39 files changed, 11827 insertions, 0 deletions

diff --git a/src/ext/Util/ca/BroadcastSettingChange.cpp b/src/ext/Util/ca/BroadcastSettingChange.cpp
new file mode 100644
index 00000000..2e153ad3
--- /dev/null
+++ b/src/ext/Util/ca/BroadcastSettingChange.cpp
@@ -0,0 +1,45 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+
+/********************************************************************
+WixBroadcastSettingChange
+
+  Send WM_SETTINGCHANGE message to all top-level windows indicating
+  that unspecified settings have changed.
+********************************************************************/
+extern "C" UINT __stdcall WixBroadcastSettingChange(
+    __in MSIHANDLE hInstall
+    )
+{
+    HRESULT hr = WcaInitialize(hInstall, "WixBroadcastSettingChange");
+    ExitOnFailure(hr, "failed to initialize WixBroadcastSettingChange");
+
+    // best effort; ignore failures
+    ::SendMessageTimeoutW(HWND_BROADCAST, WM_SETTINGCHANGE, NULL, NULL, SMTO_ABORTIFHUNG, 1000, NULL);
+
+LExit:
+    return WcaFinalize(ERROR_SUCCESS);
+}
+
+
+/********************************************************************
+WixBroadcastEnvironmentChange
+
+  Send WM_SETTINGCHANGE message to all top-level windows indicating
+  that environment variables have changed.
+********************************************************************/
+extern "C" UINT __stdcall WixBroadcastEnvironmentChange(
+    __in MSIHANDLE hInstall
+    )
+{
+    HRESULT hr = WcaInitialize(hInstall, "WixBroadcastEnvironmentChange");
+    ExitOnFailure(hr, "failed to initialize WixBroadcastEnvironmentChange");
+
+    // best effort; ignore failures
+    ::SendMessageTimeoutW(HWND_BROADCAST, WM_SETTINGCHANGE, NULL, reinterpret_cast<LPARAM>(L"Environment"), SMTO_ABORTIFHUNG, 1000, NULL);
+
+LExit:
+    return WcaFinalize(ERROR_SUCCESS);
+}
diff --git a/src/ext/Util/ca/CheckReboot.cpp b/src/ext/Util/ca/CheckReboot.cpp
new file mode 100644
index 00000000..ce056411
--- /dev/null
+++ b/src/ext/Util/ca/CheckReboot.cpp
@@ -0,0 +1,36 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+
+/********************************************************************
+WixCheckRebootRequired - entry point for WixCheckRebootRequired Custom Action
+
+ called as Type 1 CustomAction (binary DLL) from Windows Installer 
+ in InstallExecuteSequence after InstallFinalize
+********************************************************************/
+extern "C" UINT __stdcall WixCheckRebootRequired(
+    __in MSIHANDLE hInstall
+    )
+{
+    HRESULT hr = S_OK;
+    DWORD er = ERROR_SUCCESS;
+
+    hr = WcaInitialize(hInstall, "WixCheckRebootRequired");
+    ExitOnFailure(hr, "failed to initialize");
+
+    if (WcaDidDeferredActionRequireReboot())
+    {
+        WcaLog(LOGMSG_STANDARD, "Reboot required by deferred CustomAction.");
+
+        er = ::MsiSetMode(hInstall, MSIRUNMODE_REBOOTATEND, TRUE);
+        hr = HRESULT_FROM_WIN32(er);
+        ExitOnFailure(hr, "Failed to schedule reboot.");
+    }
+
+LExit:
+
+    if (FAILED(hr))
+        er = ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
diff --git a/src/ext/Util/ca/CloseApps.cpp b/src/ext/Util/ca/CloseApps.cpp
new file mode 100644
index 00000000..d4256c43
--- /dev/null
+++ b/src/ext/Util/ca/CloseApps.cpp
@@ -0,0 +1,568 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+#define DEFAULT_PROCESS_EXIT_WAIT_TIME 5000
+
+// structs
+LPCWSTR wzQUERY_CLOSEAPPS = L"SELECT `Wix4CloseApplication`, `Target`, `Description`, `Condition`, `Attributes`, `Property`, `TerminateExitCode`, `Timeout` FROM `Wix4CloseApplication` ORDER BY `Sequence`";
+enum eQUERY_CLOSEAPPS { QCA_ID = 1, QCA_TARGET, QCA_DESCRIPTION, QCA_CONDITION, QCA_ATTRIBUTES, QCA_PROPERTY, QCA_TERMINATEEXITCODE, QCA_TIMEOUT };
+
+// CloseApplication.Attributes
+enum CLOSEAPP_ATTRIBUTES
+{
+    CLOSEAPP_ATTRIBUTE_NONE = 0x0,
+    CLOSEAPP_ATTRIBUTE_CLOSEMESSAGE = 0x1,
+    CLOSEAPP_ATTRIBUTE_REBOOTPROMPT = 0x2,
+    CLOSEAPP_ATTRIBUTE_ELEVATEDCLOSEMESSAGE = 0x4,
+    CLOSEAPP_ATTRIBUTE_ENDSESSIONMESSAGE = 0x8,
+    CLOSEAPP_ATTRIBUTE_ELEVATEDENDSESSIONMESSAGE = 0x10,
+    CLOSEAPP_ATTRIBUTE_TERMINATEPROCESS = 0x20,
+    CLOSEAPP_ATTRIBUTE_PROMPTTOCONTINUE = 0x40,
+};
+
+struct PROCESS_AND_MESSAGE
+{
+    DWORD dwProcessId;
+    DWORD dwMessageId;
+    DWORD dwTimeout;
+};
+
+
+/******************************************************************
+ EnumWindowsProc - callback function which sends message if the
+ current window matches the passed in process ID
+
+******************************************************************/
+BOOL CALLBACK EnumWindowsProc(HWND hwnd, LPARAM lParam)
+{
+    PROCESS_AND_MESSAGE* pPM = reinterpret_cast<PROCESS_AND_MESSAGE*>(lParam);
+    DWORD dwProcessId = 0;
+    DWORD_PTR dwResult = 0;
+    BOOL fQueryEndSession = WM_QUERYENDSESSION == pPM->dwMessageId;
+    BOOL fContinueWindowsInProcess = TRUE; // assume we will send message to all top-level windows in a process.
+
+    ::GetWindowThreadProcessId(hwnd, &dwProcessId);
+
+    // check if the process Id is the one we're looking for
+    if (dwProcessId != pPM->dwProcessId)
+    {
+        return TRUE;
+    }
+
+    WcaLog(LOGMSG_VERBOSE, "Sending message to process id 0x%x", dwProcessId);
+
+    if (::SendMessageTimeoutW(hwnd, pPM->dwMessageId, 0, fQueryEndSession ? ENDSESSION_CLOSEAPP : 0, SMTO_BLOCK, pPM->dwTimeout, &dwResult))
+    {
+        WcaLog(LOGMSG_VERBOSE, "Result 0x%x", dwResult);
+
+        if (fQueryEndSession)
+        {
+            // If application said it was okay to close, do that.
+            if (dwResult)
+            {
+                ::SendMessageTimeoutW(hwnd, WM_ENDSESSION, TRUE, ENDSESSION_CLOSEAPP, SMTO_BLOCK, pPM->dwTimeout, &dwResult);
+            }
+            else // application said don't try to close it, so don't bother sending messages to any other top-level windows.
+            {
+                fContinueWindowsInProcess = FALSE;
+            }
+        }
+    }
+    else // log result message.
+    {
+        WcaLog(LOGMSG_VERBOSE, "Failed to send message id: %u, error: 0x%x", pPM->dwMessageId, ::GetLastError());
+    }
+
+    // so we know we succeeded
+    ::SetLastError(ERROR_SUCCESS);
+
+    return fContinueWindowsInProcess;
+}
+
+/******************************************************************
+ PromptToContinue - displays the prompt if the application is still
+  running.
+
+******************************************************************/
+static HRESULT PromptToContinue(
+    __in_z LPCWSTR wzApplication,
+    __in_z LPCWSTR wzPrompt
+    )
+{
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+    PMSIHANDLE hRecMessage = NULL;
+    DWORD *prgProcessIds = NULL;
+    DWORD cProcessIds = 0;
+
+    hRecMessage = ::MsiCreateRecord(1);
+    ExitOnNull(hRecMessage, hr, E_OUTOFMEMORY, "Failed to create record for prompt.");
+
+    er = ::MsiRecordSetStringW(hRecMessage, 0, wzPrompt);
+    ExitOnWin32Error(er, hr, "Failed to set prompt record field string");
+
+    do
+    {
+        hr = ProcFindAllIdsFromExeName(wzApplication, &prgProcessIds, &cProcessIds);
+        if (SUCCEEDED(hr) && 0 < cProcessIds)
+        {
+            er = WcaProcessMessage(static_cast<INSTALLMESSAGE>(INSTALLMESSAGE_WARNING | MB_ABORTRETRYIGNORE | MB_DEFBUTTON3 | MB_ICONWARNING), hRecMessage);
+            if (IDABORT == er)
+            {
+                hr = HRESULT_FROM_WIN32(ERROR_INSTALL_USEREXIT);
+            }
+            else if (IDRETRY == er)
+            {
+                hr = S_FALSE;
+            }
+            else if (IDIGNORE == er)
+            {
+                hr = S_OK;
+            }
+            else
+            {
+                ExitOnWin32Error(er, hr, "Unexpected return value from prompt to continue.");
+            }
+        }
+
+        ReleaseNullMem(prgProcessIds);
+        cProcessIds = 0;
+    } while (S_FALSE == hr);
+
+LExit:
+    ReleaseMem(prgProcessIds);
+    return hr;
+}
+
+/******************************************************************
+ SendProcessMessage - helper function to enumerate the top-level 
+ windows and send to all matching a process ID.
+
+******************************************************************/
+void SendProcessMessage(
+    __in DWORD dwProcessId,
+    __in DWORD dwMessageId,
+    __in DWORD dwTimeout
+    )
+{
+    WcaLog(LOGMSG_VERBOSE, "Attempting to send process id 0x%x message id: %u", dwProcessId, dwMessageId);
+
+    PROCESS_AND_MESSAGE pm = { };
+    pm.dwProcessId = dwProcessId;
+    pm.dwMessageId = dwMessageId;
+    pm.dwTimeout = dwTimeout;
+
+    if (!::EnumWindows(EnumWindowsProc, reinterpret_cast<LPARAM>(&pm)))
+    {
+        DWORD dwLastError = ::GetLastError();
+        if (ERROR_SUCCESS != dwLastError)
+        {
+            WcaLog(LOGMSG_VERBOSE, "CloseApp enumeration error: 0x%x", dwLastError);
+        }
+    }
+}
+
+/******************************************************************
+ SendApplicationMessage - helper function to iterate through the 
+ processes for the specified application and send all
+ applicable process Ids a message and give them time to process
+ the message.
+
+******************************************************************/
+void SendApplicationMessage(
+    __in LPCWSTR wzApplication,
+    __in DWORD dwMessageId,
+    __in DWORD dwTimeout
+    )
+{
+    DWORD *prgProcessIds = NULL;
+    DWORD cProcessIds = 0, iProcessId;
+    HRESULT hr = S_OK;
+
+    WcaLog(LOGMSG_VERBOSE, "Checking App: %ls ", wzApplication);
+
+    hr = ProcFindAllIdsFromExeName(wzApplication, &prgProcessIds, &cProcessIds);
+
+    if (SUCCEEDED(hr) && 0 < cProcessIds)
+    {
+        WcaLog(LOGMSG_VERBOSE, "App: %ls found running, %d processes, attempting to send message.", wzApplication, cProcessIds);
+
+        for (iProcessId = 0; iProcessId < cProcessIds; ++iProcessId)
+        {
+            SendProcessMessage(prgProcessIds[iProcessId], dwMessageId, dwTimeout);
+        }
+
+        ProcWaitForIds(prgProcessIds, cProcessIds, dwTimeout);
+    }
+
+    ReleaseMem(prgProcessIds);
+}
+
+/******************************************************************
+ SetRunningProcessProperty - helper function that sets the specified
+ property if there are any instances of the specified executable
+ running. Useful to show custom UI to ask for shutdown.
+******************************************************************/
+void SetRunningProcessProperty(
+    __in LPCWSTR wzApplication,
+    __in LPCWSTR wzProperty
+    )
+{
+    DWORD *prgProcessIds = NULL;
+    DWORD cProcessIds = 0;
+    HRESULT hr = S_OK;
+
+    WcaLog(LOGMSG_VERBOSE, "Checking App: %ls ", wzApplication);
+
+    hr = ProcFindAllIdsFromExeName(wzApplication, &prgProcessIds, &cProcessIds);
+
+    if (SUCCEEDED(hr) && 0 < cProcessIds)
+    {
+        WcaLog(LOGMSG_VERBOSE, "App: %ls found running, %d processes, setting '%ls' property.", wzApplication, cProcessIds, wzProperty);
+        WcaSetIntProperty(wzProperty, cProcessIds);
+    }
+
+    ReleaseMem(prgProcessIds);
+}
+
+/******************************************************************
+ TerminateProcesses - helper function that kills the provided set of
+ process ids such that they return a particular exit code.
