acceptable to add
+        if (S_FALSE == hr)
+        {
+            //
+            // Make sure this error code/sub code pair is in the "acceptable" list
+            //
+
+            // If the subcode is 0, that means "0" in MD_CUSTOM_ERROR_DESC (no special formatting logic needed)
+            hr = StrAllocFormatted(&pwzAcceptableCodeSubCode, L"%d,%d", pswe->iErrorCode, pswe->iSubCode);
+            ExitOnFailure(hr, "failed to create error code,subcode string while installing web error");
+
+            // We don't care where it is, just whether it's there or not
+            hr = MultiSzFindSubstring(pwzAcceptableErrors, pwzAcceptableCodeSubCode, NULL, NULL);
+            ExitOnFailure(hr, "failed to find whether or not error code, subcode: %ls is supported", pwzCodeSubCode);
+
+            if (S_FALSE == hr)
+            {
+                WcaLog(LOGMSG_VERBOSE, "Skipping error code, subcode: %ls because it is not supported by the server.", pwzCodeSubCode);
+                continue;
+            }
+
+            // If we didn't find it (and its an acceptable error) then we have nothing to replace
+            fOldValueFound = FALSE;
+        }
+
+        // Set up the new error string if needed
+        if (*(pswe->wzFile))
+        {
+            hr = StrAllocFormatted(&pwzNewError, L"%s,FILE,%s", pwzCodeSubCode, pswe->wzFile);
+            ExitOnFailure(hr, "failed to create new error code string with code,subcode: %ls, file: %ls", pwzCodeSubCode, pswe->wzFile);
+        }
+        else if (*(pswe->wzURL))
+        {
+            hr = StrAllocFormatted(&pwzNewError, L"%s,URL,%s", pwzCodeSubCode, pswe->wzURL);
+            ExitOnFailure(hr, "failed to create new error code string with code,subcode: %ls, file: %ls", pwzCodeSubCode, pswe->wzFile);
+        }
+        else if (fOldValueFound)
+        {
+            // If no File or URL was specified, they want a default error so remove the old value from the MULTISZ and move on
+            hr = MultiSzRemoveString(&pwzErrors, dwFoundCodeSubCodeIndex);
+            ExitOnFailure(hr, "failed to remove string for error code sub code: %ls in order to make it 'default'", pwzCodeSubCode);
+            continue;
+        }
+
+        // If we have something to replace, replace it, otherwise, put it at the beginning (order shouldn't matter)
+        if (fOldValueFound)
+        {
+            hr = MultiSzReplaceString(&pwzErrors, dwFoundCodeSubCodeIndex, pwzNewError);
+            ExitOnFailure(hr, "failed to replace old error string with new error string for error code,subcode: %ls", pwzCodeSubCode);
+        }
+        else
+        {
+            hr = MultiSzPrepend(&pwzErrors, NULL, pwzNewError);
+            ExitOnFailure(hr, "failed to prepend new error string for error code,subcode: %ls", pwzCodeSubCode);
+        }
+    }
+
+    // now write the CustomErrors to the metabase
+    if (weptWeb == iParentType)
+    {
+        hr = ScaWriteMetabaseValue(piMetabase, wzRoot, L"/Root", MD_CUSTOM_ERROR, METADATA_INHERIT, IIS_MD_UT_FILE, MULTISZ_METADATA, pwzErrors);
+        ExitOnFailure(hr, "Failed to write Web Error to /Root");
+    }
+    else
+    {
+        hr = ScaWriteMetabaseValue(piMetabase, wzRoot, NULL, MD_CUSTOM_ERROR, METADATA_INHERIT, IIS_MD_UT_FILE, MULTISZ_METADATA, pwzErrors);
+        ExitOnFailure(hr, "Failed to write Web Error");
+    }
+
+LExit:
+    ReleaseStr(pwzErrors);
+    ReleaseStr(pwzSearchKey);
+    ReleaseStr(pwzCodeSubCode);
+    ReleaseStr(pwzAcceptableCodeSubCode);
+    ReleaseStr(pwzAcceptableErrors);
+
+    return hr;
+}
+
+static HRESULT AddWebErrorToList(SCA_WEB_ERROR** ppsweList)
+{
+    HRESULT hr = S_OK;
+
+    SCA_WEB_ERROR* pswe = static_cast<SCA_WEB_ERROR*>(MemAlloc(sizeof(SCA_WEB_ERROR), TRUE));
+    ExitOnNull(pswe, hr, E_OUTOFMEMORY, "failed to allocate memory for new web error list element");
+
+    pswe->psweNext = *ppsweList;
+    *ppsweList = pswe;
+
+LExit:
+    return hr;
+}
+
+HRESULT ScaWebErrorCheckList(SCA_WEB_ERROR* psweList)
+{
+    if (!psweList)
+    {
+        return S_OK;
+    }
+    
+    while (psweList)
+    {
+        WcaLog(LOGMSG_STANDARD, "WebError code: %d subcode: %d for parent: %ls not used!", psweList->iErrorCode, psweList->iSubCode, psweList->wzParentValue);
+        psweList = psweList->psweNext;
+    }
+
+    return E_FAIL;
+}
+
diff --git a/src/ca/scaweberr.h b/src/ca/scaweberr.h
new file mode 100644
index 00000000..ad8ff4f5
--- /dev/null
+++ b/src/ca/scaweberr.h
@@ -0,0 +1,30 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+enum eWebErrorParentType { weptVDir = 1, weptWeb };
+
+struct SCA_WEB_ERROR
+{
+        int iErrorCode;
+        int iSubCode;
+
+        int iParentType;
+        WCHAR wzParentValue[MAX_DARWIN_KEY + 1];
+
+        WCHAR wzFile[MAX_PATH];
+        WCHAR wzURL[MAX_PATH]; // TODO: this needs to be bigger than MAX_PATH
+        
+        SCA_WEB_ERROR *psweNext;
+};
+
+// prototypes
+HRESULT ScaWebErrorRead(
+                        SCA_WEB_ERROR **ppsweList,
+                        __inout LPWSTR *ppwzCustomActionData
+                        );
+void ScaWebErrorFreeList(SCA_WEB_ERROR *psweList);
+HRESULT ScaWebErrorCheckList(SCA_WEB_ERROR* psweList);
+HRESULT ScaGetWebError(int iParentType, LPCWSTR wzParentValue, SCA_WEB_ERROR **ppsweList, SCA_WEB_ERROR **ppsweOut);
+HRESULT ScaWriteWebError(IMSAdminBase* piMetabase, int iParentType, LPCWSTR wzRoot, SCA_WEB_ERROR* psweList);
+
diff --git a/src/ca/scaweberr7.cpp b/src/ca/scaweberr7.cpp
new file mode 100644
index 00000000..33c2f1bd
--- /dev/null
+++ b/src/ca/scaweberr7.cpp
@@ -0,0 +1,88 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+HRESULT ScaWriteWebError7(
+    __in_z LPCWSTR wzWebName,
+    __in_z LPCWSTR wzRoot,
+    SCA_WEB_ERROR* psweList
+    )
+{
+    HRESULT hr = S_OK;
+
+    hr = ScaWriteConfigID(IIS_WEBERROR_BEGIN);
+    ExitOnFailure(hr, "Fail to write webError begin ID");
+
+    hr = ScaWriteConfigString(wzWebName);
+    ExitOnFailure(hr, "Fail to write webError Web Key");
+
+    hr = ScaWriteConfigString(wzRoot);
+    ExitOnFailure(hr, "Fail to write webError Vdir key");
+
+    // Loop through the HTTP headers
+    for (SCA_WEB_ERROR* pswe = psweList; pswe; pswe = pswe->psweNext)
+    {
+        hr = ScaWriteConfigID(IIS_WEBERROR);
+        ExitOnFailure(hr, "Fail to write webError ID");
+
+        hr = ScaWriteConfigInteger(pswe->iErrorCode);
+        ExitOnFailure(hr, "Fail to write webError code");
+
+        hr = ScaWriteConfigInteger(pswe->iSubCode);
+        ExitOnFailure(hr, "Fail to write webError subcode");
+
+        //just write one
+        if (*(pswe->wzFile))
+        {
+            hr = ScaWriteConfigString(pswe->wzFile);
+            ExitOnFailure(hr, "Fail to write webError file");
+            hr = ScaWriteConfigInteger(0);
+            ExitOnFailure(hr, "Fail to write webError file code");
+        }
+        else if (*(pswe->wzURL))
+        {
+            hr = ScaWriteConfigString(pswe->wzURL);
+            ExitOnFailure(hr, "Fail to write webError URL");
+            hr = ScaWriteConfigInteger(1);
+            ExitOnFailure(hr, "Fail to write webError URL code");
+        }
+    }
+
+    hr = ScaWriteConfigID(IIS_WEBERROR_END);
+    ExitOnFailure(hr, "Fail to write httpHeader end ID");
+
+LExit:
+    return hr;
+
+}
+
+//static HRESULT AddWebErrorToList(SCA_WEB_ERROR** ppsweList)
+//{
+//    HRESULT hr = S_OK;
+//
+//    SCA_WEB_ERROR* pswe = static_cast<SCA_WEB_ERROR*>(MemAlloc(sizeof(SCA_WEB_ERROR), TRUE));
+//    ExitOnNull(pswe, hr, E_OUTOFMEMORY, "failed to allocate memory for new web error list element");
+//
+//    pswe->psweNext = *ppsweList;
+//    *ppsweList = pswe;
+//
+//LExit:
+//    return hr;
+//}
+
+HRESULT ScaWebErrorCheckList7(SCA_WEB_ERROR* psweList)
+{
+    if (!psweList)
+    {
+        return S_OK;
+    }
+
+    while (psweList)
+    {
+        WcaLog(LOGMSG_STANDARD, "WebError code: %d subcode: %d for parent: %ls not used!", psweList->iErrorCode, psweList->iSubCode, psweList->wzParentValue);
+        psweList = psweList->psweNext;
+    }
+
+    return E_FAIL;
+}
+
diff --git a/src/ca/scaweberr7.h b/src/ca/scaweberr7.h
new file mode 100644
index 00000000..62448211
--- /dev/null
+++ b/src/ca/scaweberr7.h
@@ -0,0 +1,10 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+HRESULT ScaWriteWebError7(
+    __in_z LPCWSTR wzWebName,
+    __in_z LPCWSTR wzRoot,
+    SCA_WEB_ERROR* psweList
+    );
+
diff --git a/src/ca/scaweblog.cpp b/src/ca/scaweblog.cpp
new file mode 100644
index 00000000..01147848
--- /dev/null
+++ b/src/ca/scaweblog.cpp
@@ -0,0 +1,177 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+enum eWebLogQuery { wlqLog = 1, wlqFormat };
+
+/* ****************************************************************
+ * LookupLogFormatGUID -Looks up a given IIS Log format type in 
+ * the metabase and returns the GUID for it.