+******************************************************************/
+void TerminateProcesses(
+    __in_ecount(cProcessIds) DWORD rgdwProcessIds[],
+    __in DWORD cProcessIds,
+    __in DWORD dwExitCode
+    )
+{
+    for (DWORD i = 0; i < cProcessIds; ++i)
+    {
+        HANDLE hProcess = ::OpenProcess(PROCESS_TERMINATE, FALSE, rgdwProcessIds[i]);
+        if (hProcess)
+        {
+            ::TerminateProcess(hProcess, dwExitCode);
+            ::CloseHandle(hProcess);
+        }
+    }
+}
+
+/******************************************************************
+ WixCloseApplications - entry point for WixCloseApplications Custom Action
+
+ called as Type 1 CustomAction (binary DLL) from Windows Installer 
+ in InstallExecuteSequence before InstallFiles
+******************************************************************/
+extern "C" UINT __stdcall WixCloseApplications(
+    __in MSIHANDLE hInstall
+    )
+{
+    //AssertSz(FALSE, "debug WixCloseApplications");
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    LPWSTR pwzData = NULL;
+    LPWSTR pwzId = NULL;
+    LPWSTR pwzTarget = NULL;
+    LPWSTR pwzDescription = NULL;
+    LPWSTR pwzCondition = NULL;
+    LPWSTR pwzProperty = NULL;
+    DWORD dwAttributes = 0;
+    DWORD dwTimeout = 0;
+    DWORD dwTerminateExitCode = 0;
+    MSICONDITION condition = MSICONDITION_NONE;
+
+    DWORD cCloseApps = 0;
+
+    PMSIHANDLE hView = NULL;
+    PMSIHANDLE hRec = NULL;
+    MSIHANDLE hListboxTable = NULL;
+    MSIHANDLE hListboxColumns = NULL;
+
+    LPWSTR pwzCustomActionData = NULL;
+    //DWORD cchCustomActionData = 0;
+
+    //
+    // initialize
+    //
+    hr = WcaInitialize(hInstall, "WixCloseApplications");
+    ExitOnFailure(hr, "failed to initialize");
+
+    //
+    // loop through all the objects to be secured
+    //
+    hr = WcaOpenExecuteView(wzQUERY_CLOSEAPPS, &hView);
+    ExitOnFailure(hr, "failed to open view on Wix4CloseApplication table");
+    while (S_OK == (hr = WcaFetchRecord(hView, &hRec)))
+    {
+        hr = WcaGetRecordString(hRec, QCA_ID, &pwzId);
+        ExitOnFailure(hr, "failed to get id from Wix4CloseApplication table");
+
+        hr = WcaGetRecordString(hRec, QCA_CONDITION, &pwzCondition);
+        ExitOnFailure(hr, "failed to get condition from Wix4CloseApplication table");
+
+        if (pwzCondition && *pwzCondition)
+        {
+            condition = ::MsiEvaluateConditionW(hInstall, pwzCondition);
+            if (MSICONDITION_ERROR == condition)
+            {
+                hr = E_INVALIDARG;
+                ExitOnFailure(hr, "failed to process condition for Wix4CloseApplication '%ls'", pwzId);
+            }
+            else if (MSICONDITION_FALSE == condition)
+            {
+                continue; // skip processing this target
+            }
+        }
+
+        hr = WcaGetRecordFormattedString(hRec, QCA_TARGET, &pwzTarget);
+        ExitOnFailure(hr, "failed to get target from Wix4CloseApplication table");
+
+        hr = WcaGetRecordFormattedString(hRec, QCA_DESCRIPTION, &pwzDescription);
+        ExitOnFailure(hr, "failed to get description from Wix4CloseApplication table");
+
+        hr = WcaGetRecordInteger(hRec, QCA_ATTRIBUTES, reinterpret_cast<int*>(&dwAttributes));
+        ExitOnFailure(hr, "failed to get attributes from Wix4CloseApplication table");
+
+        hr = WcaGetRecordFormattedString(hRec, QCA_PROPERTY, &pwzProperty);
+        ExitOnFailure(hr, "failed to get property from Wix4CloseApplication table");
+
+        hr = WcaGetRecordInteger(hRec, QCA_TERMINATEEXITCODE, reinterpret_cast<int*>(&dwTerminateExitCode));
+        if (S_FALSE == hr)
+        {
+            dwTerminateExitCode = 0;
+            hr = S_OK;
+        }
+        ExitOnFailure(hr, "failed to get terminate exit-code from Wix4CloseApplication table");
+
+        hr = WcaGetRecordInteger(hRec, QCA_TIMEOUT, reinterpret_cast<int*>(&dwTimeout));
+        if (S_FALSE == hr)
+        {
+            dwTimeout = DEFAULT_PROCESS_EXIT_WAIT_TIME;
+            hr = S_OK;
+        }
+        ExitOnFailure(hr, "failed to get timeout from Wix4CloseApplication table");
+
+        // Before trying any changes to the machine, prompt if requested.
+        if (dwAttributes & CLOSEAPP_ATTRIBUTE_PROMPTTOCONTINUE)
+        {
+            hr = PromptToContinue(pwzTarget, pwzDescription ? pwzDescription : L"");
+            if (HRESULT_FROM_WIN32(ERROR_INSTALL_USEREXIT) == hr)
+            {
+                // Skip error message if user canceled.
+                ExitFunction();
+            }
+            ExitOnFailure(hr, "Failure while prompting user to continue to close application.");
+        }
+
+        //
+        // send WM_CLOSE or WM_QUERYENDSESSION to currently running applications
+        //
+        if (dwAttributes & CLOSEAPP_ATTRIBUTE_CLOSEMESSAGE)
+        {
+            SendApplicationMessage(pwzTarget, WM_CLOSE, dwTimeout);
+        }
+
+        if (dwAttributes & CLOSEAPP_ATTRIBUTE_ENDSESSIONMESSAGE)
+        {
+            SendApplicationMessage(pwzTarget, WM_QUERYENDSESSION, dwTimeout);
+        }
+
+        //
+        // Pass the targets to the deferred action in case the app comes back
+        // even if we close it now.
+        //
+        if (dwAttributes & (CLOSEAPP_ATTRIBUTE_ELEVATEDCLOSEMESSAGE | CLOSEAPP_ATTRIBUTE_ELEVATEDENDSESSIONMESSAGE | CLOSEAPP_ATTRIBUTE_REBOOTPROMPT | CLOSEAPP_ATTRIBUTE_TERMINATEPROCESS))
+        {
+            hr = WcaWriteStringToCaData(pwzTarget, &pwzCustomActionData);
+            ExitOnFailure(hr, "failed to add target data to CustomActionData");
+
+            hr = WcaWriteIntegerToCaData(dwAttributes, &pwzCustomActionData);
+            ExitOnFailure(hr, "failed to add attribute data to CustomActionData");
+
+            hr = WcaWriteIntegerToCaData(dwTimeout, &pwzCustomActionData);
+            ExitOnFailure(hr, "failed to add timeout data to CustomActionData");
+
+            hr = WcaWriteIntegerToCaData(dwTerminateExitCode, &pwzCustomActionData);
+            ExitOnFailure(hr, "failed to add timeout data to CustomActionData");
+        }
+
+        if (pwzProperty && *pwzProperty)
+        {
+            SetRunningProcessProperty(pwzTarget, pwzProperty);
+        }
+
+        ++cCloseApps;
+    }
+
+    // if we looped through all records all is well
+    if (E_NOMOREITEMS == hr)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "failed while looping through all apps to close");
+
+    //
+    // Do the UI dance now.
+    //
+    /*
+
+    TODO: Do this eventually
+
+    if (cCloseApps)
+    {
+        while (TRUE)
+        {
+            for (DWORD i = 0; i < cCloseApps; ++i)
+            {
+                hr = WcaAddTempRecord(&hListboxTable, &hListboxColumns, L"ListBox", NULL, 0, 4, L"FileInUseProcess", i, target, description);
+                if (FAILED(hr))
+                {
+                }
+            }
+        }
+    }
+    */
+
+    //
+    // schedule the custom action and add to progress bar
+    //
+    if (pwzCustomActionData && *pwzCustomActionData)
+    {
+        Assert(0 < cCloseApps);
+
+        hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"CloseApplicationsDeferred"), pwzCustomActionData, cCloseApps * COST_CLOSEAPP);
+        ExitOnFailure(hr, "failed to schedule CloseApplicationsDeferred action");
+    }
+
+LExit:
+    if (hListboxColumns)
+    {
+        ::MsiCloseHandle(hListboxColumns);
+    }
+    if (hListboxTable)
+    {
+        ::MsiCloseHandle(hListboxTable);
+    }
+
+    ReleaseStr(pwzCustomActionData);
+    ReleaseStr(pwzData);
+    ReleaseStr(pwzProperty);
+    ReleaseStr(pwzCondition);
+    ReleaseStr(pwzDescription);
+    ReleaseStr(pwzTarget);
+    ReleaseStr(pwzId);
+
+    if (FAILED(hr))
+    {
+        er = HRESULT_FROM_WIN32(ERROR_INSTALL_USEREXIT) == hr ? ERROR_INSTALL_USEREXIT : ERROR_INSTALL_FAILURE;
+    }
+    return WcaFinalize(er);
+}
+
+
+/******************************************************************
+ WixCloseApplicationsDeferred - entry point for 
+                                WixCloseApplicationsDeferred Custom Action
+                                called as Type 1025 CustomAction 
+                                (deferred binary DLL)
+
+ NOTE: deferred CustomAction since it modifies the machine
+ NOTE: CustomActionData == wzTarget\tdwAttributes\tdwTimeout\tdwTerminateExitCode\t...
+******************************************************************/
+extern "C" UINT __stdcall WixCloseApplicationsDeferred(
+    __in MSIHANDLE hInstall
+    )
+{
+    //AssertSz(FALSE, "debug WixCloseApplicationsDeferred");
+    HRESULT hr = S_OK;
+    DWORD er = ERROR_SUCCESS;
+
+    LPWSTR pwz = NULL;
+    LPWSTR pwzData = NULL;
+    LPWSTR pwzTarget = NULL;
+    DWORD dwAttributes = 0;
+    DWORD dwTimeout = 0;
+    DWORD dwTerminateExitCode = 0;
+
+    DWORD *prgProcessIds = NULL;
+    DWORD cProcessIds = 0;
+
+    //
+    // initialize
+    //
+    hr = WcaInitialize(hInstall, "WixCloseApplicationsDeferred");
+    ExitOnFailure(hr, "failed to initialize");
+
+    hr = WcaGetProperty(L"CustomActionData", &pwzData);
+    ExitOnFailure(hr, "failed to get CustomActionData");
+
+    WcaLog(LOGMSG_TRACEONLY, "CustomActionData: %ls", pwzData);
+
+    pwz = pwzData;
+
+    //
+    // loop through all the passed in data
+    //
+    while (pwz && *pwz)
+    {
+        hr = WcaReadStringFromCaData(&pwz, &pwzTarget);
+        ExitOnFailure(hr, "failed to process target from CustomActionData");
+
+        hr = WcaReadIntegerFromCaData(&pwz, reinterpret_cast<int*>(&dwAttributes));
+        ExitOnFailure(hr, "failed to process attributes from CustomActionData");
+
+        hr = WcaReadIntegerFromCaData(&pwz, reinterpret_cast<int*>(&dwTimeout));
+        ExitOnFailure(hr, "failed to process timeout from CustomActionData");
+
+        hr = WcaReadIntegerFromCaData(&pwz, reinterpret_cast<int*>(&dwTerminateExitCode));
+        ExitOnFailure(hr, "failed to process terminate exit code from CustomActionData");
+
+        WcaLog(LOGMSG_VERBOSE, "Checking for App: %ls Attributes: %d", pwzTarget, dwAttributes);
+
+        //
+        // send WM_CLOSE or WM_QUERYENDSESSION to currently running applications
+        //
+        if (dwAttributes & CLOSEAPP_ATTRIBUTE_ELEVATEDCLOSEMESSAGE)
+        {
+            SendApplicationMessage(pwzTarget, WM_CLOSE, dwTimeout);
+        }
+
+        if (dwAttributes & CLOSEAPP_ATTRIBUTE_ELEVATEDENDSESSIONMESSAGE)
+        {
+            SendApplicationMessage(pwzTarget, WM_QUERYENDSESSION, dwTimeout);
+        }
+
+        // If we find that an app that we need closed is still runing, require a
+        // restart or kill the process as directed.