+ * ****************************************************************/
+static HRESULT LookupLogFormatGUID(
+    __in IMSAdminBase* piMetabase,
+    __in LPCWSTR wzLogFormat,
+    __out_ecount(cchGUID) LPWSTR wzGUID,
+    __in int cchGUID
+    )
+{
+    WCHAR wzKey[METADATA_MAX_NAME_LEN];
+    HRESULT hr = S_OK;
+
+    METADATA_RECORD mrKeyType;
+    ::ZeroMemory(&mrKeyType, sizeof(mrKeyType));
+
+    mrKeyType.dwMDIdentifier = MD_KEY_TYPE;
+    mrKeyType.dwMDAttributes = METADATA_NO_ATTRIBUTES;
+    mrKeyType.dwMDUserType = IIS_MD_UT_SERVER;
+    mrKeyType.dwMDDataType = ALL_METADATA;
+    mrKeyType.dwMDDataLen = 0;
+    mrKeyType.pbMDData = NULL;
+
+    METADATA_RECORD mrPluginId;
+    ::ZeroMemory(&mrPluginId, sizeof(mrPluginId));
+
+    mrPluginId.dwMDIdentifier = MD_LOG_PLUGIN_MOD_ID;
+    mrPluginId.dwMDAttributes = METADATA_INHERIT;
+    mrPluginId.dwMDUserType = IIS_MD_UT_SERVER;
+    mrPluginId.dwMDDataType = ALL_METADATA;
+    mrPluginId.dwMDDataLen = 0;
+    mrPluginId.pbMDData = NULL;
+    
+    hr = ::StringCchPrintfW(wzKey, countof(wzKey), L"/LM/Logging/%s", wzLogFormat);
+    ExitOnFailure(hr, "failed to format logging metabase key name");
+
+    // verify that we have this log format available in IIS
+    hr = MetaGetValue(piMetabase, METADATA_MASTER_ROOT_HANDLE, wzKey, &mrKeyType);
+    ExitOnFailure(hr, "Failed to find specified Log format key in IIS for log format: %ls", wzLogFormat);
+    ExitOnNull(mrKeyType.pbMDData, hr, E_POINTER, "Request for Log format key in IIS for log format returned success, but value was NULL");
+
+    if (0 != lstrcmpW(L"IIsLogModule", (LPCWSTR)mrKeyType.pbMDData))
+    {
+        ExitOnFailure(hr = E_UNEXPECTED, "Found invalid log format in IIS: %ls", (LPCWSTR)mrKeyType.pbMDData);
+    }
+
+    // find the GUID for that log format
+    hr = MetaGetValue(piMetabase, METADATA_MASTER_ROOT_HANDLE, wzKey, &mrPluginId);
+    ExitOnFailure(hr, "Failed to retrieve IISLog format GUID. Key: %ls", wzKey);
+    ExitOnNull(mrPluginId.pbMDData, hr, E_POINTER, "Retrieval of IISLog format GUID returned success, but value was NULL");
+
+    hr = ::StringCchCopyW(wzGUID, cchGUID, (LPCWSTR)mrPluginId.pbMDData);
+    ExitOnFailure(hr, "failed to copy metabase value: %ls", (LPCWSTR)mrPluginId.pbMDData);
+
+LExit:
+
+    if (mrKeyType.pbMDData)
+    {
+        MetaFreeValue(&mrKeyType);
+    }
+
+    if (mrPluginId.pbMDData)
+    {
+        MetaFreeValue(&mrPluginId);
+    }
+
+    return hr;
+}
+
+
+/* ****************************************************************
+ * ScaGetWebLog -Retrieves Log table data for the specified Log key
+ *
+ * ****************************************************************/
+HRESULT ScaGetWebLog(
+    IMSAdminBase* piMetabase,
+    LPCWSTR wzLog,
+    __in WCA_WRAPQUERY_HANDLE hWebLogQuery,
+    SCA_WEB_LOG* pswl
+    )
+{
+    HRESULT hr = S_OK;
+    LPWSTR pwzData = NULL;
+    MSIHANDLE hRec;
+
+    if (0 == WcaGetQueryRecords(hWebLogQuery))
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping ScaGetWebLog() - no records to process");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    WcaFetchWrappedReset(hWebLogQuery);
+
+    hr = WcaFetchWrappedRecordWhereString(hWebLogQuery, wlqLog, wzLog, &hRec);
+    if (E_NOMOREITEMS == hr)
+    {
+        ExitOnFailure(hr, "cannot locate IIsWebLog.Log='%ls'", wzLog);
+    }
+    HRESULT hrTemp = WcaFetchWrappedRecordWhereString(hWebLogQuery, wlqLog, wzLog, &hRec);
+
+    if (SUCCEEDED(hrTemp))
+    {
+        ExitOnFailure(hr, "error - found multiple matching IIsWebLog rows");
+    }
+
+    ::ZeroMemory(pswl, sizeof(SCA_WEB_LOG));
+
+    // check that log key matches
+    hr = WcaGetRecordString(hRec, wlqLog, &pwzData);
+    ExitOnFailure(hr, "failed to get IIsWebLog.Log for Log: %ls", wzLog);
+    hr = ::StringCchCopyW(pswl->wzLog, countof(pswl->wzLog), pwzData);
+    ExitOnFailure(hr, "failed to copy log name: %ls", pwzData);
+
+    hr = WcaGetRecordString(hRec, wlqFormat, &pwzData);
+    ExitOnFailure(hr, "failed to get IIsWebLog.Format for Log:", wzLog);
+    hr = ::StringCchCopyW(pswl->wzFormat, countof(pswl->wzFormat), pwzData);
+    ExitOnFailure(hr, "failed to copy log format: %ls", pwzData);
+
+    // if they specified a log format, look up its GUID in the metabase
+    if (*pswl->wzFormat && 0 != lstrcmpW(pswl->wzFormat, L"none"))
+    {
+        hr = LookupLogFormatGUID(piMetabase, pswl->wzFormat, pswl->wzFormatGUID, countof(pswl->wzFormatGUID));
+        ExitOnFailure(hr, "Failed to get Log Format GUID for Log: %ls", wzLog);
+    }
+
+LExit:
+    ReleaseStr(pwzData);
+
+    return hr;
+}
+
+
+/* ****************************************************************
+ * ScaWriteWebLog -Writes the IIS log values to the metabase.