+        ProcFindAllIdsFromExeName(pwzTarget, &prgProcessIds, &cProcessIds);
+        if (0 < cProcessIds)
+        {
+            if (dwAttributes & CLOSEAPP_ATTRIBUTE_REBOOTPROMPT)
+            {
+                WcaLog(LOGMSG_VERBOSE, "App: %ls found running, requiring a reboot.", pwzTarget);
+
+                WcaDeferredActionRequiresReboot();
+            }
+            else if (dwAttributes & CLOSEAPP_ATTRIBUTE_TERMINATEPROCESS)
+            {
+                TerminateProcesses(prgProcessIds, cProcessIds, dwTerminateExitCode);
+            }
+        }
+
+        hr = WcaProgressMessage(COST_CLOSEAPP, FALSE);
+        ExitOnFailure(hr, "failed to send progress message");
+    }
+
+LExit:
+    ReleaseMem(prgProcessIds);
+
+    ReleaseStr(pwzTarget);
+    ReleaseStr(pwzData);
+
+    if (FAILED(hr))
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+    return WcaFinalize(er);
+}
diff --git a/src/ext/Util/ca/CustomMsiErrors.h b/src/ext/Util/ca/CustomMsiErrors.h
new file mode 100644
index 00000000..3218b61b
--- /dev/null
+++ b/src/ext/Util/ca/CustomMsiErrors.h
@@ -0,0 +1,32 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+#define msierrSecureObjectsFailedCreateSD    25520
+#define msierrSecureObjectsFailedSet         25521
+#define msierrSecureObjectsUnknownType       25522
+
+#define msierrXmlFileFailedRead         25530
+#define msierrXmlFileFailedOpen         25531
+#define msierrXmlFileFailedSelect       25532
+#define msierrXmlFileFailedSave         25533
+
+#define msierrXmlConfigFailedRead         25540
+#define msierrXmlConfigFailedOpen         25541
+#define msierrXmlConfigFailedSelect       25542
+#define msierrXmlConfigFailedSave         25543
+
+#define msierrPERFMONFailedRegisterDLL         26251
+#define msierrPERFMONFailedUnregisterDLL       26252
+#define msierrInstallPerfCounterData           26253
+#define msierrUninstallPerfCounterData         26254
+
+#define msierrSMBFailedCreate                  26301
+#define msierrSMBFailedDrop                    26302
+#define msierrUSRFailedUserCreate              26401
+#define msierrUSRFailedUserCreatePswd          26402
+#define msierrUSRFailedUserGroupAdd            26403
+#define msierrUSRFailedUserCreateExists        26404
+#define msierrUSRFailedGrantLogonAsService     26405
+
+//Last available is 26450
\ No newline at end of file
diff --git a/src/ext/Util/ca/FormatFiles.cpp b/src/ext/Util/ca/FormatFiles.cpp
new file mode 100644
index 00000000..d1533999
--- /dev/null
+++ b/src/ext/Util/ca/FormatFiles.cpp
@@ -0,0 +1,221 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+const UINT COST_FILEFORMATTING = 2000;
+
+
+//
+// WixSchedFormatFiles - immediate CA to schedule format files CAs
+//
+extern "C" UINT __stdcall WixSchedFormatFiles(
+    __in MSIHANDLE hInstall
+    )
+{
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+    PSCZ sczBinaryKey;
+    PSCZ sczFileKey;
+    PSCZ sczComponentKey;
+    PSCZ sczFormattedFile;
+    PSCZ sczFilePath;
+    PMSIHANDLE hView;
+    PMSIHANDLE hRec;
+    PSCZ sczFileContent;
+    PSCZ sczFormattedContent;
+    PSCZ sczExecCustomActionData;
+    PSCZ sczRollbackCustomActionData;
+
+    LPCWSTR wzQuery =
+        L"SELECT `Wix4FormatFile`.`Binary_`, `Wix4FormatFile`.`File_`, `File`.`Component_` "
+        L"FROM `Wix4FormatFile`, `File` "
+        L"WHERE `Wix4FormatFile`.`File_` = `File`.`File`";
+    enum eQuery { eqBinaryKey = 1, eqFileKey, eqComponentKey };
+
+    // initialize
+    hr = WcaInitialize(hInstall, "WixSchedFormatFiles");
+    ExitOnFailure(hr, "Failed to initialize for WixSchedFormatFiles.");
+
+    // query and loop through all the files
+    hr = WcaOpenExecuteView(wzQuery, &hView);
+    ExitOnFailure(hr, "Failed to open view on Wix4FormatFile table");
+
+    DWORD cFiles = 0;
+    while (S_OK == (hr = WcaFetchRecord(hView, &hRec)))
+    {
+        ++cFiles;
+
+        hr = WcaGetRecordString(hRec, eqBinaryKey, &sczBinaryKey);
+        ExitOnFailure(hr, "Failed to get Binary table key.");
+
+        hr = WcaGetRecordString(hRec, eqFileKey, &sczFileKey);
+        ExitOnFailure(hr, "Failed to get File table key.");
+
+        hr = WcaGetRecordString(hRec, eqComponentKey, &sczComponentKey);
+        ExitOnFailure(hr, "Failed to get Component table key.");
+
+        // we need to know if the component's being installed, uninstalled, or reinstalled
+        WCA_TODO todo = WcaGetComponentToDo(sczComponentKey);
+        if (WCA_TODO_INSTALL == todo || WCA_TODO_REINSTALL == todo)
+        {
+            // turn the file key into the path to the target file
+            hr = StrAllocFormatted(&sczFormattedFile, L"[#%ls]", sczFileKey);
+            ExitOnFailure(hr, "Failed to format file string for file: %ls", sczFileKey);
+            hr = WcaGetFormattedString(sczFormattedFile, &sczFilePath);
+            ExitOnFailure(hr, "Failed to get path for file: %ls", sczFileKey);
+
+            // extract binary to string
+            WCA_ENCODING encoding = WCA_ENCODING_UNKNOWN;
+            hr = WcaExtractBinaryToString(sczBinaryKey, &sczFileContent, &encoding);
+            ExitOnFailure(hr, "Failed to extract binary: %ls", sczBinaryKey);
+
+            // format string
+            hr = WcaGetFormattedString(sczFileContent, &sczFormattedContent);
+            ExitOnFailure(hr, "Failed to format file content: %ls", sczFileContent);
+
+            // write to deferred custom action data
+            hr = WcaWriteStringToCaData(sczFilePath, &sczExecCustomActionData);
+            ExitOnFailure(hr, "Failed to write deferred custom action data for file: %ls", sczFilePath);
+
+            hr = WcaWriteIntegerToCaData(encoding, &sczExecCustomActionData);
+            ExitOnFailure(hr, "Failed to write deferred custom action data for encoding: %d", encoding);
+
+            hr = WcaWriteStringToCaData(sczFormattedContent, &sczExecCustomActionData);
+            ExitOnFailure(hr, "Failed to write deferred custom action data for file content: %ls", sczFilePath);
+
+            // write to rollback custom action data
+            hr = WcaWriteStringToCaData(sczFilePath, &sczRollbackCustomActionData);
+            ExitOnFailure(hr, "Failed to write rollback custom action data for file: %ls", sczFilePath);
+
+            hr = WcaWriteIntegerToCaData(encoding, &sczRollbackCustomActionData);
+            ExitOnFailure(hr, "Failed to write deferred custom action data for encoding: %d", encoding);
+
+            hr = WcaWriteStringToCaData(sczFileContent, &sczRollbackCustomActionData);
+            ExitOnFailure(hr, "Failed to write rollback custom action data for file content: %ls", sczFilePath);
+        }
+    }
+
+    // reaching the end of the list is actually a good thing, not an error
+    if (E_NOMOREITEMS == hr)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "Failure occurred while processing Wix4FormatFile table");
+
+    // schedule deferred CAs if there's anything to do
+    if (sczRollbackCustomActionData && *sczRollbackCustomActionData)
+    {
+        hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"RollbackFormatFiles"), sczRollbackCustomActionData, cFiles * COST_FILEFORMATTING);
+        ExitOnFailure(hr, "Failed to schedule RollbackFormatFiles");
+    }
+
+    if (sczExecCustomActionData && *sczExecCustomActionData)
+    {
+        hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"ExecFormatFiles"), sczExecCustomActionData, cFiles * COST_FILEFORMATTING);
+        ExitOnFailure(hr, "Failed to schedule ExecFormatFiles");
+    }
+
+LExit:
+    return WcaFinalize(er = FAILED(hr) ? ERROR_INSTALL_FAILURE : er);
+}
+
+
+//
+// WixExecFormatFiles - deferred and rollback CAs to write formatted files
+//
+extern "C" UINT __stdcall WixExecFormatFiles(
+    __in MSIHANDLE hInstall
+    )
+{
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+    PSCZ sczCustomActionData;
+    LPWSTR pwz = NULL;
+    PSCZ sczFilePath;
+    PSCZ sczFileContent;
+    LPSTR psz = NULL;
+
+    // initialize
+    hr = WcaInitialize(hInstall, "WixExecFormatFiles");
+    ExitOnFailure(hr, "Failed to initialize for WixExecFormatFiles.");
+
+    hr = WcaGetProperty(L"CustomActionData", &sczCustomActionData);
+    ExitOnFailure(hr, "Failed to get CustomActionData.");
+#ifdef _DEBUG
+    WcaLog(LOGMSG_STANDARD, "CustomActionData: %ls", sczCustomActionData);
+#endif
+
+    // loop through all the passed in data
+    pwz = sczCustomActionData;
+    while (pwz && *pwz)
+    {
+        // extract the custom action data
+        hr = WcaReadStringFromCaData(&pwz, &sczFilePath);
+        ExitOnFailure(hr, "Failed to read file path from custom action data");
+
+        WCA_ENCODING encoding = WCA_ENCODING_UNKNOWN;
+        hr = WcaReadIntegerFromCaData(&pwz, reinterpret_cast<int*>(&encoding));
+        ExitOnFailure(hr, "Failed to read encoding from custom action data");
+
+        hr = WcaReadStringFromCaData(&pwz, &sczFileContent);
+        ExitOnFailure(hr, "Failed to read file content from custom action data");
+
+        // re-encode content
+        LPCBYTE pbData = NULL;
+        size_t cbData = 0;
+        switch (encoding)
+        {
+        case WCA_ENCODING_UTF_16:
+            pbData = reinterpret_cast<LPCBYTE>(LPCWSTR(sczFileContent));
+            cbData = lstrlenW(sczFileContent) * sizeof(WCHAR);
+            break;
+
+        case WCA_ENCODING_UTF_8:
+            hr = StrAnsiAllocString(&psz, sczFileContent, 0, CP_UTF8);
+            ExitOnFailure(hr, "Failed to convert Unicode to UTF-8.");
+            pbData = reinterpret_cast<LPCBYTE>(psz);
+
+            hr = ::StringCbLengthA(psz, STRSAFE_MAX_CCH, &cbData);
+            ExitOnFailure(hr, "Failed to count UTF-8 bytes.");
+            break;
+
+        case WCA_ENCODING_ANSI:
+            hr = StrAnsiAllocString(&psz, sczFileContent, 0, CP_ACP);
+            ExitOnFailure(hr, "Failed to convert Unicode to ANSI.");
+            pbData = reinterpret_cast<LPCBYTE>(psz);
+
+            hr = ::StringCbLengthA(psz, STRSAFE_MAX_CCH, &cbData);
+            ExitOnFailure(hr, "Failed to count UTF-8 bytes.");
+            break;
+
+        default:
+            break;
+        }
+
+#ifdef _DEBUG
+        WcaLog(LOGMSG_STANDARD, "File: %ls", sczCustomActionData);
+        WcaLog(LOGMSG_STANDARD, "Content: %ls", sczFileContent);
+#endif
+
+        // write file and preserve modified time
+        FILETIME filetime;
+
+        hr = FileGetTime(sczFilePath, NULL, NULL, &filetime);
+        ExitOnFailure(hr, "Failed to get modified time of file : %ls", sczFilePath);
+
+        hr = FileWrite(sczFilePath, FILE_ATTRIBUTE_NORMAL, pbData, cbData, NULL);
+        ExitOnFailure(hr, "Failed to write file content: %ls", sczFilePath);
+
+        hr = FileSetTime(sczFilePath, NULL, NULL, &filetime);
+        ExitOnFailure(hr, "Failed to set modified time of file : %ls", sczFilePath);
+
+        // Tick the progress bar
+        hr = WcaProgressMessage(COST_FILEFORMATTING, FALSE);
+        ExitOnFailure(hr, "Failed to tick progress bar for file: %ls", sczFilePath);
+    }
+
+LExit:
+    ReleaseStr(psz);
+
+    return WcaFinalize(er = FAILED(hr) ? ERROR_INSTALL_FAILURE : er);
+}
diff --git a/src/ext/Util/ca/OsInfo.cpp b/src/ext/Util/ca/OsInfo.cpp
new file mode 100644
index 00000000..4783673e
--- /dev/null
+++ b/src/ext/Util/ca/OsInfo.cpp
@@ -0,0 +1,487 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+// constants we'll pick up from later SDKs
+#define SM_TABLETPC    86
+#define SM_MEDIACENTER 87
+#define SM_STARTER     88
+#define SM_SERVERR2    89
+#define VER_SUITE_WH_SERVER 0x00008000
+
+/********************************************************************
+WixQueryOsInfo - entry point for WixQueryOsInfo custom action
+
+ Called as Type 1 custom action (DLL from the Binary table) from 
+ Windows Installer to set properties that identify OS information 
+ and predefined directories
+********************************************************************/
+extern "C" UINT __stdcall WixQueryOsInfo(
+    __in MSIHANDLE hInstall
+    )
+{
+    HRESULT hr = S_OK;
+    DWORD er = ERROR_SUCCESS;
+    OSVERSIONINFOEXW ovix = {0};
+
+    hr = WcaInitialize(hInstall, "WixQueryOsInfo");
+    ExitOnFailure(hr, "WixQueryOsInfo failed to initialize");
+
+    // identify product suites
+    ovix.dwOSVersionInfoSize = sizeof(OSVERSIONINFOEXW);
+    #pragma warning(suppress: 4996) //TODO: use osutil
+    ::GetVersionExW(reinterpret_cast<LPOSVERSIONINFOW>(&ovix));
+
+    if (VER_SUITE_SMALLBUSINESS == (ovix.wSuiteMask & VER_SUITE_SMALLBUSINESS))
+    {
+        WcaSetIntProperty(L"WIX_SUITE_SMALLBUSINESS", 1);
+    }
+
+    if (VER_SUITE_ENTERPRISE == (ovix.wSuiteMask & VER_SUITE_ENTERPRISE))
+    {
+        WcaSetIntProperty(L"WIX_SUITE_ENTERPRISE", 1);
+    }
+
+    if (VER_SUITE_BACKOFFICE == (ovix.wSuiteMask & VER_SUITE_BACKOFFICE))
+    {
+        WcaSetIntProperty(L"WIX_SUITE_BACKOFFICE", 1);
+    }
+
+    if (VER_SUITE_COMMUNICATIONS == (ovix.wSuiteMask & VER_SUITE_COMMUNICATIONS))
+    {
+        WcaSetIntProperty(L"WIX_SUITE_COMMUNICATIONS", 1);
+    }
+