+ *
+ * ****************************************************************/
+HRESULT ScaWriteWebLog(
+    IMSAdminBase* piMetabase,
+    LPCWSTR wzWebBase,
+    SCA_WEB_LOG *pswl
+    )
+{
+    HRESULT hr = S_OK;
+
+    if (*pswl->wzFormat)
+    {
+        if (0 == lstrcmpW(pswl->wzFormat, L"none"))
+        {
+            // user wishes for Logging to be turned 'off'
+            hr = ScaWriteMetabaseValue(piMetabase, wzWebBase, L"", MD_LOG_TYPE, METADATA_INHERIT, IIS_MD_UT_SERVER, DWORD_METADATA, (LPVOID)((DWORD_PTR)0));
+            ExitOnFailure(hr, "Failed to write Log Type for Web: %ls", wzWebBase);
+        }
+        else
+        {
+            Assert(*pswl->wzFormatGUID);
+            
+            // write the GUID for the log format for the web to the metabase
+            hr = ScaWriteMetabaseValue(piMetabase, wzWebBase, L"", MD_LOG_PLUGIN_ORDER, METADATA_INHERIT, IIS_MD_UT_SERVER, STRING_METADATA, pswl->wzFormatGUID);
+            ExitOnFailure(hr, "Failed to write Log GUID for Web: %ls", wzWebBase);
+
+            hr = ScaWriteMetabaseValue(piMetabase, wzWebBase, L"", MD_LOG_TYPE, METADATA_INHERIT, IIS_MD_UT_SERVER, DWORD_METADATA, (LPVOID)((DWORD_PTR)1));
+            ExitOnFailure(hr, "Failed to write Log Type for Web: %ls", wzWebBase);
+        }
+    }
+
+LExit:
+    return hr;
+}
+
+
diff --git a/src/ca/scaweblog.h b/src/ca/scaweblog.h
new file mode 100644
index 00000000..1a690cce
--- /dev/null
+++ b/src/ca/scaweblog.h
@@ -0,0 +1,27 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+struct SCA_WEB_LOG
+{
+        // iis configuation information
+        WCHAR wzLog[MAX_DARWIN_KEY + 1];
+
+        // for specifying the log format
+        WCHAR wzFormat[MAX_DARWIN_KEY + 1];
+        WCHAR wzFormatGUID[MAX_DARWIN_KEY + 1];
+};
+
+
+// prototypes
+HRESULT ScaGetWebLog(
+        IMSAdminBase* piMetabase,
+        LPCWSTR wzLog,
+    __in WCA_WRAPQUERY_HANDLE hWebLogQuery,
+        SCA_WEB_LOG* pswl
+        );
+HRESULT ScaWriteWebLog(
+        IMSAdminBase* piMetabase,
+        LPCWSTR wzRootOfWeb,
+        SCA_WEB_LOG *pswl
+        );
diff --git a/src/ca/scaweblog7.cpp b/src/ca/scaweblog7.cpp
new file mode 100644
index 00000000..c857c46f
--- /dev/null
+++ b/src/ca/scaweblog7.cpp
@@ -0,0 +1,120 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+// sql queries
+LPCWSTR vcsWebLogQuery7 = L"SELECT `Log`, `Format` "
+                         L"FROM `IIsWebLog`  WHERE `Log`=?";
+
+enum eWebLogQuery { wlqLog = 1, wlqFormat };
+
+/* ****************************************************************
+ * ScaGetWebLog7 -Retrieves Log table data for the specified Log key
+ *
+ * ****************************************************************/
+HRESULT ScaGetWebLog7(
+    __in_z LPCWSTR wzLog,
+    __in WCA_WRAPQUERY_HANDLE hWebLogQuery,
+    __out SCA_WEB_LOG* pswl
+    )
+{
+    HRESULT hr = S_OK;
+    LPWSTR pwzData = NULL;
+    MSIHANDLE hRec;
+
+    if (0 == WcaGetQueryRecords(hWebLogQuery))
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping ScaGetWebLog() - no records to process");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    WcaFetchWrappedReset(hWebLogQuery);
+
+    hr = WcaFetchWrappedRecordWhereString(hWebLogQuery, wlqLog, wzLog, &hRec);
+    if (E_NOMOREITEMS == hr)
+    {
+        ExitOnFailure(hr, "cannot locate IIsWebLog.Log='%ls'", wzLog);
+    }
+    HRESULT hrTemp = WcaFetchWrappedRecordWhereString(hWebLogQuery, wlqLog, wzLog, &hRec);
+
+    if (SUCCEEDED(hrTemp))
+    {
+        ExitOnFailure(hr, "error - found multiple matching IIsWebLog rows");
+    }
+
+    ::ZeroMemory(pswl, sizeof(SCA_WEB_LOG));
+
+    // check that log key matches
+    hr = WcaGetRecordString(hRec, wlqLog, &pwzData);
+    ExitOnFailure(hr, "failed to get IIsWebLog.Log for Log: %ls", wzLog);
+    hr = ::StringCchCopyW(pswl->wzLog, countof(pswl->wzLog), pwzData);
+    ExitOnFailure(hr, "failed to copy log name: %ls", pwzData);
+
+    hr = WcaGetRecordString(hRec, wlqFormat, &pwzData);
+    ExitOnFailure(hr, "failed to get IIsWebLog.Format for Log:", wzLog);
+
+    //translate WIX log format name strings to IIS7
+    if (0 == lstrcmpW(pwzData, L"Microsoft IIS Log File Format"))
+    {
+        hr = ::StringCchCopyW(pswl->wzFormat, countof(pswl->wzFormat), L"IIS");
+        ExitOnFailure(hr, "failed to copy log format: %ls", pwzData);
+    }
+    else if (0 == lstrcmpW(pwzData, L"NCSA Common Log File Format"))
+    {
+        hr = ::StringCchCopyW(pswl->wzFormat, countof(pswl->wzFormat), L"NCSA");
+        ExitOnFailure(hr, "failed to copy log format: %ls", pwzData);
+    }
+    else if (0 == lstrcmpW(pwzData, L"none"))
+    {
+        hr = ::StringCchCopyW(pswl->wzFormat, countof(pswl->wzFormat), L"none");
+        ExitOnFailure(hr, "failed to copy log format: %ls", pwzData);
+    }
+    else if (0 == lstrcmpW(pwzData, L"ODBC Logging"))
+    {
+        hr = ::StringCchCopyW(pswl->wzFormat, countof(pswl->wzFormat), L"W3C");
+        ExitOnFailure(hr, "failed to copy log format: %ls", pwzData);
+    }
+    else if (0 == lstrcmpW(pwzData, L"W3C Extended Log File Format"))
+    {
+        hr = ::StringCchCopyW(pswl->wzFormat, countof(pswl->wzFormat), L"W3C");
+        ExitOnFailure(hr, "failed to copy log format: %ls", pwzData);
+    }
+    else
+    {
+        hr = HRESULT_FROM_WIN32(ERROR_INVALID_INDEX);
+        ExitOnFailure(hr, "Invalid log file format: %ls", pwzData);
+    }
+
+LExit:
+    ReleaseStr(pwzData);
+
+    return hr;
+}
+
+
+/* ****************************************************************
+ * ScaWriteWebLog -Writes the IIS log values to the metabase.
+ *
+ * ****************************************************************/
+HRESULT ScaWriteWebLog7(
+    LPCWSTR wzWebBase,
+    const SCA_WEB_LOG *pswl
+    )
+{
+    HRESULT hr = S_OK;
+
+    if (*pswl->wzFormat)
+    {
+        //write pswl->wzFormat
+        hr = ScaWriteConfigID(IIS_WEBLOG);
+        ExitOnFailure(hr, "Failed to write log format id");
+        hr = ScaWriteConfigString(wzWebBase);
+        ExitOnFailure(hr, "Failed to write log web key");
+        hr = ScaWriteConfigString(pswl->wzFormat);
+        ExitOnFailure(hr, "Failed to write log format string");
+    }
+
+LExit:
+    return hr;
+}
+
+
diff --git a/src/ca/scaweblog7.h b/src/ca/scaweblog7.h
new file mode 100644
index 00000000..f2bb60d7
--- /dev/null
+++ b/src/ca/scaweblog7.h
@@ -0,0 +1,14 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+HRESULT ScaGetWebLog7(
+    __in_z LPCWSTR wzLog,
+    __in WCA_WRAPQUERY_HANDLE hWebLogQuery,
+    __out SCA_WEB_LOG* pswl
+    );
+
+HRESULT ScaWriteWebLog7(
+    __in_z LPCWSTR wzRootOfWeb,
+    const SCA_WEB_LOG *pswl
+    );
diff --git a/src/ca/scawebprop.cpp b/src/ca/scawebprop.cpp
new file mode 100644
index 00000000..b5e38467
--- /dev/null
+++ b/src/ca/scawebprop.cpp
@@ -0,0 +1,301 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+// sql queries
+enum eWebDirPropertiesQuery { wpqProperties = 1, wpqAccess, wpqAuthorization, wpqUser, wpqControlledPassword, wpqLogVisits, wpqIndex, wpqDefaultDoc,  wpqAspDetailedError, wpqHttpExp, wpqCCMaxAge, wpqCCCustom, wpqNoCustomError, wpqAccessSSLFlags, wpqAuthenticationProviders };
+
+HRESULT ScaGetWebDirProperties(
+    __in LPCWSTR wzProperties,
+    __in WCA_WRAPQUERY_HANDLE hUserQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebDirPropQuery,
+    __inout SCA_WEB_PROPERTIES* pswp
+    )
+{
+    Assert(*wzProperties && pswp);
+
+    HRESULT hr = S_OK;
+    MSIHANDLE hRec;
+    LPWSTR pwzData = NULL;
+
+    ExitOnNull(wzProperties, hr, E_INVALIDARG, "Failed to get web directory properties because no properties were provided to get");
+
+    WcaFetchWrappedReset(hWebDirPropQuery);
+
+    hr = WcaFetchWrappedRecordWhereString(hWebDirPropQuery, 1, wzProperties, &hRec);
+    if (S_OK == hr)
+    {
+        hr = WcaGetRecordString(hRec, wpqProperties, &pwzData);
+        ExitOnFailure(hr, "Failed to get IIsWebDirProperties.DirProperties");
+        hr = ::StringCchCopyW(pswp->wzKey, countof(pswp->wzKey), pwzData);
+        ExitOnFailure(hr, "Failed to copy key string to webdirproperties object");
+
+        Assert(0 == lstrcmpW(pswp->wzKey, wzProperties));
+
+        hr = WcaGetRecordInteger(hRec, wpqAccess, &pswp->iAccess);
+        ExitOnFailure(hr, "Failed to get access value");
+
+        hr = WcaGetRecordInteger(hRec, wpqAuthorization, &pswp->iAuthorization);
+        ExitOnFailure(hr, "Failed to get authorization value");
+
+        // if allow anonymous users
+        if (S_OK == hr && pswp->iAuthorization & 1)
+        {
+            // if there is an anonymous user specified
+            hr = WcaGetRecordString(hRec, wpqUser, &pwzData);
+            ExitOnFailure(hr, "Failed to get AnonymousUser_");
+            if (pwzData && *pwzData)
+            {
+                hr = WcaGetRecordInteger(hRec, wpqControlledPassword, &pswp->fIIsControlledPassword);
+                ExitOnFailure(hr, "Failed to get IIsControlledPassword");
+                if (S_FALSE == hr)
+                {
+                    pswp->fIIsControlledPassword = FALSE;
+                    hr = S_OK;
+                }
+
+                hr = ScaGetUserDeferred(pwzData, hUserQuery, &pswp->scau);
+                ExitOnFailure(hr, "Failed to get User information for Web");
+
+                pswp->fHasUser = TRUE;
+            }
+            else
+                pswp->fHasUser = FALSE;
+        }
+
+        hr = WcaGetRecordInteger(hRec, wpqLogVisits, &pswp->fLogVisits);
+        ExitOnFailure(hr, "Failed to get IIsWebDirProperties.LogVisits");
+
+        hr = WcaGetRecordInteger(hRec, wpqIndex, &pswp->fIndex);
+        ExitOnFailure(hr, "Failed to get IIsWebDirProperties.Index");
+
+        hr = WcaGetRecordString(hRec, wpqDefaultDoc, &pwzData);
+        ExitOnFailure(hr, "Failed to get IIsWebDirProperties.DefaultDoc");
+        if (pwzData && *pwzData)
+        {
+            pswp->fHasDefaultDoc = TRUE;
+            if (0 == lstrcmpW(L"-", pwzData))   // remove any existing default documents by setting them blank
+            {
+                pswp->wzDefaultDoc[0] = L'\0';
+            }
+            else   // set the default documents
+            {
+                hr = ::StringCchCopyW(pswp->wzDefaultDoc, countof(pswp->wzDefaultDoc), pwzData);
+                ExitOnFailure(hr, "Failed to copy default document string to webdirproperties object");
+            }
+        }
+        else
+        {
+            pswp->fHasDefaultDoc = FALSE;
+        }
+
+        hr = WcaGetRecordInteger(hRec, wpqAspDetailedError, &pswp->fAspDetailedError);
+        ExitOnFailure(hr, "Failed to get IIsWebDirProperties.AspDetailedError");
+
+        hr = WcaGetRecordString(hRec, wpqHttpExp, &pwzData);
+        ExitOnFailure(hr, "Failed to get IIsWebDirProperties.HttpExp");
+        if (pwzData && *pwzData)
+        {
+            pswp->fHasHttpExp = TRUE;
+            if (0 == lstrcmpW(L"-", pwzData))   // remove any existing default expiration settings by setting them blank
+            {
+                pswp->wzHttpExp[0] = L'\0';
+            }
+            else   // set the expiration setting
+            {
+                hr = ::StringCchCopyW(pswp->wzHttpExp, countof(pswp->wzHttpExp), pwzData);
+                ExitOnFailure(hr, "Failed to copy http expiration string to webdirproperties object");
+            }
+        }
+        else
+        {
+            pswp->fHasHttpExp = FALSE;
+        }
+
+        hr = WcaGetRecordInteger(hRec, wpqCCMaxAge, &pswp->iCacheControlMaxAge);
+        ExitOnFailure(hr, "failed to get IIsWebDirProperties.CacheControlMaxAge");
+
+        hr = WcaGetRecordString(hRec, wpqCCCustom, &pwzData);
+        ExitOnFailure(hr, "Failed to get IIsWebDirProperties.CacheControlCustom");
+        if (pwzData && *pwzData)
+        {
+            pswp->fHasCacheControlCustom = TRUE;
+            if (0 == lstrcmpW(L"-", pwzData))   // remove any existing default cache control custom settings by setting them blank
+            {
+                pswp->wzCacheControlCustom[0] = L'\0';
+            }
+            else   // set the custom cache control setting
+            {
+                hr = ::StringCchCopyW(pswp->wzCacheControlCustom, countof(pswp->wzCacheControlCustom), pwzData);
+                ExitOnFailure(hr, "Failed to copy cache control custom settings to webdirproperites object");
+            }
+        }
+        else
+        {
+            pswp->fHasCacheControlCustom = FALSE;
+        }
+
+        hr = WcaGetRecordInteger(hRec, wpqNoCustomError, &pswp->fNoCustomError);
+        ExitOnFailure(hr, "failed to get IIsWebDirProperties.NoCustomError");
+        if (MSI_NULL_INTEGER == pswp->fNoCustomError)
+            pswp->fNoCustomError = FALSE;
+
+        hr = WcaGetRecordInteger(hRec, wpqAccessSSLFlags, &pswp->iAccessSSLFlags);
+        ExitOnFailure(hr, "failed to get IIsWebDirProperties.AccessSSLFlags");
+
+        hr = WcaGetRecordString(hRec, wpqAuthenticationProviders, &pwzData);
+        ExitOnFailure(hr, "Failed to get IIsWebDirProperties.AuthenticationProviders");
+        if (pwzData && *pwzData)
+        {
+            hr = ::StringCchCopyW(pswp->wzAuthenticationProviders, countof(pswp->wzAuthenticationProviders), pwzData);
+            ExitOnFailure(hr, "Failed to copy authentication providers string to webdirproperties object");
+        }
+        else
+        {
+            pswp->wzAuthenticationProviders[0] = L'\0';
+        }
+    }
+    else if (E_NOMOREITEMS == hr)
+    {
+        WcaLog(LOGMSG_STANDARD, "Error: Cannot locate IIsWebDirProperties.DirProperties='%ls'", wzProperties);
+        hr = E_FAIL;
+    }
+    else
+    {
+        ExitOnFailure(hr, "Error getting appropriate webdirproperty");
+    }
+
+    // Let's check that there isn't more than one record found - if there is, throw an assert like WcaFetchSingleRecord() would
+    HRESULT hrTemp = WcaFetchWrappedRecordWhereString(hWebDirPropQuery, 1, wzProperties, &hRec);
+    if (SUCCEEDED(hrTemp))
+    {
+        AssertSz(E_NOMOREITEMS == hrTemp, "ScaGetWebDirProperties found more than one record");
+    }
+
+LExit:
+    ReleaseStr(pwzData);
+
+    return hr;
+}
+
+
+HRESULT ScaWriteWebDirProperties(
+    __in IMSAdminBase* piMetabase,
+    __in LPCWSTR wzRootOfWeb,
+    __inout SCA_WEB_PROPERTIES* pswp
+    )
+{
+    HRESULT hr = S_OK;
+    DWORD dw = 0;
+    WCHAR wz[METADATA_MAX_NAME_LEN + 1];
+
+    // write the access permissions to the metabase
+    if (MSI_NULL_INTEGER != pswp->iAccess)
+    {
+        hr = ScaWriteMetabaseValue(piMetabase, wzRootOfWeb, NULL, MD_ACCESS_PERM, METADATA_INHERIT, IIS_MD_UT_FILE, DWORD_METADATA, (LPVOID)((DWORD_PTR)pswp->iAccess));
+        ExitOnFailure(hr, "Failed to write access permissions for Web");
+    }
+
+    if (MSI_NULL_INTEGER != pswp->iAuthorization)
+    {
+        hr = ScaWriteMetabaseValue(piMetabase, wzRootOfWeb, NULL, MD_AUTHORIZATION, METADATA_INHERIT, IIS_MD_UT_FILE, DWORD_METADATA, (LPVOID)((DWORD_PTR)pswp->iAuthorization));
+        ExitOnFailure(hr, "Failed to write authorization for Web");
+    }
+
+    if (pswp->fHasUser)
+    {
+        Assert(pswp->scau.wzName);
+        // write the user name
+        if (*pswp->scau.wzDomain)
+        {
+            hr = ::StringCchPrintfW(wz, countof(wz), L"%s\\%s", pswp->scau.wzDomain, pswp->scau.wzName);
+            ExitOnFailure(hr, "Failed to format domain\\username string");
+        }
+        else
+        {
+            hr = ::StringCchCopyW(wz, countof(wz), pswp->scau.wzName);
+            ExitOnFailure(hr, "Failed to copy user name");
+        }
+        hr = ScaWriteMetabaseValue(piMetabase, wzRootOfWeb, NULL, MD_ANONYMOUS_USER_NAME, METADATA_INHERIT, IIS_MD_UT_FILE, STRING_METADATA, (LPVOID)wz);
+        ExitOnFailure(hr, "Failed to write anonymous user name for Web");
+
+        // write the password
+        hr = ScaWriteMetabaseValue(piMetabase, wzRootOfWeb, NULL, MD_ANONYMOUS_PWD, METADATA_INHERIT | METADATA_SECURE, IIS_MD_UT_FILE, STRING_METADATA, (LPVOID)pswp->scau.wzPassword);
+        ExitOnFailure(hr, "Failed to write anonymous user password for Web");
+
+        // store whether IIs controls password
+        dw = (pswp->fIIsControlledPassword) ? TRUE : FALSE;
+        hr = ScaWriteMetabaseValue(piMetabase, wzRootOfWeb, NULL, MD_ANONYMOUS_USE_SUBAUTH, METADATA_INHERIT, IIS_MD_UT_FILE, DWORD_METADATA, (LPVOID)((DWORD_PTR)dw));
+        ExitOnFailure(hr, "Failed to write if IIs controls user password for Web");
+    }
+
+    if (MSI_NULL_INTEGER != pswp->fLogVisits)
+    {
+        // The sense of this boolean value is reversed - it is "don't log", not "log visits."