+    if (VER_SUITE_TERMINAL == (ovix.wSuiteMask & VER_SUITE_TERMINAL))
+    {
+        WcaSetIntProperty(L"WIX_SUITE_TERMINAL", 1);
+    }
+
+    if (VER_SUITE_SMALLBUSINESS_RESTRICTED == (ovix.wSuiteMask & VER_SUITE_SMALLBUSINESS_RESTRICTED))
+    {
+        WcaSetIntProperty(L"WIX_SUITE_SMALLBUSINESS_RESTRICTED", 1);
+    }
+
+    if (VER_SUITE_EMBEDDEDNT == (ovix.wSuiteMask & VER_SUITE_EMBEDDEDNT))
+    {
+        WcaSetIntProperty(L"WIX_SUITE_EMBEDDEDNT", 1);
+    }
+
+    if (VER_SUITE_DATACENTER == (ovix.wSuiteMask & VER_SUITE_DATACENTER))
+    {
+        WcaSetIntProperty(L"WIX_SUITE_DATACENTER", 1);
+    }
+
+    if (VER_SUITE_SINGLEUSERTS == (ovix.wSuiteMask & VER_SUITE_SINGLEUSERTS))
+    {
+        WcaSetIntProperty(L"WIX_SUITE_SINGLEUSERTS", 1);
+    }
+
+    if (VER_SUITE_PERSONAL == (ovix.wSuiteMask & VER_SUITE_PERSONAL))
+    {
+        WcaSetIntProperty(L"WIX_SUITE_PERSONAL", 1);
+    }
+
+    if (VER_SUITE_BLADE == (ovix.wSuiteMask & VER_SUITE_BLADE))
+    {
+        WcaSetIntProperty(L"WIX_SUITE_BLADE", 1);
+    }
+
+    if (VER_SUITE_EMBEDDED_RESTRICTED == (ovix.wSuiteMask & VER_SUITE_EMBEDDED_RESTRICTED))
+    {
+        WcaSetIntProperty(L"WIX_SUITE_EMBEDDED_RESTRICTED", 1);
+    }
+
+    if (VER_SUITE_SECURITY_APPLIANCE == (ovix.wSuiteMask & VER_SUITE_SECURITY_APPLIANCE))
+    {
+        WcaSetIntProperty(L"WIX_SUITE_SECURITY_APPLIANCE", 1);
+    }
+
+    if (VER_SUITE_STORAGE_SERVER == (ovix.wSuiteMask & VER_SUITE_STORAGE_SERVER))
+    {
+        WcaSetIntProperty(L"WIX_SUITE_STORAGE_SERVER", 1);
+    }
+
+    if (VER_SUITE_COMPUTE_SERVER == (ovix.wSuiteMask & VER_SUITE_COMPUTE_SERVER))
+    {
+        WcaSetIntProperty(L"WIX_SUITE_COMPUTE_SERVER", 1);
+    }
+
+    if (VER_SUITE_WH_SERVER == (ovix.wSuiteMask & VER_SUITE_WH_SERVER))
+    {
+        WcaSetIntProperty(L"WIX_SUITE_WH_SERVER", 1);
+    }
+
+    // only for XP and later
+    if (5 < ovix.dwMajorVersion || (5 == ovix.dwMajorVersion && 0 < ovix.dwMinorVersion))
+    {
+        if (::GetSystemMetrics(SM_SERVERR2))
+        {
+            WcaSetIntProperty(L"WIX_SUITE_SERVERR2", 1);
+        }
+
+        if (::GetSystemMetrics(SM_MEDIACENTER))
+        {
+            WcaSetIntProperty(L"WIX_SUITE_MEDIACENTER", 1);
+        }
+
+        if (::GetSystemMetrics(SM_STARTER))
+        {
+            WcaSetIntProperty(L"WIX_SUITE_STARTER", 1);
+        }
+
+        if (::GetSystemMetrics(SM_TABLETPC))
+        {
+            WcaSetIntProperty(L"WIX_SUITE_TABLETPC", 1);
+        }
+    }
+
+LExit:
+    if (FAILED(hr))
+        er = ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+/********************************************************************
+WixQueryOsDirs - entry point for WixQueryOsDirs custom action
+
+ Called as Type 1 custom action (DLL from the Binary table) from 
+ Windows Installer to set properties that identify predefined directories
+********************************************************************/
+extern "C" UINT __stdcall WixQueryOsDirs(
+    __in MSIHANDLE hInstall
+    )
+{
+    HRESULT hr = S_OK;
+    DWORD er = ERROR_SUCCESS;
+
+    hr = WcaInitialize(hInstall, "WixQueryOsDirs");
+    ExitOnFailure(hr, "WixQueryOsDirs failed to initialize");
+
+    // get the paths of the CSIDLs that represent real paths and for which MSI
+    // doesn't yet have standard folder properties
+    WCHAR path[MAX_PATH];
+    if (ERROR_SUCCESS == ::SHGetFolderPathW(NULL, CSIDL_ADMINTOOLS, NULL, SHGFP_TYPE_CURRENT, path))
+    {
+        WcaSetProperty(L"WIX_DIR_ADMINTOOLS", path);
+    }
+
+    if (ERROR_SUCCESS == ::SHGetFolderPathW(NULL, CSIDL_ALTSTARTUP, NULL, SHGFP_TYPE_CURRENT, path))
+    {
+        WcaSetProperty(L"WIX_DIR_ALTSTARTUP", path);
+    }
+
+    if (ERROR_SUCCESS == ::SHGetFolderPathW(NULL, CSIDL_CDBURN_AREA, NULL, SHGFP_TYPE_CURRENT, path))
+    {
+        WcaSetProperty(L"WIX_DIR_CDBURN_AREA", path);
+    }
+
+    if (ERROR_SUCCESS == ::SHGetFolderPathW(NULL, CSIDL_COMMON_ADMINTOOLS, NULL, SHGFP_TYPE_CURRENT, path))
+    {
+        WcaSetProperty(L"WIX_DIR_COMMON_ADMINTOOLS", path);
+    }
+
+    if (ERROR_SUCCESS == ::SHGetFolderPathW(NULL, CSIDL_COMMON_ALTSTARTUP, NULL, SHGFP_TYPE_CURRENT, path))
+    {
+        WcaSetProperty(L"WIX_DIR_COMMON_ALTSTARTUP", path);
+    }
+
+    if (ERROR_SUCCESS == ::SHGetFolderPathW(NULL, CSIDL_COMMON_DOCUMENTS, NULL, SHGFP_TYPE_CURRENT, path))
+    {
+        WcaSetProperty(L"WIX_DIR_COMMON_DOCUMENTS", path);
+    }
+
+    if (ERROR_SUCCESS == ::SHGetFolderPathW(NULL, CSIDL_COMMON_FAVORITES, NULL, SHGFP_TYPE_CURRENT, path))
+    {
+        WcaSetProperty(L"WIX_DIR_COMMON_FAVORITES", path);
+    }
+
+    if (ERROR_SUCCESS == ::SHGetFolderPathW(NULL, CSIDL_COMMON_MUSIC, NULL, SHGFP_TYPE_CURRENT, path))
+    {
+        WcaSetProperty(L"WIX_DIR_COMMON_MUSIC", path);
+    }
+
+    if (ERROR_SUCCESS == ::SHGetFolderPathW(NULL, CSIDL_COMMON_PICTURES, NULL, SHGFP_TYPE_CURRENT, path))
+    {
+        WcaSetProperty(L"WIX_DIR_COMMON_PICTURES", path);
+    }
+
+    if (ERROR_SUCCESS == ::SHGetFolderPathW(NULL, CSIDL_COMMON_VIDEO, NULL, SHGFP_TYPE_CURRENT, path))
+    {
+        WcaSetProperty(L"WIX_DIR_COMMON_VIDEO", path);
+    }
+
+    if (ERROR_SUCCESS == ::SHGetFolderPathW(NULL, CSIDL_COOKIES, NULL, SHGFP_TYPE_CURRENT, path))
+    {
+        WcaSetProperty(L"WIX_DIR_COOKIES", path);
+    }
+
+    if (ERROR_SUCCESS == ::SHGetFolderPathW(NULL, CSIDL_DESKTOP, NULL, SHGFP_TYPE_CURRENT, path))
+    {
+        WcaSetProperty(L"WIX_DIR_DESKTOP", path);
+    }
+
+    if (ERROR_SUCCESS == ::SHGetFolderPathW(NULL, CSIDL_HISTORY, NULL, SHGFP_TYPE_CURRENT, path))
+    {
+        WcaSetProperty(L"WIX_DIR_HISTORY", path);
+    }
+
+    if (ERROR_SUCCESS == ::SHGetFolderPathW(NULL, CSIDL_INTERNET_CACHE, NULL, SHGFP_TYPE_CURRENT, path))
+    {
+        WcaSetProperty(L"WIX_DIR_INTERNET_CACHE", path);
+    }
+
+    if (ERROR_SUCCESS == ::SHGetFolderPathW(NULL, CSIDL_MYMUSIC, NULL, SHGFP_TYPE_CURRENT, path))
+    {
+        WcaSetProperty(L"WIX_DIR_MYMUSIC", path);
+    }
+
+    if (ERROR_SUCCESS == ::SHGetFolderPathW(NULL, CSIDL_MYPICTURES, NULL, SHGFP_TYPE_CURRENT, path))
+    {
+        WcaSetProperty(L"WIX_DIR_MYPICTURES", path);
+    }
+
+    if (ERROR_SUCCESS == ::SHGetFolderPathW(NULL, CSIDL_MYVIDEO, NULL, SHGFP_TYPE_CURRENT, path))
+    {
+        WcaSetProperty(L"WIX_DIR_MYVIDEO", path);
+    }
+
+    if (ERROR_SUCCESS == ::SHGetFolderPathW(NULL, CSIDL_NETHOOD, NULL, SHGFP_TYPE_CURRENT, path))
+    {
+        WcaSetProperty(L"WIX_DIR_NETHOOD", path);
+    }
+
+    if (ERROR_SUCCESS == ::SHGetFolderPathW(NULL, CSIDL_PERSONAL, NULL, SHGFP_TYPE_CURRENT, path))
+    {
+        WcaSetProperty(L"WIX_DIR_PERSONAL", path);
+    }
+
+    if (ERROR_SUCCESS == ::SHGetFolderPathW(NULL, CSIDL_PRINTHOOD, NULL, SHGFP_TYPE_CURRENT, path))
+    {
+        WcaSetProperty(L"WIX_DIR_PRINTHOOD", path);
+    }
+
+    if (ERROR_SUCCESS == ::SHGetFolderPathW(NULL, CSIDL_PROFILE, NULL, SHGFP_TYPE_CURRENT, path))
+    {
+        WcaSetProperty(L"WIX_DIR_PROFILE", path);
+    }
+
+    if (ERROR_SUCCESS == ::SHGetFolderPathW(NULL, CSIDL_RECENT, NULL, SHGFP_TYPE_CURRENT, path))
+    {
+        WcaSetProperty(L"WIX_DIR_RECENT", path);
+    }
+
+    if (ERROR_SUCCESS == ::SHGetFolderPathW(NULL, CSIDL_RESOURCES, NULL, SHGFP_TYPE_CURRENT, path))
+    {
+        WcaSetProperty(L"WIX_DIR_RESOURCES", path);
+    }
+
+LExit:
+    if (FAILED(hr))
+        er = ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+
+/********************************************************************
+SetPropertyWellKnownSID
+
+ Set a property with the localized name of a well known windows SID
+********************************************************************/
+static HRESULT SetPropertyWellKnownSID(
+    __in WELL_KNOWN_SID_TYPE sidType,
+    __in LPCWSTR wzPropertyName,
+    __in BOOL fIncludeDomainName
+    )
+{
+    HRESULT hr = S_OK;
+    PSID psid = NULL;
+    WCHAR wzRefDomain[MAX_PATH] = {0};
+    SID_NAME_USE nameUse;
+    DWORD refSize = MAX_PATH;
+    WCHAR wzName[MAX_PATH] = {0};
+    LPWSTR pwzPropertyValue = NULL;
+    DWORD size = MAX_PATH;
+
+    hr = AclGetWellKnownSid(sidType, &psid);
+    ExitOnFailure(hr, "Failed to get SID; skipping account %ls", wzPropertyName);
+
+    if (!::LookupAccountSidW(NULL, psid, wzName, &size, wzRefDomain, &refSize, &nameUse))
+    {
+        ExitWithLastError(hr, "Failed to look up account for SID; skipping account %ls.", wzPropertyName);
+    }
+
+    if (fIncludeDomainName)
+    {
+        hr = StrAllocFormatted(&pwzPropertyValue, L"%s\\%s", wzRefDomain, wzName);
+        ExitOnFailure(hr, "Failed to format property value");
+
+        hr = WcaSetProperty(wzPropertyName, pwzPropertyValue);
+        ExitOnFailure(hr, "Failed write domain\\name property");
+    }
+    else
+    {
+        hr = WcaSetProperty(wzPropertyName, wzName);
+        ExitOnFailure(hr, "Failed write to name-only property");
+    }
+ 
+LExit:
+    if (NULL != psid)
+    {
+        ::LocalFree(psid);
+    }
+    ReleaseStr(pwzPropertyValue);
+    return hr;
+}
+
+/********************************************************************
+WixQueryOsWellKnownSID - entry point for WixQueryOsWellKnownSID custom action
+
+ Called as Type 1 custom action (DLL from the Binary table) from 
+ Windows Installer to set properties with the localized names of built-in
+ Windows Security IDs
+********************************************************************/
+extern "C" UINT __stdcall WixQueryOsWellKnownSID(
+    __in MSIHANDLE hInstall
+    )
+{
+    HRESULT hr = S_OK;
+    DWORD er = ERROR_SUCCESS;
+
+    hr = WcaInitialize(hInstall, "WixQueryOsWellKnownSID");
+    ExitOnFailure(hr, "WixQueryOsWellKnownSID failed to initialize");
+
+    SetPropertyWellKnownSID(WinLocalSystemSid, L"WIX_ACCOUNT_LOCALSYSTEM", TRUE);
+    SetPropertyWellKnownSID(WinLocalServiceSid, L"WIX_ACCOUNT_LOCALSERVICE", TRUE);
+    SetPropertyWellKnownSID(WinNetworkServiceSid, L"WIX_ACCOUNT_NETWORKSERVICE", TRUE);
+    SetPropertyWellKnownSID(WinBuiltinAdministratorsSid, L"WIX_ACCOUNT_ADMINISTRATORS", TRUE);
+    SetPropertyWellKnownSID(WinBuiltinUsersSid, L"WIX_ACCOUNT_USERS", TRUE);
+    SetPropertyWellKnownSID(WinBuiltinGuestsSid, L"WIX_ACCOUNT_GUESTS", TRUE);
+    SetPropertyWellKnownSID(WinBuiltinPerfLoggingUsersSid, L"WIX_ACCOUNT_PERFLOGUSERS", TRUE);
+    SetPropertyWellKnownSID(WinBuiltinPerfLoggingUsersSid, L"WIX_ACCOUNT_PERFLOGUSERS_NODOMAIN", FALSE);
+
+LExit:
+    if (FAILED(hr))
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+    return WcaFinalize(er);
+}
+
+
+/********************************************************************
+DetectWDDMDriver
+
+ Set a property if the driver on the machine is a WDDM driver. One
+ reliable way to detect the presence of a WDDM driver is to try and
+ use the Direct3DCreate9Ex() function. This method attempts that
+ then sets the property appropriately.
+********************************************************************/
+static HRESULT DetectWDDMDriver()
+{
+    HRESULT hr = S_OK;
+    HMODULE hModule = NULL;
+
+    // Manually load the d3d9.dll library. If the library couldn't be loaded then we obviously won't be able
+    // to try calling the function so just return.
+    hr = LoadSystemLibrary(L"d3d9.dll", &hModule);
+    if (E_MODNOTFOUND == hr)
+    {
+        TraceError(hr, "Unable to load DirectX APIs, skipping WDDM driver check.");
+        ExitFunction1(hr = S_OK);
+    }
+    ExitOnFailure(hr, "Failed to the load the existing DirectX APIs.");
+
+    // Obtain the address of the Direct3DCreate9Ex function. If this fails we know it isn't a WDDM
+    // driver so just exit.
+    const void* Direct3DCreate9ExPtr = ::GetProcAddress(hModule, "Direct3DCreate9Ex");
+    ExitOnNull(Direct3DCreate9ExPtr, hr, S_OK, "Unable to load Direct3DCreateEx function, so the driver is not a WDDM driver.");
+
+    // At this point we know it's a WDDM driver so set the property.
+    hr = WcaSetIntProperty(L"WIX_WDDM_DRIVER_PRESENT", 1);
+    ExitOnFailure(hr, "Failed write property");
+
+LExit:
+    if (NULL != hModule)
+    {
+        FreeLibrary(hModule);
+    }
+
+    return hr;
+}
+
+/********************************************************************
+DetectIsCompositionEnabled
+
+ Set a property based on the return value of DwmIsCompositionEnabled().
+********************************************************************/
+static HRESULT DetectIsCompositionEnabled()
+{
+    HRESULT hr = S_OK;
+    HMODULE hModule = NULL;
+    BOOL compositionState = false;
+
+    // Manually load the d3d9.dll library. If the library can't load it's likely because we are not on a Vista
+    // OS. Just return ok, and the property won't get set.
+    hr = LoadSystemLibrary(L"dwmapi.dll", &hModule);
+    if (E_MODNOTFOUND == hr)
+    {
+        TraceError(hr, "Unable to load Vista desktop window manager APIs, skipping Composition Enabled check.");
+        ExitFunction1(hr = S_OK);
+    }
+    ExitOnFailure(hr, "Failed to load the existing window manager APIs.");
+
+    // If for some reason we can't get the function pointer that's ok, just return.