+        dw = (pswp->fLogVisits) ? FALSE : TRUE;
+        hr = ScaWriteMetabaseValue(piMetabase, wzRootOfWeb, NULL, MD_DONT_LOG, METADATA_INHERIT, IIS_MD_UT_FILE, DWORD_METADATA, (LPVOID)((DWORD_PTR)dw));
+        ExitOnFailure(hr, "Failed to write authorization for Web");
+    }
+
+    if (MSI_NULL_INTEGER != pswp->fIndex)
+    {
+        dw = (pswp->fIndex) ? TRUE : FALSE;
+        hr = ScaWriteMetabaseValue(piMetabase, wzRootOfWeb, NULL, MD_IS_CONTENT_INDEXED, METADATA_INHERIT, IIS_MD_UT_FILE, DWORD_METADATA, (LPVOID)((DWORD_PTR)dw));
+        ExitOnFailure(hr, "Failed to write authorization for Web");
+    }
+
+    if (pswp->fHasDefaultDoc)
+    {
+        hr = ScaWriteMetabaseValue(piMetabase, wzRootOfWeb, NULL, MD_DEFAULT_LOAD_FILE, METADATA_INHERIT, IIS_MD_UT_FILE, STRING_METADATA, (LPVOID)pswp->wzDefaultDoc);
+        ExitOnFailure(hr, "Failed to write default documents for Web");
+    }
+
+    if (MSI_NULL_INTEGER != pswp->fAspDetailedError)
+    {
+        dw = (pswp->fAspDetailedError) ? TRUE : FALSE;
+        hr = ScaWriteMetabaseValue(piMetabase, wzRootOfWeb, NULL, MD_ASP_SCRIPTERRORSSENTTOBROWSER, METADATA_INHERIT, ASP_MD_UT_APP, DWORD_METADATA, (LPVOID)((DWORD_PTR)dw));
+        ExitOnFailure(hr, "Failed to write ASP script error for Web");
+    }
+
+    if (pswp->fHasHttpExp)
+    {
+        hr = ScaWriteMetabaseValue(piMetabase, wzRootOfWeb, NULL, MD_HTTP_EXPIRES, METADATA_INHERIT, IIS_MD_UT_FILE, STRING_METADATA, (LPVOID)pswp->wzHttpExp);
+        ExitOnFailure(hr, "Failed to write HTTP Expiration for Web");
+    }
+
+    if (MSI_NULL_INTEGER != pswp->iCacheControlMaxAge)
+    {
+        hr = ScaWriteMetabaseValue(piMetabase, wzRootOfWeb, NULL, MD_CC_MAX_AGE, METADATA_INHERIT, IIS_MD_UT_FILE, DWORD_METADATA, (LPVOID)((DWORD_PTR)pswp->iCacheControlMaxAge));
+        ExitOnFailure(hr, "Failed to write Cache Control Max Age for Web");
+    }
+
+    if (pswp->fHasCacheControlCustom)
+    {
+        hr = ScaWriteMetabaseValue(piMetabase, wzRootOfWeb, NULL, MD_CC_OTHER, METADATA_INHERIT, IIS_MD_UT_FILE, STRING_METADATA, (LPVOID)pswp->wzCacheControlCustom);
+        ExitOnFailure(hr, "Failed to write Cache Control Custom for Web");
+    }
+
+    if (pswp->fNoCustomError)
+    {
+        memset(wz, 0, sizeof(wz));
+        hr = ScaWriteMetabaseValue(piMetabase, wzRootOfWeb, NULL, MD_CUSTOM_ERROR, METADATA_INHERIT, IIS_MD_UT_FILE, MULTISZ_METADATA, wz);
+        ExitOnFailure(hr, "Failed to write Custom Error for Web");
+    }
+
+    if (MSI_NULL_INTEGER != pswp->iAccessSSLFlags)
+    {
+        hr = ScaWriteMetabaseValue(piMetabase, wzRootOfWeb, NULL, MD_SSL_ACCESS_PERM, METADATA_INHERIT, IIS_MD_UT_FILE, DWORD_METADATA, (LPVOID)((DWORD_PTR)pswp->iAccessSSLFlags));
+        ExitOnFailure(hr, "Failed to write AccessSSLFlags for Web");
+    }
+
+    if (*pswp->wzAuthenticationProviders)
+    {
+        hr = ::StringCchCopyW(wz, countof(wz), pswp->wzAuthenticationProviders);
+        ExitOnFailure(hr, "Failed to copy authentication providers string");
+        hr = ScaWriteMetabaseValue(piMetabase, wzRootOfWeb, NULL, MD_NTAUTHENTICATION_PROVIDERS, METADATA_INHERIT, IIS_MD_UT_FILE, STRING_METADATA, (LPVOID)wz);
+        ExitOnFailure(hr, "Failed to write AuthenticationProviders for Web");
+    }
+
+LExit:
+    return hr;
+}
diff --git a/src/ca/scawebprop.h b/src/ca/scawebprop.h
new file mode 100644
index 00000000..7a3ae5c9
--- /dev/null
+++ b/src/ca/scawebprop.h
@@ -0,0 +1,60 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+#include "scauser.h"
+ 
+// global sql queries provided for optimization
+extern LPCWSTR vcsWebDirPropertiesQuery;
+
+
+// structs
+struct SCA_WEB_PROPERTIES
+{
+        WCHAR wzKey[MAX_DARWIN_KEY + 1];
+
+        int iAccess;
+
+        int iAuthorization;
+        BOOL fHasUser;
+        SCA_USER scau;
+        BOOL fIIsControlledPassword;
+
+        BOOL fLogVisits;
+        BOOL fIndex;
+
+        BOOL fHasDefaultDoc;
+        WCHAR wzDefaultDoc[MAX_DARWIN_COLUMN + 1];
+
+        BOOL fHasHttpExp;
+        WCHAR wzHttpExp[MAX_DARWIN_COLUMN + 1];
+
+        BOOL fAspDetailedError;
+
+        int iCacheControlMaxAge;
+
+        BOOL fHasCacheControlCustom;
+        WCHAR wzCacheControlCustom[MAX_DARWIN_COLUMN + 1];
+
+        BOOL fNoCustomError;
+
+        int iAccessSSLFlags;
+
+        WCHAR wzAuthenticationProviders[MAX_DARWIN_COLUMN + 1];
+};
+ 
+
+// prototypes
+HRESULT ScaGetWebDirProperties(
+    __in LPCWSTR pwzProperties,
+    __in WCA_WRAPQUERY_HANDLE hUserQuery,
+    __in WCA_WRAPQUERY_HANDLE hWebDirPropQuery,
+    __inout SCA_WEB_PROPERTIES* pswp
+    );
+
+HRESULT ScaWriteWebDirProperties(
+    __in IMSAdminBase* piMetabase,
+    __in LPCWSTR wzRootOfWeb, 
+    __inout SCA_WEB_PROPERTIES* pswp
+    );
+
diff --git a/src/ca/scawebprop7.cpp b/src/ca/scawebprop7.cpp
new file mode 100644
index 00000000..b8d99b0a
--- /dev/null
+++ b/src/ca/scawebprop7.cpp
@@ -0,0 +1,155 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+HRESULT ScaWriteWebDirProperties7(
+    __in_z LPCWSTR wzWebName,
+    __in_z LPCWSTR wzRootOfWeb,
+    __in const SCA_WEB_PROPERTIES* pswp
+    )
+{
+    HRESULT hr = S_OK;
+    WCHAR wz[METADATA_MAX_NAME_LEN + 1];
+
+    //all go to same web/root location tag
+    hr = ScaWriteConfigID(IIS_DIRPROP_BEGIN);
+    ExitOnFailure(hr, "Failed to write DirProp begin id");
+    hr = ScaWriteConfigString(wzWebName);                //site name key
+    ExitOnFailure(hr, "Failed to write DirProp web key");
+    hr = ScaWriteConfigString(wzRootOfWeb);               //app path key
+    ExitOnFailure(hr, "Failed to write DirProp app key");
+
+    // write the access permissions to the metabase
+    if (MSI_NULL_INTEGER != pswp->iAccess)
+    {
+        hr = ScaWriteConfigID(IIS_DIRPROP_ACCESS);
+        ExitOnFailure(hr, "Failed to write DirProp access id");
+        hr = ScaWriteConfigInteger(pswp->iAccess);
+        ExitOnFailure(hr, "Failed to write access permissions for Web");
+    }
+
+    if (MSI_NULL_INTEGER != pswp->iAuthorization)
+    {
+        hr = ScaWriteConfigID(IIS_DIRPROP_AUTH);
+        ExitOnFailure(hr, "Failed to write DirProp auth id");
+        hr = ScaWriteConfigInteger(pswp->iAuthorization);
+        ExitOnFailure(hr, "Failed to write authorization for Web");
+    }
+
+    if (pswp->fHasUser)
+    {
+        Assert(pswp->scau.wzName);
+        // write the user name
+        if (*pswp->scau.wzDomain)
+        {
+            hr = ::StringCchPrintfW(wz, countof(wz), L"%s\\%s", pswp->scau.wzDomain, pswp->scau.wzName);
+            ExitOnFailure(hr, "Failed to format domain\\username string");
+        }
+        else
+        {
+#pragma prefast(suppress:26037, "Source string is null terminated - it is populated as target of ::StringCchCopyW")
+            hr = ::StringCchCopyW(wz, countof(wz), pswp->scau.wzName);
+            ExitOnFailure(hr, "Failed to copy user name");
+        }
+        hr = ScaWriteConfigID(IIS_DIRPROP_USER);
+        ExitOnFailure(hr, "Failed to write DirProp user id");
+        hr = ScaWriteConfigString(wz);
+        ExitOnFailure(hr, "Failed to write anonymous user name for Web");
+
+        // write the password
+        hr = ScaWriteConfigID(IIS_DIRPROP_PWD);
+        ExitOnFailure(hr, "Failed to write DirProp pwd id");
+        hr = ScaWriteConfigString(pswp->scau.wzPassword);
+        ExitOnFailure(hr, "Failed to write anonymous user password for Web");
+
+        if (pswp->fIIsControlledPassword)
+        {
+            //Not Supported by IIS7 : pswp->fIIsControlledPassword
+            WcaLog(LOGMSG_VERBOSE, "Not supported by IIS7: WebDirProperties.IIsControlledPassword, ignoring");
+        }
+    }
+
+    if (MSI_NULL_INTEGER != pswp->fLogVisits)
+    {
+        hr = ScaWriteConfigID(IIS_DIRPROP_LOGVISITS);
+        ExitOnFailure(hr, "Failed to write DirProp logVisits id");
+        hr = ScaWriteConfigInteger(pswp->fLogVisits ? FALSE : TRUE); // we capture "should log" but IIS7 wants "should not log"
+        ExitOnFailure(hr, "Failed to write DirProp logVisits");
+    }
+
+    if (MSI_NULL_INTEGER != pswp->fIndex)
+    {
+        //Not Supported by IIS7 : pswp->fIndex
+        WcaLog(LOGMSG_VERBOSE, "Not supported by IIS7: WebDirProperties.Index, ignoring");
+    }
+
+    if (pswp->fHasDefaultDoc)
+    {
+        hr = ScaWriteConfigID(IIS_DIRPROP_DEFDOCS);
+        ExitOnFailure(hr, "Failed to write DirProp defdocs id");
+        hr = ScaWriteConfigString(pswp->wzDefaultDoc);
+        ExitOnFailure(hr, "Failed to write default documents for Web");
+    }
+
+    if (MSI_NULL_INTEGER != pswp->fAspDetailedError)
+    {
+        hr = ScaWriteConfigID(IIS_DIRPROP_ASPERROR);
+        ExitOnFailure(hr, "Failed to write ASP script error id");
+        hr = ScaWriteConfigInteger(pswp->fAspDetailedError);
+        ExitOnFailure(hr, "Failed to write ASP script error for Web");
+    }
+
+    if (pswp->fHasHttpExp)
+    {
+        hr = ScaWriteConfigID(IIS_DIRPROP_HTTPEXPIRES);
+        ExitOnFailure(hr, "Failed to write DirProp HttpExpires id");
+        hr = ScaWriteConfigString(pswp->wzHttpExp);
+        ExitOnFailure(hr, "Failed to write DirProp HttpExpires value");
+    }
+
+    if (MSI_NULL_INTEGER != pswp->iCacheControlMaxAge)
+    {
+        hr = ScaWriteConfigID(IIS_DIRPROP_MAXAGE);
+        ExitOnFailure(hr, "Failed to write DirProp MaxAge id");
+        hr = ScaWriteConfigInteger(pswp->iCacheControlMaxAge);
+        ExitOnFailure(hr, "Failed to write DirProp MaxAge value");
+    }
+
+    if (pswp->fHasCacheControlCustom)
+    {
+        hr = ScaWriteConfigID(IIS_DIRPROP_CACHECUST);
+        ExitOnFailure(hr, "Failed to write DirProp Cache Control Custom id");
+        hr = ScaWriteConfigString(pswp->wzCacheControlCustom);
+        ExitOnFailure(hr, "Failed to write Cache Control Custom for Web");
+    }
+
+    if (pswp->fNoCustomError)
+    {
+        hr = ScaWriteConfigID(IIS_DIRPROP_NOCUSTERROR);
+        ExitOnFailure(hr, "Failed to write DirProp clear Cust Errors id");
+    }
+
+    if (MSI_NULL_INTEGER != pswp->iAccessSSLFlags)
+    {
+        hr = ScaWriteConfigID(IIS_DIRPROP_SSLFLAGS);
+        ExitOnFailure(hr, "Failed to write DirProp sslFlags id");
+        hr = ScaWriteConfigInteger(pswp->iAccessSSLFlags);
+        ExitOnFailure(hr, "Failed to write AccessSSLFlags for Web");
+    }
+
+    if (*pswp->wzAuthenticationProviders)
+    {
+        hr = ::StringCchCopyW(wz, countof(wz), pswp->wzAuthenticationProviders);
+        ExitOnFailure(hr, "Failed to copy authentication providers string");
+        hr = ScaWriteConfigID(IIS_DIRPROP_AUTHPROVID);
+        ExitOnFailure(hr, "Failed to write DirProp AuthProvid id");
+        hr = ScaWriteConfigString(wz);
+        ExitOnFailure(hr, "Failed to write AuthenticationProviders for Web");
+    }
+    //End of Dir Properties
+    hr = ScaWriteConfigID(IIS_DIRPROP_END);
+    ExitOnFailure(hr, "Failed to write DirProp end id");
+
+LExit:
+    return hr;
+}
diff --git a/src/ca/scawebprop7.h b/src/ca/scawebprop7.h
new file mode 100644
index 00000000..a97e8679
--- /dev/null
+++ b/src/ca/scawebprop7.h
@@ -0,0 +1,12 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+#include "scauser.h"
+
+HRESULT ScaWriteWebDirProperties7(
+    __in_z LPCWSTR wzwWebName,
+    __in_z LPCWSTR wzRootOfWeb,
+    const SCA_WEB_PROPERTIES* pswp
+    );
+
diff --git a/src/ca/scawebsvcext.cpp b/src/ca/scawebsvcext.cpp
new file mode 100644
index 00000000..369e951b
--- /dev/null
+++ b/src/ca/scawebsvcext.cpp
@@ -0,0 +1,343 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+// sql queries
+enum eWebSvcExtQuery { ldqComponent=1 , ldqFile, ldqDescription, ldqGroup, ldqAttributes, ldqInstalled, ldqAction };
+
+
+LPCWSTR vcsWebSvcExtRoot = L"/LM/W3SVC";
+
+// prototypes for private helper functions
+static HRESULT AddWebSvcExtToList(
+    __in SCA_WEBSVCEXT** ppsWseList
+    );
+
+//static HRESULT ScaCheckWebSvcExtValue(
+//    __in IMSAdminBase* piMetabase,
+//    __in DWORD dwMDIdentifier
+//    );
+
+static HRESULT ScaWebSvcExtInstall(
+    __in LPWSTR *pwzWebSvcExtList,
+    __in DWORD_PTR *pcchWebSvcExtList,
+    __in SCA_WEBSVCEXT* psWseList
+    );
+
+static HRESULT ScaWebSvcExtUninstall(
+    __in LPWSTR *pwzWebSvcExtList,
+    __in const DWORD *pcchWebSvcExtList,
+    __in SCA_WEBSVCEXT* psWseList
+    );
+
+// functions
+
+HRESULT __stdcall ScaWebSvcExtRead(
+    __in SCA_WEBSVCEXT** ppsWseList,
+    __inout LPWSTR *ppwzCustomActionData
+    )
+{
+    Assert(ppsWseList);
+
+    HRESULT hr = S_OK;
+    MSIHANDLE hRec;
+    LPWSTR pwzData = NULL;
+    INSTALLSTATE isInstalled = INSTALLSTATE_UNKNOWN;
+    INSTALLSTATE isAction = INSTALLSTATE_UNKNOWN;
+    SCA_WEBSVCEXT* psWebSvcExt = NULL;
+    WCA_WRAPQUERY_HANDLE hWrapQuery = NULL;
+
+    hr = WcaBeginUnwrapQuery(&hWrapQuery, ppwzCustomActionData);
+    ExitOnFailure(hr, "Failed to unwrap query for ScaWebSvcExtRead");
+
+    if (0 == WcaGetQueryRecords(hWrapQuery))
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping ScaWebSvcExtRead() because IIsWebServiceExtension data not present");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    // loop through all the web service extensions
+    while (S_OK == (hr = WcaFetchWrappedRecord(hWrapQuery, &hRec)))
+    {
+        // Get the Component first.  If the Component is not being modified during
+        // this transaction, skip processing this whole record.