+    typedef HRESULT (WINAPI *DWMISCOMPOSITIONENABLEDPTR)(BOOL*);
+    DWMISCOMPOSITIONENABLEDPTR DwmIsCompositionEnabledPtr = (DWMISCOMPOSITIONENABLEDPTR)::GetProcAddress(hModule, "DwmIsCompositionEnabled");
+    ExitOnNull(hModule, hr, S_OK, "Unable to obtain function information, skipping Composition Enabled check.");
+    
+    hr = DwmIsCompositionEnabledPtr(&compositionState);
+    ExitOnFailure(hr, "Failed to retrieve Composition state");
+
+    if (compositionState)
+    {
+        hr = WcaSetIntProperty(L"WIX_DWM_COMPOSITION_ENABLED", 1);
+        ExitOnFailure(hr, "Failed write property");
+    }
+
+LExit:
+    if (NULL != hModule)
+    {
+        FreeLibrary(hModule);
+    }
+    return hr;
+}
+
+/********************************************************************
+WixQueryOsDriverInfo - entry point for WixQueryOsDriverInfo custom action
+
+ Called as Type 1 custom action (DLL from the Binary table) from 
+ Windows Installer to set properties about drivers installed on
+ the target machine
+********************************************************************/
+extern "C" UINT __stdcall WixQueryOsDriverInfo(
+    __in MSIHANDLE hInstall
+    )
+{
+    HRESULT hr = S_OK;
+    DWORD er = ERROR_SUCCESS;
+
+    hr = WcaInitialize(hInstall, "WixQueryOsDriverInfo");
+    ExitOnFailure(hr, "WixQueryOsDriverInfo failed to initialize");
+
+    // Detect the WDDM driver status
+    hr = DetectWDDMDriver();
+    ExitOnFailure(hr, "Failed to detect WIX_WDDM_DRIVER_PRESENT");
+
+    // Detect whether composition is enabled
+    hr = DetectIsCompositionEnabled();
+    ExitOnFailure(hr, "Failed to detect WIX_DWM_COMPOSITION_ENABLED");
+
+LExit:
+    if (FAILED(hr))
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+    return WcaFinalize(er);
+}
diff --git a/src/ext/Util/ca/RemoveFoldersEx.cpp b/src/ext/Util/ca/RemoveFoldersEx.cpp
new file mode 100644
index 00000000..cbc7f4bb
--- /dev/null
+++ b/src/ext/Util/ca/RemoveFoldersEx.cpp
@@ -0,0 +1,243 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+LPCWSTR vcsRemoveFolderExQuery =
+    L"SELECT `Wix4RemoveFolderEx`, `Component_`, `Property`, `InstallMode`, `WixRemoveFolderEx`.`Condition`, `Component`.`Attributes`"
+    L"FROM `Wix4RemoveFolderEx``,`Component` "
+    L"WHERE `Wix4RemoveFolderEx`.`Component_`=`Component`.`Component`";
+enum eRemoveFolderExQuery { rfqId = 1, rfqComponent, rfqProperty, rfqMode, rfqCondition, rfqComponentAttributes };
+
+static HRESULT RecursePath(
+    __in_z LPCWSTR wzPath,
+    __in_z LPCWSTR wzId,
+    __in_z LPCWSTR wzComponent,
+    __in_z LPCWSTR wzProperty,
+    __in int iMode,
+    __in BOOL fDisableWow64Redirection,
+    __inout DWORD* pdwCounter,
+    __inout MSIHANDLE* phTable,
+    __inout MSIHANDLE* phColumns
+    )
+{
+    HRESULT hr = S_OK;
+    DWORD er;
+    LPWSTR sczSearch = NULL;
+    LPWSTR sczProperty = NULL;
+    HANDLE hFind = INVALID_HANDLE_VALUE;
+    WIN32_FIND_DATAW wfd;
+    LPWSTR sczNext = NULL;
+
+    if (fDisableWow64Redirection)
+    {
+        hr = WcaDisableWow64FSRedirection();
+        ExitOnFailure(hr, "Custom action was told to act on a 64-bit component, but was unable to disable filesystem redirection through the Wow64 API.");
+    }
+
+    // First recurse down to all the child directories.
+    hr = StrAllocFormatted(&sczSearch, L"%s*", wzPath);
+    ExitOnFailure(hr, "Failed to allocate file search string in path: %S", wzPath);
+
+    hFind = ::FindFirstFileW(sczSearch, &wfd);
+    if (INVALID_HANDLE_VALUE == hFind)
+    {
+        er = ::GetLastError();
+        if (ERROR_PATH_NOT_FOUND == er)
+        {
+            WcaLog(LOGMSG_STANDARD, "Search path not found: %ls; skipping", sczSearch);
+            ExitFunction1(hr = S_FALSE);
+        }
+        else
+        {
+            hr = HRESULT_FROM_WIN32(er);
+        }
+        ExitOnFailure(hr, "Failed to find all files in path: %S", wzPath);
+    }
+
+    do
+    {
+        // Skip files and the dot directories.
+        if (FILE_ATTRIBUTE_DIRECTORY != (wfd.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) || L'.' == wfd.cFileName[0] && (L'\0' == wfd.cFileName[1] || (L'.' == wfd.cFileName[1] && L'\0' == wfd.cFileName[2])))
+        {
+            continue;
+        }
+
+        hr = StrAllocFormatted(&sczNext, L"%s%s\\", wzPath, wfd.cFileName);
+        ExitOnFailure(hr, "Failed to concat filename '%S' to string: %S", wfd.cFileName, wzPath);
+
+        // Don't re-disable redirection; if it was necessary, we've already done it.
+        hr = RecursePath(sczNext, wzId, wzComponent, wzProperty, iMode, FALSE, pdwCounter, phTable, phColumns);
+        ExitOnFailure(hr, "Failed to recurse path: %S", sczNext);
+    } while (::FindNextFileW(hFind, &wfd));
+
+    er = ::GetLastError();
+    if (ERROR_NO_MORE_FILES == er)
+    {
+        hr = S_OK;
+    }
+    else
+    {
+        hr = HRESULT_FROM_WIN32(er);
+        ExitOnFailure(hr, "Failed while looping through files in directory: %S", wzPath);
+    }
+
+    // Finally, set a property that points at our path.
+    hr = StrAllocFormatted(&sczProperty, L"_%s_%u", wzProperty, *pdwCounter);
+    ExitOnFailure(hr, "Failed to allocate Property for RemoveFile table with property: %S.", wzProperty);
+
+    ++(*pdwCounter);
+
+    hr = WcaSetProperty(sczProperty, wzPath);
+    ExitOnFailure(hr, "Failed to set Property: %S with path: %S", sczProperty, wzPath);
+
+    // Add the row to remove any files and another row to remove the folder.
+    hr = WcaAddTempRecord(phTable, phColumns, L"RemoveFile", NULL, 1, 5, L"RfxFiles", wzComponent, L"*.*", sczProperty, iMode);
+    ExitOnFailure(hr, "Failed to add row to remove all files for Wix4RemoveFolderEx row: %ls under path: %ls", wzId, wzPath);
+
+    hr = WcaAddTempRecord(phTable, phColumns, L"RemoveFile", NULL, 1, 5, L"RfxFolder", wzComponent, NULL, sczProperty, iMode);
+    ExitOnFailure(hr, "Failed to add row to remove folder for Wix4RemoveFolderEx row: %ls under path: %ls", wzId, wzPath);
+
+LExit:
+    if (INVALID_HANDLE_VALUE != hFind)
+    {
+        ::FindClose(hFind);
+    }
+
+    if (fDisableWow64Redirection)
+    {
+        WcaRevertWow64FSRedirection();
+    }
+
+    ReleaseStr(sczNext);
+    ReleaseStr(sczProperty);
+    ReleaseStr(sczSearch);
+    return hr;
+}
+
+extern "C" UINT WINAPI WixRemoveFoldersEx(
+    __in MSIHANDLE hInstall
+    )
+{
+    //AssertSz(FALSE, "debug WixRemoveFoldersEx");
+
+    HRESULT hr = S_OK;
+    PMSIHANDLE hView;
+    PMSIHANDLE hRec;
+    LPWSTR sczId = NULL;
+    LPWSTR sczComponent = NULL;
+    LPWSTR sczProperty = NULL;
+    LPWSTR sczCondition = NULL;
+    LPWSTR sczPath = NULL;
+    LPWSTR sczExpandedPath = NULL;
+    int iMode = 0;
+    int iComponentAttributes;
+    BOOL f64BitComponent = FALSE;
+    DWORD dwCounter = 0;
+    DWORD_PTR cchLen = 0;
+    MSIHANDLE hTable = NULL;
+    MSIHANDLE hColumns = NULL;
+
+    hr = WcaInitialize(hInstall, "WixRemoveFoldersEx");
+    ExitOnFailure(hr, "Failed to initialize WixRemoveFoldersEx.");
+
+    WcaInitializeWow64();
+
+    // anything to do?
+    if (S_OK != WcaTableExists(L"Wix4RemoveFolderEx"))
+    {
+        WcaLog(LOGMSG_STANDARD, "Wix4RemoveFolderEx table doesn't exist, so there are no folders to remove.");
+        ExitFunction();
+    }
+
+    // query and loop through all the remove folders exceptions
+    hr = WcaOpenExecuteView(vcsRemoveFolderExQuery, &hView);
+    ExitOnFailure(hr, "Failed to open view on Wix4RemoveFolderEx table");
+
+    while (S_OK == (hr = WcaFetchRecord(hView, &hRec)))
+    {
+        hr = WcaGetRecordString(hRec, rfqId, &sczId);
+        ExitOnFailure(hr, "Failed to get remove folder identity.");
+
+        hr = WcaGetRecordString(hRec, rfqCondition, &sczCondition);
+        ExitOnFailure(hr, "Failed to get remove folder condition.");
+
+        if (sczCondition && *sczCondition)
+        {
+            MSICONDITION condition = ::MsiEvaluateConditionW(hInstall, sczCondition);
+            if (MSICONDITION_TRUE == condition)
+            {
+                WcaLog(LOGMSG_STANDARD, "True condition for row %S: %S; processing.", sczId, sczCondition);
+            }
+            else
+            {
+                WcaLog(LOGMSG_STANDARD, "False or invalid condition for row %S: %S; skipping.", sczId, sczCondition);
+                continue;
+            }
+        }
+
+        hr = WcaGetRecordString(hRec, rfqComponent, &sczComponent);
+        ExitOnFailure(hr, "Failed to get remove folder component.");
+
+        hr = WcaGetRecordString(hRec, rfqProperty, &sczProperty);
+        ExitOnFailure(hr, "Failed to get remove folder property.");
+
+        hr = WcaGetRecordInteger(hRec, rfqMode, &iMode);
+        ExitOnFailure(hr, "Failed to get remove folder mode");
+
+        hr = WcaGetProperty(sczProperty, &sczPath);
+        ExitOnFailure(hr, "Failed to resolve remove folder property: %S for row: %S", sczProperty, sczId);
+
+        hr = WcaGetRecordInteger(hRec, rfqComponentAttributes, &iComponentAttributes);
+        ExitOnFailure(hr, "failed to get component attributes for row: %ls", sczId);
+
+        f64BitComponent = iComponentAttributes & msidbComponentAttributes64bit;
+
+        // fail early if the property isn't set as you probably don't want your installers trying to delete SystemFolder
+        // StringCchLengthW succeeds only if the string is zero characters plus 1 for the terminating null
+        hr = ::StringCchLengthW(sczPath, 1, reinterpret_cast<UINT_PTR*>(&cchLen));
+        if (SUCCEEDED(hr))
+        {
+            ExitOnFailure(hr = E_INVALIDARG, "Missing folder property: %S for row: %S", sczProperty, sczId);
+        }
+
+        hr = PathExpand(&sczExpandedPath, sczPath, PATH_EXPAND_ENVIRONMENT);
+        ExitOnFailure(hr, "Failed to expand path: %S for row: %S", sczPath, sczId);
+        
+        hr = PathBackslashTerminate(&sczExpandedPath);
+        ExitOnFailure(hr, "Failed to backslash-terminate path: %S", sczExpandedPath);
+    
+        WcaLog(LOGMSG_STANDARD, "Recursing path: %S for row: %S.", sczExpandedPath, sczId);
+        hr = RecursePath(sczExpandedPath, sczId, sczComponent, sczProperty, iMode, f64BitComponent, &dwCounter, &hTable, &hColumns);
+        ExitOnFailure(hr, "Failed while navigating path: %S for row: %S", sczPath, sczId);
+    }
+
+    // reaching the end of the list is actually a good thing, not an error
+    if (E_NOMOREITEMS == hr)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "Failure occured while processing Wix4RemoveFolderEx table");
+
+LExit:
+    WcaFinalizeWow64();
+
+    if (hColumns)
+    {
+        ::MsiCloseHandle(hColumns);
+    }
+
+    if (hTable)
+    {
+        ::MsiCloseHandle(hTable);
+    }
+
+    ReleaseStr(sczExpandedPath);
+    ReleaseStr(sczPath);
+    ReleaseStr(sczProperty);
+    ReleaseStr(sczComponent);
+    ReleaseStr(sczCondition);
+    ReleaseStr(sczId);
+
+    DWORD er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
diff --git a/src/ext/Util/ca/RemoveRegistryKeysEx.cpp b/src/ext/Util/ca/RemoveRegistryKeysEx.cpp
new file mode 100644
index 00000000..478c0779
--- /dev/null
+++ b/src/ext/Util/ca/RemoveRegistryKeysEx.cpp
@@ -0,0 +1,114 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+LPCWSTR vcsRemoveRegistryKeyExQuery =
+    L"SELECT `Wix4RemoveRegistryKeyEx`, `Component_`, `Root`, `Key`, `InstallMode`, `Condition` FROM `Wix4RemoveRegistryKeyEx`";
+enum eRemoveRegistryKeyExQuery { rrxqId = 1, rrxqComponent, rrxqRoot, rrxqKey, rrxqMode, rrxqCondition };
+
+extern "C" UINT WINAPI WixRemoveRegistryKeysEx(
+    __in MSIHANDLE hInstall
+)
+{
+    //AssertSz(FALSE, "debug WixRemoveRegistryKeyEx");
+
+    HRESULT hr = S_OK;
+    PMSIHANDLE hView;
+    PMSIHANDLE hRec;
+    LPWSTR sczId = NULL;
+    LPWSTR sczComponent = NULL;
+    LPWSTR sczCondition = NULL;
+    LPWSTR sczKey = NULL;
+    int iRoot = 0;
+    int iMode = 0;
+    MSIHANDLE hTable = NULL;
+    MSIHANDLE hColumns = NULL;
+
+    hr = WcaInitialize(hInstall, __FUNCTION__);
+    ExitOnFailure(hr, "Failed to initialize " __FUNCTION__);
+
+    // anything to do?