+        hr = WcaGetRecordString(hRec, ldqComponent, &pwzData);
+        ExitOnFailure(hr, "Failed to get Component for WebSvcExt");
+
+        hr = WcaGetRecordInteger(hRec, ldqInstalled, (int *)&isInstalled);
+        ExitOnFailure(hr, "Failed to get Component installed state for WebSvcExt");
+
+        hr = WcaGetRecordInteger(hRec, ldqAction, (int *)&isAction);
+        ExitOnFailure(hr, "Failed to get Component action state for WebSvcExt");
+
+        if (!WcaIsInstalling(isInstalled, isAction) &&
+            !WcaIsReInstalling(isInstalled, isAction) &&
+            !WcaIsUninstalling(isInstalled, isAction))
+        {
+            continue; // skip this record.
+        }
+
+        hr = AddWebSvcExtToList(ppsWseList);
+        ExitOnFailure(hr, "failed to add element to web svc ext list");
+
+        psWebSvcExt = *ppsWseList;
+        Assert(psWebSvcExt);
+
+        psWebSvcExt->isInstalled = isInstalled;
+        psWebSvcExt->isAction = isAction;
+
+        hr = WcaGetRecordString(hRec, ldqFile, &pwzData);
+        ExitOnFailure(hr, "Failed to get File for WebSvcExt");
+        hr = ::StringCchCopyW(psWebSvcExt->wzFile, countof(psWebSvcExt->wzFile), pwzData);
+        ExitOnFailure(hr, "Failed to copy File for WebSvcExt");
+
+        hr = WcaGetRecordString(hRec, ldqDescription, &pwzData);
+        ExitOnFailure(hr, "Failed to get Description for WebSvcExt");
+        hr = ::StringCchCopyW(psWebSvcExt->wzDescription, countof(psWebSvcExt->wzDescription), pwzData);
+        ExitOnFailure(hr, "Failed to copy Description for WebSvcExt");
+
+        hr = WcaGetRecordString(hRec, ldqGroup, &pwzData);
+        ExitOnFailure(hr, "Failed to get Group for WebSvcExt");
+        hr = ::StringCchCopyW(psWebSvcExt->wzGroup, countof(psWebSvcExt->wzGroup), pwzData);
+        ExitOnFailure(hr, "Failed to copy Group for WebSvcExt");
+
+        hr = WcaGetRecordInteger(hRec, ldqAttributes, &psWebSvcExt->iAttributes);
+        ExitOnFailure(hr, "Failed to get Attributes for WebSvcExt");
+    }
+
+    if (E_NOMOREITEMS == hr)
+        hr = S_OK;
+    ExitOnFailure(hr, "Failure while processing WebSvcExt");
+
+LExit:
+    WcaFinishUnwrapQuery(hWrapQuery);
+
+    ReleaseStr(pwzData);
+
+    return hr;
+}
+
+
+// Commit does both install and uninstall
+HRESULT __stdcall ScaWebSvcExtCommit(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_WEBSVCEXT* psWseList
+    )
+{
+    Assert(piMetabase);
+
+    HRESULT hr = S_OK;
+    METADATA_RECORD mr;
+
+    LPWSTR wzWebSvcExtList = NULL;
+    DWORD cbWebSvcExtList = 0;
+    DWORD_PTR cchWebSvcExtList = 0;
+
+    if (!psWseList)
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping ScaWebSvcExtCommit() because there are no web service extensions in the list");
+        ExitFunction();
+    }
+
+    // Get current set of web service extensions.
+    ::ZeroMemory(&mr, sizeof(mr));
+    mr.dwMDIdentifier = MD_WEB_SVC_EXT_RESTRICTION_LIST;
+    mr.dwMDAttributes = 0;
+    mr.dwMDUserType  = IIS_MD_UT_SERVER;
+    mr.dwMDDataType = ALL_METADATA;
+    mr.pbMDData = NULL;
+    mr.dwMDDataLen = 0;
+
+    hr = piMetabase->GetData(METADATA_MASTER_ROOT_HANDLE, vcsWebSvcExtRoot, &mr, &cbWebSvcExtList);
+    if (MD_ERROR_DATA_NOT_FOUND == hr)
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping ScaWebSvcExtCommit() because WebSvcExtRestrictionList value is not present");
+        ExitFunction1(hr = S_FALSE);
+    }
+    else if (HRESULT_FROM_WIN32(ERROR_INSUFFICIENT_BUFFER) == hr)
+    {
+        // cchWebSvcExtList is returned in bytes. Convert to WCHAR size to call StrAlloc
+        cchWebSvcExtList = cbWebSvcExtList / sizeof(WCHAR);
+        hr = StrAlloc(&wzWebSvcExtList, cchWebSvcExtList);
+        ExitOnFailure(hr, "Failed allocating space for web service extensions");
+    }
+    else
+    {
+        ExitOnFailure(hr, "Failed retrieving web service extensions");
+    }
+
+    mr.pbMDData = (unsigned char*)wzWebSvcExtList;
+    mr.dwMDDataLen = cbWebSvcExtList;
+
+    hr = piMetabase->GetData(METADATA_MASTER_ROOT_HANDLE, vcsWebSvcExtRoot, &mr, &cbWebSvcExtList);
+    ExitOnFailure(hr, "Failed retrieving web service extensions");
+
+    // Make changes to local copy of metabase
+    while (psWseList)
+    {
+        if (WcaIsInstalling(psWseList->isInstalled, psWseList->isAction))
+        {
+            hr = ScaWebSvcExtInstall(&wzWebSvcExtList, &cchWebSvcExtList, psWseList);
+            ExitOnFailure(hr, "Failed to install Web Service extension");
+        }
+        else if (WcaIsUninstalling(psWseList->isInstalled, psWseList->isAction))
+        {
+            hr = ScaWebSvcExtUninstall(&wzWebSvcExtList, (DWORD *)&cchWebSvcExtList, psWseList);
+            ExitOnFailure(hr, "Failed to uninstall Web Service extension");
+        }
+
+        psWseList = psWseList->psWseNext;
+    }
+
+    // Write Metabase
+    hr = ScaWriteMetabaseValue(piMetabase, vcsWebSvcExtRoot, NULL, MD_WEB_SVC_EXT_RESTRICTION_LIST, METADATA_INHERIT, IIS_MD_UT_FILE, MULTISZ_METADATA, wzWebSvcExtList);
+    ExitOnFailure(hr, "Failed to write WebServiceExtensions: '%ls'", wzWebSvcExtList);
+
+LExit:
+    ReleaseStr(wzWebSvcExtList);
+
+    return hr;
+}
+
+
+static HRESULT ScaWebSvcExtInstall(
+    __in LPWSTR *ppwzWebSvcExtList,
+    __in DWORD_PTR *pcchWebSvcExtList,
+    __in SCA_WEBSVCEXT* psWseList
+    )
+{
+    Assert( ppwzWebSvcExtList && pcchWebSvcExtList && psWseList);
+    Assert(*ppwzWebSvcExtList);
+
+    HRESULT hr = S_OK;
+
+    LPWSTR pwzWebSvcExt = NULL;
+    int iAllow;
+    int iUiDeletable;
+
+    BOOL fAlreadyExists = FALSE;
+    DWORD_PTR dwIndex = 0xFFFFFFFF;
+    LPCWSTR wzFoundString = NULL;
+
+    // Check if it's already in there
+    hr = MultiSzFindSubstring(*ppwzWebSvcExtList, psWseList->wzFile, &dwIndex, &wzFoundString);
+    ExitOnFailure(hr, "failed to search for string:%ls in web service extension MULTISZ", psWseList->wzFile);
+
+    if (S_FALSE != hr && NULL != wcsstr(wzFoundString, psWseList->wzGroup) && NULL != wcsstr(wzFoundString, psWseList->wzDescription))
+    {
+        fAlreadyExists = TRUE;
+    }
+
+    // Construct the single string in the format required for the WebSvc Ext list in metabase
+    iAllow = (psWseList->iAttributes & 1);
+    iUiDeletable = ((psWseList->iAttributes >> 1) & 1);
+    hr = StrAllocFormatted(&pwzWebSvcExt, L"%d,%s,%d,%s,%s", iAllow, psWseList->wzFile, iUiDeletable, psWseList->wzGroup, psWseList->wzDescription);
+    ExitOnFailure(hr, "Failure allocating space for web service extensions");
+
+    if (fAlreadyExists)
+    {
+        hr = MultiSzReplaceString(ppwzWebSvcExtList, dwIndex, pwzWebSvcExt);
+        ExitOnFailure(hr, "failed to update web service extension string: %ls", pwzWebSvcExt);
+    }
+    else
+    {