+    if (S_OK != WcaTableExists(L"Wix4RemoveRegistryKeyEx"))
+    {
+        WcaLog(LOGMSG_STANDARD, "Wix4RemoveRegistryKeyEx table doesn't exist, so there are no registry keys to remove.");
+        ExitFunction();
+    }
+
+    hr = WcaOpenExecuteView(vcsRemoveRegistryKeyExQuery, &hView);
+    ExitOnFailure(hr, "Failed to open view on Wix4RemoveRegistryKeyEx table");
+
+    while (S_OK == (hr = WcaFetchRecord(hView, &hRec)))
+    {
+        hr = WcaGetRecordString(hRec, rrxqId, &sczId);
+        ExitOnFailure(hr, "Failed to get Wix4RemoveRegistryKeyEx identity.");
+
+        hr = WcaGetRecordString(hRec, rrxqCondition, &sczCondition);
+        ExitOnFailure(hr, "Failed to get Wix4RemoveRegistryKeyEx condition.");
+
+        if (sczCondition && *sczCondition)
+        {
+            MSICONDITION condition = ::MsiEvaluateConditionW(hInstall, sczCondition);
+            if (MSICONDITION_TRUE == condition)
+            {
+                WcaLog(LOGMSG_STANDARD, "True condition for row %S: %S; processing.", sczId, sczCondition);
+            }
+            else
+            {
+                WcaLog(LOGMSG_STANDARD, "False or invalid condition for row %S: %S; skipping.", sczId, sczCondition);
+                continue;
+            }
+        }
+
+        hr = WcaGetRecordString(hRec, rrxqComponent, &sczComponent);
+        ExitOnFailure(hr, "Failed to get Wix4RemoveRegistryKeyEx component.");
+
+        hr = WcaGetRecordInteger(hRec, rrxqRoot, &iRoot);
+        ExitOnFailure(hr, "Failed to get Wix4RemoveRegistryKeyEx root.");
+
+        hr = WcaGetRecordString(hRec, rrxqKey, &sczKey);
+        ExitOnFailure(hr, "Failed to get Wix4RemoveRegistryKeyEx key.");
+
+        hr = WcaGetRecordInteger(hRec, rrxqMode, &iMode);
+        ExitOnFailure(hr, "Failed to get Wix4RemoveRegistryKeyEx mode.");
+
+        switch (iMode)
+        {
+        case 1: // remove on install
+            WcaLog(LOGMSG_STANDARD, "Adding RemoveRegistry row: %ls/%d/%ls/-/%ls", sczId, iRoot, sczKey, sczComponent);
+            hr = WcaAddTempRecord(&hTable, &hColumns, L"RemoveRegistry", NULL, 0, 5, sczId, iRoot, sczKey, L"-", sczComponent);
+            ExitOnFailure(hr, "Failed to add RemoveRegistry row for remove-on-install Wix4RemoveRegistryKeyEx row: %ls:", sczId);
+            break;
+        case 2: // remove on uninstall
+            WcaLog(LOGMSG_STANDARD, "Adding Registry row: %ls/%d/%ls/-/null/%ls", sczId, iRoot, sczKey, sczComponent);
+            hr = WcaAddTempRecord(&hTable, &hColumns, L"Registry", NULL, 0, 6, sczId, iRoot, sczKey, L"-", NULL, sczComponent);
+            ExitOnFailure(hr, "Failed to add Registry row for remove-on-uninstall Wix4RemoveRegistryKeyEx row: %ls:", sczId);
+            break;
+        }
+    }
+
+    // reaching the end of the list is actually a good thing, not an error
+    if (E_NOMOREITEMS == hr)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "Failure occured while processing Wix4RemoveRegistryKeyEx table.");
+
+LExit:
+    if (hColumns)
+    {
+        ::MsiCloseHandle(hColumns);
+    }
+
+    if (hTable)
+    {
+        ::MsiCloseHandle(hTable);
+    }
+
+    ReleaseStr(sczKey);
+    ReleaseStr(sczComponent);
+    ReleaseStr(sczCondition);
+    ReleaseStr(sczId);
+
+    DWORD er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
diff --git a/src/ext/Util/ca/RestartManager.cpp b/src/ext/Util/ca/RestartManager.cpp
new file mode 100644
index 00000000..c31819c1
--- /dev/null
+++ b/src/ext/Util/ca/RestartManager.cpp
@@ -0,0 +1,185 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+#include <restartmanager.h>
+
+// Include space for the terminating null.
+#define CCH_SESSION_KEY CCH_RM_SESSION_KEY + 1
+
+enum eRmuResourceType
+{
+    etInvalid,
+    etFilename,
+    etApplication,
+    etServiceName,
+
+    // Mask types from Attributes.
+    etTypeMask = 0xf,
+};
+
+LPCWSTR vcsRestartResourceQuery =
+    L"SELECT `Wix4RestartResource`.`Wix4RestartResource`, `Wix4RestartResource`.`Component_`, `Wix4RestartResource`.`Resource`, `Wix4RestartResource`.`Attributes` "
+    L"FROM `Wix4RestartResource`";
+enum eRestartResourceQuery { rrqRestartResource = 1, rrqComponent, rrqResource, rrqAttributes };
+
+/********************************************************************
+WixRegisterRestartResources - Immediate CA to register resources with RM.
+
+Enumerates components before InstallValidate and registers resources
+to be restarted by Restart Manager if the component action
+is anything other than None.
+
+Do not disable file system redirection.
+
+********************************************************************/
+extern "C" UINT __stdcall WixRegisterRestartResources(
+    __in MSIHANDLE hInstall
+    )
+{
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    PMSIHANDLE hView = NULL;
+    PMSIHANDLE hRec = NULL;
+
+    LPWSTR wzSessionKey = NULL;
+    size_t cchSessionKey = 0;
+    PRMU_SESSION pSession = NULL;
+
+    LPWSTR wzRestartResource = NULL;
+    LPWSTR wzComponent = NULL;
+    LPWSTR wzResource = NULL;
+    int iAttributes = NULL;
+    BOOL fIsComponentNull = FALSE;
+    WCA_TODO todo = WCA_TODO_UNKNOWN;
+    int iType = etInvalid;
+
+    hr = WcaInitialize(hInstall, "WixRegisterRestartResources");
+    ExitOnFailure(hr, "Failed to initialize.");
+
+    // Skip if the table doesn't exist.
+    if (S_OK != WcaTableExists(L"Wix4RestartResource"))
+    {
+        WcaLog(LOGMSG_STANDARD, "The Wix4RestartResource table does not exist; there are no resources to register with Restart Manager.");
+        ExitFunction();
+    }
+
+    // Get the existing Restart Manager session if available.
+    hr = WcaGetProperty(L"MsiRestartManagerSessionKey", &wzSessionKey);
+    ExitOnFailure(hr, "Failed to get the MsiRestartManagerSessionKey property.");
+
+    hr = ::StringCchLengthW(wzSessionKey, CCH_SESSION_KEY, &cchSessionKey);
+    ExitOnFailure(hr, "Failed to get the MsiRestartManagerSessionKey string length.");
+
+    // Skip if the property doesn't exist.
+    if (0 == cchSessionKey)
+    {
+        WcaLog(LOGMSG_STANDARD, "The MsiRestartManagerSessionKey property is not available to join.");
+        ExitFunction();
+    }
+
+    // Join the existing Restart Manager session if supported.
+    hr = RmuJoinSession(&pSession, wzSessionKey);
+    if (E_MODNOTFOUND == hr)
+    {
+        WcaLog(LOGMSG_STANDARD, "The Restart Manager is not supported on this platform. Skipping.");
+        ExitFunction1(hr = S_OK);
+    }
+    else if (FAILED(hr))
+    {
+        WcaLog(LOGMSG_STANDARD, "Failed to join the existing Restart Manager session %ls.", wzSessionKey);
+        ExitFunction1(hr = S_OK);
+    }
+
+    // Loop through each record in the table.
+    hr = WcaOpenExecuteView(vcsRestartResourceQuery, &hView);
+    ExitOnFailure(hr, "Failed to open a view on the RestartResource table.");
+
+    while (S_OK == (hr = WcaFetchRecord(hView, &hRec)))
+    {
+        hr = WcaGetRecordString(hRec, rrqRestartResource, &wzRestartResource);
+        ExitOnFailure(hr, "Failed to get the RestartResource field value.");
+
+        hr = WcaGetRecordString(hRec, rrqComponent, &wzComponent);
+        ExitOnFailure(hr, "Failed to get the Component_ field value.");
+
+        hr = WcaGetRecordFormattedString(hRec, rrqResource, &wzResource);
+        ExitOnFailure(hr, "Failed to get the Resource formatted field value.");
+
+        hr = WcaGetRecordInteger(hRec, rrqAttributes, &iAttributes);
+        ExitOnFailure(hr, "Failed to get the Attributes field value.");
+
+        fIsComponentNull = ::MsiRecordIsNull(hRec, rrqComponent);
+        todo = WcaGetComponentToDo(wzComponent);
+
+        // Only register resources for components that are null, or being installed, reinstalled, or uninstalled.
+        if (!fIsComponentNull && WCA_TODO_UNKNOWN == todo)
+        {
+            WcaLog(LOGMSG_VERBOSE, "Skipping resource %ls.", wzRestartResource);
+            continue;
+        }
+
+        // Get the type from Attributes and add to the Restart Manager.
+        iType = iAttributes & etTypeMask;
+        switch (iType)
+        {
+        case etFilename:
+            WcaLog(LOGMSG_VERBOSE, "Registering file name %ls with the Restart Manager.", wzResource);
+            hr = RmuAddFile(pSession, wzResource);
+            ExitOnFailure(hr, "Failed to register the file name with the Restart Manager session.");
+            break;
+
+        case etApplication:
+            WcaLog(LOGMSG_VERBOSE, "Registering process name %ls with the Restart Manager.", wzResource);
+            hr = RmuAddProcessesByName(pSession, wzResource);
+            if (E_NOTFOUND == hr)
+            {
+                // ERROR_ACCESS_DENIED was returned when trying to register this process.
+                // Since other instances may have been registered, log a message and continue the setup rather than failing.
+                WcaLog(LOGMSG_STANDARD, "The process, %ls, could not be registered with the Restart Manager (probably because the setup is not elevated and the process is in another user context). A reboot may be requested later.", wzResource);
+                hr = S_OK;
+            }
+            else
+            {
+                ExitOnFailure(hr, "Failed to register the process name with the Restart Manager session.");
+            }
+            break;
+
+        case etServiceName:
+            WcaLog(LOGMSG_VERBOSE, "Registering service name %ls with the Restart Manager.", wzResource);
+            hr = RmuAddService(pSession, wzResource);
+            ExitOnFailure(hr, "Failed to register the service name with the Restart Manager session.");
+            break;
+
+        default:
+            WcaLog(LOGMSG_VERBOSE, "The resource type %d for %ls is not supported and will not be registered.", iType, wzRestartResource);
+            break;
+        }
+    }
+
+    if (E_NOMOREITEMS == hr)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "Failed while looping through all rows to register resources.");
+
+    // Register the resources and unjoin the session.
+    hr = RmuEndSession(pSession);
+    if (FAILED(hr))
+    {
+        WcaLog(LOGMSG_VERBOSE, "Failed to register the resources with the Restart Manager.");
+        ExitFunction1(hr = S_OK);
+    }
+
+LExit:
+    ReleaseStr(wzRestartResource);
+    ReleaseStr(wzComponent);
+    ReleaseStr(wzResource);
+
+    if (FAILED(hr))
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+
+    return WcaFinalize(er);
+}
diff --git a/src/ext/Util/ca/TouchFile.cpp b/src/ext/Util/ca/TouchFile.cpp
new file mode 100644
index 00000000..e704f922
--- /dev/null
+++ b/src/ext/Util/ca/TouchFile.cpp
@@ -0,0 +1,308 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+LPCWSTR vcsTouchFileQuery = L"SELECT `Wix4TouchFile`, `Component_`, `Path`, `Attributes` FROM `Wix4TouchFile`";
+enum TOUCH_FILE_QUERY { tfqId = 1, tfqComponent, tfqPath, tfqTouchFileAttributes };
+
+enum TOUCH_FILE_ATTRIBUTE
+{
+    TOUCH_FILE_ATTRIBUTE_ON_INSTALL = 0x01,
+    TOUCH_FILE_ATTRIBUTE_ON_REINSTALL = 0x02,
+    TOUCH_FILE_ATTRIBUTE_ON_UNINSTALL = 0x04,
+    TOUCH_FILE_ATTRIBUTE_64BIT = 0x10,
+    TOUCH_FILE_ATTRIBUTE_VITAL = 0x20
+};
+
+
+static BOOL SetExistingFileModifiedTime(
+    __in_z LPCWSTR wzId,
+    __in_z LPCWSTR wzPath,
+    __in BOOL f64Bit,
+    __in FILETIME* pftModified
+    )
+{
+    HRESULT hr = S_OK;
+    BOOL fReenableFileSystemRedirection = FALSE;
+
+    if (f64Bit)
+    {
+        hr = WcaDisableWow64FSRedirection();
+        ExitOnFailure(hr, "Failed to disable 64-bit file system redirection to path: '%ls' for: %ls", wzPath, wzId);
+
+        fReenableFileSystemRedirection = TRUE;
+    }
+
+    hr = FileSetTime(wzPath, NULL, NULL, pftModified);
+
+LExit:
+    if (fReenableFileSystemRedirection)
+    {
+        WcaRevertWow64FSRedirection();
+    }
+
+    return SUCCEEDED(hr);
+}
+
+
+static HRESULT AddDataToCustomActionData(
+    __deref_inout_z LPWSTR* psczCustomActionData,
+    __in_z LPCWSTR wzId,
+    __in_z LPCWSTR wzPath,
+    __in int iTouchFileAttributes,
+    __in FILETIME ftModified
+    )
+{
+    HRESULT hr = S_OK;
+
+    hr = WcaWriteStringToCaData(wzId, psczCustomActionData);
+    ExitOnFailure(hr, "Failed to add touch file identity to custom action data.");
+
+    hr = WcaWriteStringToCaData(wzPath, psczCustomActionData);
+    ExitOnFailure(hr, "Failed to add touch file path to custom action data.");
+
+    hr = WcaWriteIntegerToCaData(iTouchFileAttributes, psczCustomActionData);
+    ExitOnFailure(hr, "Failed to add touch file attributes to custom action data.");
+
+    hr = WcaWriteIntegerToCaData(ftModified.dwHighDateTime, psczCustomActionData);
+    ExitOnFailure(hr, "Failed to add touch file high date/time to custom action data.");
+
+    hr = WcaWriteIntegerToCaData(ftModified.dwLowDateTime, psczCustomActionData);
+    ExitOnFailure(hr, "Failed to add touch file low date/time to custom action data.");
+
+LExit:
+    return hr;
+}
+
+
+static BOOL TryGetExistingFileModifiedTime(
+    __in_z LPCWSTR wzId,
+    __in_z LPCWSTR wzPath,
+    __in BOOL f64Bit,
+    __inout FILETIME* pftModified
+    )
+{
+    HRESULT hr = S_OK;
+    BOOL fReenableFileSystemRedirection = FALSE;
+
+    if (f64Bit)
+    {
+        hr = WcaDisableWow64FSRedirection();
+        ExitOnFailure(hr, "Failed to disable 64-bit file system redirection to path: '%ls' for: %ls", wzPath, wzId);
+
+        fReenableFileSystemRedirection = TRUE;
+    }
+
+    hr = FileGetTime(wzPath, NULL, NULL, pftModified);
+    if (E_PATHNOTFOUND == hr || E_FILENOTFOUND == hr)
+    {
+        // If the file doesn't exist yet there is nothing to rollback (i.e. file will probably be removed during rollback), so
+        // keep the error code but don't log anything.
+    }
+    else if (FAILED(hr))
+    {
+        WcaLog(LOGMSG_STANDARD, "Cannot access modified timestamp for file: '%ls' due to error: 0x%x. Continuing with out rollback for: %ls", wzPath, hr, wzId);
+    }
+
+LExit:
+    if (fReenableFileSystemRedirection)
+    {
+        WcaRevertWow64FSRedirection();
+    }
+
+    return SUCCEEDED(hr);
+}
+
+
+static HRESULT ProcessTouchFileTable(
+    __in BOOL fInstalling
+    )
+{
+    HRESULT hr = S_OK;
+
+    FILETIME ftModified = {};
+
+    PMSIHANDLE hView;
+    PMSIHANDLE hRec;
+
+    LPWSTR sczId = NULL;
+    LPWSTR sczComponent = NULL;
+    int iTouchFileAttributes = 0;
+    LPWSTR sczPath = NULL;
+
+    FILETIME ftRollbackModified = {};
+    LPWSTR sczRollbackData = NULL;
+    LPWSTR sczExecuteData = NULL;
+
+    if (S_OK != WcaTableExists(L"Wix4TouchFile"))
+    {
+        ExitFunction();
+    }
+
+    ::GetSystemTimeAsFileTime(&ftModified);
+
+    hr = WcaOpenExecuteView(vcsTouchFileQuery, &hView);
+    ExitOnFailure(hr, "Failed to open view on Wix4TouchFile table");
+
+    while (S_OK == (hr = WcaFetchRecord(hView, &hRec)))
+    {
+        hr = WcaGetRecordString(hRec, tfqId, &sczId);
+        ExitOnFailure(hr, "Failed to get touch file identity.");
+
+        hr = WcaGetRecordString(hRec, tfqComponent, &sczComponent);
+        ExitOnFailure(hr, "Failed to get touch file component for: %ls", sczId);
+
+        hr = WcaGetRecordInteger(hRec, tfqTouchFileAttributes, &iTouchFileAttributes);
+        ExitOnFailure(hr, "Failed to get touch file attributes for: %ls", sczId);
+
+        WCA_TODO todo = WcaGetComponentToDo(sczComponent);
+
+        BOOL fOnInstall = fInstalling && WCA_TODO_INSTALL == todo && (iTouchFileAttributes & TOUCH_FILE_ATTRIBUTE_ON_INSTALL);
+        BOOL fOnReinstall = fInstalling && WCA_TODO_REINSTALL == todo && (iTouchFileAttributes & TOUCH_FILE_ATTRIBUTE_ON_REINSTALL);
+        BOOL fOnUninstall = !fInstalling && WCA_TODO_UNINSTALL == todo && (iTouchFileAttributes & TOUCH_FILE_ATTRIBUTE_ON_UNINSTALL);
+
+        if (fOnInstall || fOnReinstall || fOnUninstall)
+        {
+            hr = WcaGetRecordFormattedString(hRec, tfqPath, &sczPath);
+            ExitOnFailure(hr, "Failed to get touch file path for: %ls", sczId);
+
+            if (TryGetExistingFileModifiedTime(sczId, sczPath, (iTouchFileAttributes & TOUCH_FILE_ATTRIBUTE_64BIT), &ftRollbackModified))
+            {
+                hr = AddDataToCustomActionData(&sczRollbackData, sczId, sczPath, iTouchFileAttributes, ftRollbackModified);
+                ExitOnFailure(hr, "Failed to add to rollback custom action data for: %ls", sczId);
+            }
+
+            hr = AddDataToCustomActionData(&sczExecuteData, sczId, sczPath, iTouchFileAttributes, ftModified);
+            ExitOnFailure(hr, "Failed to add to execute custom action data for: %ls", sczId);
+        }
+    }
+
+    if (E_NOMOREITEMS == hr)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "Failure occured while processing Wix4TouchFile table");
+
+    if (sczRollbackData)
+    {
+        hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"RollbackTouchFile"), sczRollbackData, 0);
+        ExitOnFailure(hr, "Failed to schedule RollbackTouchFile");
+    }
+
+    if (sczExecuteData)
+    {
+        hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"ExecuteTouchFile"), sczExecuteData, 0);
+        ExitOnFailure(hr, "Failed to schedule ExecuteTouchFile");
+    }
+
+LExit:
+    ReleaseStr(sczExecuteData);
+    ReleaseStr(sczRollbackData);
+    ReleaseStr(sczPath);
+    ReleaseStr(sczComponent);
+    ReleaseStr(sczId);
+
+    return hr;
+}
+
+
+extern "C" UINT WINAPI WixTouchFileDuringInstall(
+    __in MSIHANDLE hInstall
+    )
+{
+    //AssertSz(FALSE, "debug WixTouchFileDuringInstall");
+
+    HRESULT hr = S_OK;
+
+    hr = WcaInitialize(hInstall, "WixTouchFileDuringInstall");
+    ExitOnFailure(hr, "Failed to initialize WixTouchFileDuringInstall.");
+
+    hr = ProcessTouchFileTable(TRUE);
+
+LExit:
+    DWORD er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+
+extern "C" UINT WINAPI WixTouchFileDuringUninstall(
+    __in MSIHANDLE hInstall
+    )
+{
+    //AssertSz(FALSE, "debug WixTouchFileDuringUninstall");
+
+    HRESULT hr = S_OK;
+
+    hr = WcaInitialize(hInstall, "WixTouchFileDuringUninstall");
+    ExitOnFailure(hr, "Failed to initialize WixTouchFileDuringUninstall.");
+
+    hr = ProcessTouchFileTable(FALSE);
+
+LExit:
+    DWORD er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+
+extern "C" UINT WINAPI WixExecuteTouchFile(
+    __in MSIHANDLE hInstall
+    )
+{
+    HRESULT hr = S_OK;
+
+    LPWSTR sczData = NULL;
+    LPWSTR pwz = NULL;
+
+    LPWSTR sczId = NULL;
+    LPWSTR sczPath = NULL;
+    int iTouchFileAttributes = 0;
+    FILETIME ftModified = {};
+
+    hr = WcaInitialize(hInstall, "WixExecuteTouchFile");
+    ExitOnFailure(hr, "Failed to initialize WixExecuteTouchFile.");
+
+    hr = WcaGetProperty(L"CustomActionData", &sczData);
+    ExitOnFailure(hr, "Failed to get custom action data for WixExecuteTouchFile.");
+
+    pwz = sczData;
+
+    while (pwz && *pwz)
+    {
+        hr = WcaReadStringFromCaData(&pwz, &sczId);
+        ExitOnFailure(hr, "Failed to get touch file identity from custom action data.");
+
+        hr = WcaReadStringFromCaData(&pwz, &sczPath);
+        ExitOnFailure(hr, "Failed to get touch file path from custom action data for: %ls", sczId);
+
+        hr = WcaReadIntegerFromCaData(&pwz, &iTouchFileAttributes);
+        ExitOnFailure(hr, "Failed to get touch file attributes from custom action data for: %ls", sczId);
+
+        hr = WcaReadIntegerFromCaData(&pwz, reinterpret_cast<int*>(&ftModified.dwHighDateTime));
+        ExitOnFailure(hr, "Failed to get touch file high date/time from custom action data for: %ls", sczId);
+
+        hr = WcaReadIntegerFromCaData(&pwz, reinterpret_cast<int*>(&ftModified.dwLowDateTime));
+        ExitOnFailure(hr, "Failed to get touch file low date/time from custom action data for: %ls", sczId);
+
+        hr = SetExistingFileModifiedTime(sczId, sczPath, (iTouchFileAttributes & TOUCH_FILE_ATTRIBUTE_64BIT), &ftModified);
+        if (FAILED(hr))
+        {
+            if (iTouchFileAttributes & TOUCH_FILE_ATTRIBUTE_VITAL)
+            {
+                ExitOnFailure(hr, "Failed to touch file: '%ls' for: %ls", &sczPath, sczId);
+            }
+            else
+            {
+                WcaLog(LOGMSG_STANDARD, "Could not touch non-vital file: '%ls' for: %ls with error: 0x%x. Continuing...", sczPath, sczId, hr);
+                hr = S_OK;
+            }
+        }
+    }
+
+LExit:
+    ReleaseStr(sczPath);
+    ReleaseStr(sczId);
+    ReleaseStr(sczData);
+
+    DWORD er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
diff --git a/src/ext/Util/ca/XmlConfig.cpp b/src/ext/Util/ca/XmlConfig.cpp
new file mode 100644
index 00000000..a1ec9d6f
--- /dev/null
+++ b/src/ext/Util/ca/XmlConfig.cpp
@@ -0,0 +1,1130 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+#define XMLCONFIG_ELEMENT 0x00000001
+#define XMLCONFIG_VALUE 0x00000002
+#define XMLCONFIG_DOCUMENT 0x00000004
+#define XMLCONFIG_CREATE 0x00000010
+#define XMLCONFIG_DELETE 0x00000020
+#define XMLCONFIG_INSTALL 0x00000100
+#define XMLCONFIG_UNINSTALL 0x00000200
+#define XMLCONFIG_PRESERVE_MODIFIED 0x00001000
+
+enum eXmlAction
+{
+    xaUnknown = 0,
+    xaOpenFile,
+    xaOpenFilex64,
+    xaWriteValue,
+    xaWriteDocument,
+    xaDeleteValue,
+    xaCreateElement,
+    xaDeleteElement,
+};
+
+enum eXmlPreserveDate
+{
+    xdDontPreserve = 0,
+    xdPreserve
+};
+
+LPCWSTR vcsXmlConfigQuery =
+    L"SELECT `Wix4XmlConfig`.`Wix4XmlConfig`, `Wix4XmlConfig`.`File`, `Wix4XmlConfig`.`ElementId`, `Wix4XmlConfig`.`ElementPath`, `Wix4XmlConfig`.`VerifyPath`, `Wix4XmlConfig`.`Name`, "
+    L"`Wix4XmlConfig`.`Value`, `Wix4XmlConfig`.`Flags`, `Wix4XmlConfig`.`Component_`, `Component`.`Attributes` "
+    L"FROM `Wix4XmlConfig`,`Component` WHERE `Wix4XmlConfig`.`Component_`=`Component`.`Component` ORDER BY `File`, `Sequence`";
+enum eXmlConfigQuery { xfqXmlConfig = 1, xfqFile, xfqElementId, xfqElementPath, xfqVerifyPath, xfqName, xfqValue, xfqXmlFlags, xfqComponent, xfqCompAttributes  };
+
+struct XML_CONFIG_CHANGE
+{
+    WCHAR wzId[MAX_DARWIN_KEY + 1];
+
+    WCHAR wzComponent[MAX_DARWIN_KEY + 1];
+    INSTALLSTATE isInstalled;
+    INSTALLSTATE isAction;
+
+    WCHAR wzFile[MAX_PATH];
+    LPWSTR pwzElementId;
+    LPWSTR pwzElementPath;
+    LPWSTR pwzVerifyPath;
+    WCHAR wzName[MAX_DARWIN_COLUMN];
+    LPWSTR pwzValue;
+    BOOL fInstalledFile;
+
+    int iXmlFlags;
+    int iCompAttributes;
+
+    XML_CONFIG_CHANGE* pxfcAdditionalChanges;
+    int cAdditionalChanges;
+
+    XML_CONFIG_CHANGE* pxfcPrev;
+    XML_CONFIG_CHANGE* pxfcNext;
+};
+
+static HRESULT FreeXmlConfigChangeList(
+    __in_opt XML_CONFIG_CHANGE* pxfcList
+    )
+{
+    HRESULT hr = S_OK;
+
+    XML_CONFIG_CHANGE* pxfcDelete;
+    while(pxfcList)
+    {
+        pxfcDelete = pxfcList;
+        pxfcList = pxfcList->pxfcNext;
+
+        if (pxfcDelete->pwzElementId)
+        {
+            hr = MemFree(pxfcDelete->pwzElementId);
+            ExitOnFailure(hr, "failed to free xml config element id in change list item");
+        }
+
+        if (pxfcDelete->pwzElementPath)
+        {
+            hr = MemFree(pxfcDelete->pwzElementPath);
+            ExitOnFailure(hr, "failed to free xml config element path in change list item");
+        }
+
+        if (pxfcDelete->pwzVerifyPath)
+        {
+            hr = MemFree(pxfcDelete->pwzVerifyPath);
+            ExitOnFailure(hr, "failed to free xml config verify path in change list item");
+        }
+
+        if (pxfcDelete->pwzValue)
+        {
+            hr = MemFree(pxfcDelete->pwzValue);
+            ExitOnFailure(hr, "failed to free xml config value in change list item");
+        }
+
+        hr = MemFree(pxfcDelete);
+        ExitOnFailure(hr, "failed to free xml config change list item");
+    }
+
+LExit:
+    return hr;
+}
+
+static HRESULT AddXmlConfigChangeToList(
+    __inout XML_CONFIG_CHANGE** ppxfcHead,
+    __inout XML_CONFIG_CHANGE** ppxfcTail
+    )
+{
+    Assert(ppxfcHead && ppxfcTail);
+
+    HRESULT hr = S_OK;
+
+    XML_CONFIG_CHANGE* pxfc = static_cast<XML_CONFIG_CHANGE*>(MemAlloc(sizeof(XML_CONFIG_CHANGE), TRUE));
+    ExitOnNull(pxfc, hr, E_OUTOFMEMORY, "failed to allocate memory for new xml file change list element");
+
+    // Add it to the end of the list
+    if (NULL == *ppxfcHead)
+    {
+        *ppxfcHead = pxfc;
+        *ppxfcTail = pxfc;
+    }
+    else
+    {
+        Assert(*ppxfcTail && (*ppxfcTail)->pxfcNext == NULL);
+        (*ppxfcTail)->pxfcNext = pxfc;
+        pxfc->pxfcPrev = *ppxfcTail;
+        *ppxfcTail = pxfc;
+    }
+
+LExit:
+    return hr;
+}
+
+
+static HRESULT ReadXmlConfigTable(
+    __inout XML_CONFIG_CHANGE** ppxfcHead,
+    __inout XML_CONFIG_CHANGE** ppxfcTail
+    )
+{
+    Assert(ppxfcHead && ppxfcTail);
+
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    PMSIHANDLE hView = NULL;
+    PMSIHANDLE hRec = NULL;
+
+    LPWSTR pwzData = NULL;
+
+    // loop through all the xml configurations
+    hr = WcaOpenExecuteView(vcsXmlConfigQuery, &hView);
+    ExitOnFailure(hr, "failed to open view on Wix4XmlConfig table");
+
+    while (S_OK == (hr = WcaFetchRecord(hView, &hRec)))
+    {
+        hr = AddXmlConfigChangeToList(ppxfcHead, ppxfcTail);
+        ExitOnFailure(hr, "failed to add xml file change to list");
+
+        // Get record Id
+        hr = WcaGetRecordString(hRec, xfqXmlConfig, &pwzData);
+        ExitOnFailure(hr, "failed to get Wix4XmlConfig record Id");
+        hr = StringCchCopyW((*ppxfcTail)->wzId, countof((*ppxfcTail)->wzId), pwzData);