+        hr = MultiSzPrepend(ppwzWebSvcExtList, pcchWebSvcExtList, pwzWebSvcExt);
+        ExitOnFailure(hr, "failed to prepend web service extension string: %ls", pwzWebSvcExt);
+    }
+
+LExit:
+    ReleaseStr(pwzWebSvcExt);
+
+    return hr;
+}
+
+
+static HRESULT ScaWebSvcExtUninstall(
+    __in LPWSTR *ppwzWebSvcExtList,
+    __in const DWORD* /*pcchWebSvcExtList*/,
+    __in SCA_WEBSVCEXT* psWseList
+    )
+{
+    Assert(ppwzWebSvcExtList && *ppwzWebSvcExtList && psWseList);
+    Assert(*ppwzWebSvcExtList);
+
+    HRESULT hr = S_OK;
+    DWORD_PTR dwIndex = 0xFFFFFFFF;
+    LPCWSTR wzFoundString = NULL;
+
+    // Find the string to remove
+    hr = MultiSzFindSubstring(*ppwzWebSvcExtList, psWseList->wzFile, &dwIndex, &wzFoundString);
+    ExitOnFailure(hr, "failed to search for string:%ls in web service extension MULTISZ", psWseList->wzFile);
+
+    // If we found a match (ignoring the Allow and Deletable flags)
+    if (S_FALSE != hr && NULL != wcsstr(wzFoundString, psWseList->wzGroup) && NULL != wcsstr(wzFoundString, psWseList->wzDescription))
+    {
+        hr = MultiSzRemoveString(ppwzWebSvcExtList, dwIndex);
+        ExitOnFailure(hr, "failed to remove string: %d from web service extension MULTISZ", dwIndex);
+    }
+
+LExit:
+    return hr;
+}
+
+
+//static HRESULT ScaCheckWebSvcExtValue(
+//    __in IMSAdminBase* piMetabase,
+//    __in DWORD dwMDIdentifier
+//    )
+//{
+//    if (!piMetabase)
+//    {
+//        return E_INVALIDARG;
+//    }
+//
+//    HRESULT hr = S_OK;
+//    METADATA_RECORD mr = { 0 };
+//    DWORD cch = 0;
+//
+//    mr.dwMDIdentifier = dwMDIdentifier;
+//    mr.dwMDUserType  = IIS_MD_UT_SERVER;
+//
+//    hr = piMetabase->GetData(METADATA_MASTER_ROOT_HANDLE, vcsWebSvcExtRoot, &mr, &cch);
+//    if (HRESULT_FROM_WIN32(ERROR_INSUFFICIENT_BUFFER) == hr)
+//    {
+//        hr = S_OK;
+//    }
+//    else if (MD_ERROR_DATA_NOT_FOUND == hr)
+//    {
+//        hr = S_FALSE;
+//    }
+//
+//    return hr;
+//}
+
+
+void ScaWebSvcExtFreeList(
+    __in SCA_WEBSVCEXT* psWseList
+    )
+{
+    SCA_WEBSVCEXT* psWseDelete = psWseList;
+    while (psWseList)
+    {
+        psWseDelete = psWseList;
+        psWseList = psWseList->psWseNext;
+        MemFree(psWseDelete);
+    }
+}
+
+
+static HRESULT AddWebSvcExtToList(
+    __in SCA_WEBSVCEXT** ppsWseList
+    )
+{
+    HRESULT hr = S_OK;
+
+    SCA_WEBSVCEXT* psWse = static_cast<SCA_WEBSVCEXT*>(MemAlloc(sizeof(SCA_WEBSVCEXT), TRUE));
+    ExitOnNull(psWse, hr, E_OUTOFMEMORY, "failed to allocate element for web svc ext list");
+
+    psWse->psWseNext = *ppsWseList;
+    *ppsWseList = psWse;
+
+LExit:
+    return hr;
+}
diff --git a/src/ca/scawebsvcext.h b/src/ca/scawebsvcext.h
new file mode 100644
index 00000000..4d225b09
--- /dev/null
+++ b/src/ca/scawebsvcext.h
@@ -0,0 +1,35 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+enum SCA_WEBSVCEXT_ATTRIBUTES { SWSEATTRIB_ALLOW = 1, SWSEATTRIB_UIDELETABLE = 2 };
+
+struct SCA_WEBSVCEXT
+{
+    // darwin information
+    INSTALLSTATE isInstalled;
+    INSTALLSTATE isAction;
+
+    // iis configuation information
+    WCHAR wzFile[MAX_PATH + 1];
+    WCHAR wzDescription[MAX_DARWIN_COLUMN + 1];
+    WCHAR wzGroup[MAX_DARWIN_COLUMN + 1];
+
+    int iAttributes;
+
+    SCA_WEBSVCEXT* psWseNext;
+};
+
+HRESULT __stdcall ScaWebSvcExtRead(
+    __in SCA_WEBSVCEXT** ppsWseList,
+    __inout LPWSTR *ppwzCustomActionData
+    );
+
+HRESULT ScaWebSvcExtCommit(
+    __in IMSAdminBase* piMetabase,
+    __in SCA_WEBSVCEXT* psWseList
+    );
+
+void ScaWebSvcExtFreeList(
+    __in SCA_WEBSVCEXT* psWseList
+    );
diff --git a/src/ca/scawebsvcext7.cpp b/src/ca/scawebsvcext7.cpp
new file mode 100644
index 00000000..dcf2f7f8
--- /dev/null
+++ b/src/ca/scawebsvcext7.cpp
@@ -0,0 +1,106 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+static HRESULT ScaWebSvcExtInstall(
+    const SCA_WEBSVCEXT* psWseList
+    );
+
+static HRESULT ScaWebSvcExtUninstall(
+    const SCA_WEBSVCEXT* psWseList
+    );
+
+// functions
+// Commit does both install and uninstall
+HRESULT __stdcall ScaWebSvcExtCommit7(
+    __in SCA_WEBSVCEXT* psWseList
+    )
+{
+    HRESULT hr = S_OK;
+
+    if (!psWseList)
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping ScaWebSvcExtCommit() because there are no web service extensions in the list");
+        ExitFunction();
+    }
+
+    // Make changes to local copy of metabase
+    while (psWseList)
+    {
+        if (WcaIsInstalling(psWseList->isInstalled, psWseList->isAction))
+        {
+            hr = ScaWebSvcExtInstall(psWseList);
+            ExitOnFailure(hr, "Failed to install Web Service extension");
+        }
+        else if (WcaIsUninstalling(psWseList->isInstalled, psWseList->isAction))
+        {
+            hr = ScaWebSvcExtUninstall(psWseList);
+            ExitOnFailure(hr, "Failed to uninstall Web Service extension");
+        }
+
+        psWseList = psWseList->psWseNext;
+    }
+
+
+LExit:
+
+    return hr;
+}
+
+
+static HRESULT ScaWebSvcExtInstall(
+    const SCA_WEBSVCEXT* psWseList
+    )
+{
+    HRESULT hr = S_OK;
+    int iAllow;
+
+    //Write CAData actions
+    hr = ScaWriteConfigID(IIS_WEB_SVC_EXT);
+    ExitOnFailure(hr, "failed add web svc ext ID");
+    hr = ScaWriteConfigID(IIS_CREATE);
+    ExitOnFailure(hr, "failed add web svc ext action");
+
+    // write File path
+    hr = ScaWriteConfigString(psWseList->wzFile);
+    ExitOnFailure(hr, "failed add web svc ext file path");
+
+    // write allowed
+    // unDeleatable n/a in IIS7
+    iAllow = (psWseList->iAttributes & 1);
+    hr = ScaWriteConfigInteger(iAllow);
+    ExitOnFailure(hr, "failed add web svc ext Allowed");
+
+    //write group
+    hr = ScaWriteConfigString(psWseList->wzGroup);
+    ExitOnFailure(hr, "failed add web svc ext group");
+
+    //write description
+    hr = ScaWriteConfigString(psWseList->wzDescription);
+    ExitOnFailure(hr, "failed add web svc ext description");
+
+LExit:
+
+    return hr;
+}
+
+
+static HRESULT ScaWebSvcExtUninstall(
+    const SCA_WEBSVCEXT* psWseList
+    )
+{
+    HRESULT hr = S_OK;
+
+    //Write CAData actions
+    hr = ScaWriteConfigID(IIS_WEB_SVC_EXT);
+    ExitOnFailure(hr, "failed add web svc ext ID");
+    hr = ScaWriteConfigID(IIS_DELETE);
+    ExitOnFailure(hr, "failed add web svc ext action");
+
+    // write File path (Key)
+    hr = ScaWriteConfigString(psWseList->wzFile);
+    ExitOnFailure(hr, "failed add web svc ext file path");
+
+LExit:
+    return hr;
+}
diff --git a/src/ca/scawebsvcext7.h b/src/ca/scawebsvcext7.h
new file mode 100644
index 00000000..1a686aed
--- /dev/null
+++ b/src/ca/scawebsvcext7.h
@@ -0,0 +1,8 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+HRESULT ScaWebSvcExtCommit7(
+    __in SCA_WEBSVCEXT* psWseList
+    );
+