+        ExitOnFailure(hr, "failed to copy Wix4XmlConfig record Id");
+
+        // Get component name
+        hr = WcaGetRecordString(hRec, xfqComponent, &pwzData);
+        ExitOnFailure(hr, "failed to get component name for Wix4XmlConfig: %ls", (*ppxfcTail)->wzId);
+
+        // Get the component's state
+        if (pwzData && *pwzData)
+        {
+            hr = StringCchCopyW((*ppxfcTail)->wzComponent, countof((*ppxfcTail)->wzComponent), pwzData);
+            ExitOnFailure(hr, "failed to copy component id");
+
+            er = ::MsiGetComponentStateW(WcaGetInstallHandle(), (*ppxfcTail)->wzComponent, &(*ppxfcTail)->isInstalled, &(*ppxfcTail)->isAction);
+            ExitOnFailure(hr = HRESULT_FROM_WIN32(er), "failed to get install state for component id");
+        }
+
+        // Get the xml file
+        hr = WcaGetRecordFormattedString(hRec, xfqFile, &pwzData);
+        ExitOnFailure(hr, "failed to get xml file for Wix4XmlConfig: %ls", (*ppxfcTail)->wzId);
+        hr = StringCchCopyW((*ppxfcTail)->wzFile, countof((*ppxfcTail)->wzFile), pwzData);
+        ExitOnFailure(hr, "failed to copy xml file path");
+
+        // Figure out if the file is already on the machine or if it's being installed
+        hr = WcaGetRecordString(hRec, xfqFile, &pwzData);
+        ExitOnFailure(hr, "failed to get xml file for Wix4XmlConfig: %ls", (*ppxfcTail)->wzId);
+        if (NULL != wcsstr(pwzData, L"[!") || NULL != wcsstr(pwzData, L"[#"))
+        {
+            (*ppxfcTail)->fInstalledFile = TRUE;
+        }
+
+        // Get the Wix4XmlConfig table flags
+        hr = WcaGetRecordInteger(hRec, xfqXmlFlags, &(*ppxfcTail)->iXmlFlags);
+        ExitOnFailure(hr, "failed to get Wix4XmlConfig flags for Wix4XmlConfig: %ls", (*ppxfcTail)->wzId);
+
+        // Get the Element Id
+        hr = WcaGetRecordFormattedString(hRec, xfqElementId, &(*ppxfcTail)->pwzElementId);
+        ExitOnFailure(hr, "failed to get Element Id for Wix4XmlConfig: %ls", (*ppxfcTail)->wzId);
+
+        // Get the Element Path
+        hr = WcaGetRecordFormattedString(hRec, xfqElementPath, &(*ppxfcTail)->pwzElementPath);
+        ExitOnFailure(hr, "failed to get Element Path for Wix4XmlConfig: %ls", (*ppxfcTail)->wzId);
+
+        // Get the Verify Path
+        hr = WcaGetRecordFormattedString(hRec, xfqVerifyPath, &(*ppxfcTail)->pwzVerifyPath);
+        ExitOnFailure(hr, "failed to get Verify Path for Wix4XmlConfig: %ls", (*ppxfcTail)->wzId);
+
+        // Get the name
+        hr = WcaGetRecordFormattedString(hRec, xfqName, &pwzData);
+        ExitOnFailure(hr, "failed to get Name for Wix4XmlConfig: %ls", (*ppxfcTail)->wzId);
+        hr = StringCchCopyW((*ppxfcTail)->wzName, countof((*ppxfcTail)->wzName), pwzData);
+        ExitOnFailure(hr, "failed to copy name of element");
+
+        // Get the value
+        hr = WcaGetRecordFormattedString(hRec, xfqValue, &pwzData);
+        ExitOnFailure(hr, "failed to get Value for Wix4XmlConfig: %ls", (*ppxfcTail)->wzId);
+        hr = StrAllocString(&(*ppxfcTail)->pwzValue, pwzData, 0);
+        ExitOnFailure(hr, "failed to allocate buffer for value");
+
+        // Get the component attributes
+        hr = WcaGetRecordInteger(hRec, xfqCompAttributes, &(*ppxfcTail)->iCompAttributes);
+        ExitOnFailure(hr, "failed to get component attributes for Wix4XmlConfig: %ls", (*ppxfcTail)->wzId);
+    }
+
+    // if we looped through all records all is well
+    if (E_NOMOREITEMS == hr)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "failed while looping through all objects to secure");
+
+LExit:
+    ReleaseStr(pwzData);
+
+    return hr;
+}
+
+static HRESULT ProcessChanges(
+    __inout XML_CONFIG_CHANGE** ppxfcHead
+    )
+{
+    Assert(ppxfcHead && *ppxfcHead);
+    HRESULT hr = S_OK;
+
+    XML_CONFIG_CHANGE* pxfc = NULL;
+    XML_CONFIG_CHANGE* pxfcNext = NULL;
+    XML_CONFIG_CHANGE* pxfcCheck = NULL;
+    int cAdditionalChanges = 0;
+    XML_CONFIG_CHANGE* pxfcLast = NULL;
+
+    // If there's only one item in the list, none of this matters
+    if (pxfc && !pxfc->pxfcNext)
+    {
+        ExitFunction();
+    }
+
+    // Loop through the list
+    pxfc = *ppxfcHead;
+    while (pxfc)
+    {
+        // Keep track of where our next spot will be since our current node may be moved
+        pxfcNext = pxfc->pxfcNext;
+
+        // With each node, check to see if it's element path matches the Id of some other node in the list
+        pxfcCheck = *ppxfcHead;
+        while (pxfcCheck)
+        {
+            if (pxfc->pwzElementId)
+            {
+                if (0 == lstrcmpW(pxfc->pwzElementId, pxfcCheck->wzId)
+                    && 0 == pxfc->iXmlFlags
+                    && XMLCONFIG_CREATE & pxfcCheck->iXmlFlags
+                    && XMLCONFIG_ELEMENT & pxfcCheck->iXmlFlags)
+                {
+                    // We found a match.  First, take it out of the current list
+                    if (pxfc->pxfcPrev)
+                    {
+                        pxfc->pxfcPrev->pxfcNext = pxfc->pxfcNext;
+                    }
+                    else // it was the head.  Update the head
+                    {
+                        *ppxfcHead = pxfc->pxfcNext;
+                    }
+
+                    if (pxfc->pxfcNext)
+                    {
+                        pxfc->pxfcNext->pxfcPrev = pxfc->pxfcPrev;
+                    }
+
+                    pxfc->pxfcNext = NULL;
+                    pxfc->pxfcPrev = NULL;
+
+                    // Now, add this node to the end of the matched node's additional changes list
+                    if (!pxfcCheck->pxfcAdditionalChanges)
+                    {
+                        pxfcCheck->pxfcAdditionalChanges = pxfc;
+                        pxfcCheck->cAdditionalChanges = 1;
+                    }
+                    else
+                    {
+                        pxfcLast = pxfcCheck->pxfcAdditionalChanges;
+                        cAdditionalChanges = 1;
+                        while (pxfcLast->pxfcNext)
+                        {
+                            pxfcLast = pxfcLast->pxfcNext;
+                            ++cAdditionalChanges;
+                        }
+                        pxfcLast->pxfcNext = pxfc;
+                        pxfc->pxfcPrev = pxfcLast;
+                        pxfcCheck->cAdditionalChanges = ++cAdditionalChanges;
+                    }
+                }
+                else
+                {
+                    hr = E_NOTFOUND;
+                    ExitOnRootFailure(hr, "failed to find matching ElementId: %ls", pxfc->pwzElementId);
+                }
+            }
+
+            pxfcCheck = pxfcCheck->pxfcNext;
+        }
+
+        pxfc = pxfcNext;
+    }
+
+LExit:
+
+    return hr;
+}
+
+
+static HRESULT BeginChangeFile(
+    __in LPCWSTR pwzFile,
+    __in int iCompAttributes,
+    __inout LPWSTR* ppwzCustomActionData
+    )
+{
+    Assert(pwzFile && *pwzFile && ppwzCustomActionData);
+
+    HRESULT hr = S_OK;
+    BOOL fIs64Bit = iCompAttributes & msidbComponentAttributes64bit;
+
+    LPBYTE pbData = NULL;
+    SIZE_T cbData = 0;
+
+    LPWSTR pwzRollbackCustomActionData = NULL;
+
+    if (fIs64Bit)
+    {
+        hr = WcaWriteIntegerToCaData((int)xaOpenFilex64, ppwzCustomActionData);
+        ExitOnFailure(hr, "failed to write 64-bit file indicator to custom action data");
+    }
+    else
+    {
+        hr = WcaWriteIntegerToCaData((int)xaOpenFile, ppwzCustomActionData);
+        ExitOnFailure(hr, "failed to write file indicator to custom action data");
+    }
+
+    hr = WcaWriteStringToCaData(pwzFile, ppwzCustomActionData);
+    ExitOnFailure(hr, "failed to write file to custom action data: %ls", pwzFile);
+
+    // If the file already exits, then we have to put it back the way it was on failure
+    if (FileExistsEx(pwzFile, NULL))
+    {
+        hr = FileRead(&pbData, &cbData, pwzFile);
+        ExitOnFailure(hr, "failed to read file: %ls", pwzFile);
+
+        // Set up the rollback for this file
+        hr = WcaWriteIntegerToCaData((int)fIs64Bit, &pwzRollbackCustomActionData);
+        ExitOnFailure(hr, "failed to write component bitness to rollback custom action data");
+
+        hr = WcaWriteStringToCaData(pwzFile, &pwzRollbackCustomActionData);
+        ExitOnFailure(hr, "failed to write file name to rollback custom action data: %ls", pwzFile);
+
+        hr = WcaWriteStreamToCaData(pbData, cbData, &pwzRollbackCustomActionData);
+        ExitOnFailure(hr, "failed to write file contents to rollback custom action data.");
+
+        hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"ExecXmlConfigRollback"), pwzRollbackCustomActionData, COST_XMLFILE);
+        ExitOnFailure(hr, "failed to schedule ExecXmlConfigRollback for file: %ls", pwzFile);
+
+        ReleaseStr(pwzRollbackCustomActionData);
+    }
+LExit:
+    ReleaseMem(pbData);
+
+    return hr;
+}
+
+
+static HRESULT WriteChangeData(
+    __in XML_CONFIG_CHANGE* pxfc,
+    __in eXmlAction action,
+    __inout LPWSTR* ppwzCustomActionData
+    )
+{
+    Assert(pxfc && ppwzCustomActionData);
+
+    HRESULT hr = S_OK;
+    XML_CONFIG_CHANGE* pxfcAdditionalChanges = NULL;
+    LPCWSTR wzElementPath = pxfc->pwzElementId ? pxfc->pwzElementId : pxfc->pwzElementPath;
+
+    hr = WcaWriteStringToCaData(wzElementPath, ppwzCustomActionData);
+    ExitOnFailure(hr, "failed to write ElementPath to custom action data: %ls", wzElementPath);
+
+    hr = WcaWriteStringToCaData(pxfc->pwzVerifyPath, ppwzCustomActionData);
+    ExitOnFailure(hr, "failed to write VerifyPath to custom action data: %ls", pxfc->pwzVerifyPath);
+
+    hr = WcaWriteStringToCaData(pxfc->wzName, ppwzCustomActionData);
+    ExitOnFailure(hr, "failed to write Name to custom action data: %ls", pxfc->wzName);
+
+    hr = WcaWriteStringToCaData(pxfc->pwzValue, ppwzCustomActionData);
+    ExitOnFailure(hr, "failed to write Value to custom action data: %ls", pxfc->pwzValue);
+
+    if (pxfc->iXmlFlags & XMLCONFIG_CREATE && pxfc->iXmlFlags & XMLCONFIG_ELEMENT && xaCreateElement == action && pxfc->pxfcAdditionalChanges)
+    {
+        hr = WcaWriteIntegerToCaData(pxfc->cAdditionalChanges, ppwzCustomActionData);
+        ExitOnFailure(hr, "failed to write additional changes value to custom action data");
+
+        pxfcAdditionalChanges = pxfc->pxfcAdditionalChanges;
+        while (pxfcAdditionalChanges)
+        {
+            Assert((0 == lstrcmpW(pxfcAdditionalChanges->wzComponent, pxfc->wzComponent)) && 0 == pxfcAdditionalChanges->iXmlFlags && (0 == lstrcmpW(pxfcAdditionalChanges->wzFile, pxfc->wzFile)));
+
+            hr = WcaWriteStringToCaData(pxfcAdditionalChanges->wzName, ppwzCustomActionData);
+            ExitOnFailure(hr, "failed to write Name to custom action data: %ls", pxfc->wzName);
+
+            hr = WcaWriteStringToCaData(pxfcAdditionalChanges->pwzValue, ppwzCustomActionData);
+            ExitOnFailure(hr, "failed to write Value to custom action data: %ls", pxfc->pwzValue);
+
+            pxfcAdditionalChanges = pxfcAdditionalChanges->pxfcNext;
+        }
+    }
+    else
+    {
+        hr = WcaWriteIntegerToCaData(0, ppwzCustomActionData);
+        ExitOnFailure(hr, "failed to write additional changes value to custom action data");
+    }
+
+LExit:
+    return hr;
+}
+
+
+/******************************************************************
+ SchedXmlConfig - entry point for XmlConfig Custom Action
+
+********************************************************************/
+extern "C" UINT __stdcall SchedXmlConfig(
+    __in MSIHANDLE hInstall
+    )
+{
+//    AssertSz(FALSE, "debug SchedXmlConfig");
+
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    LPWSTR pwzCurrentFile = NULL;
+    BOOL fCurrentFileChanged = FALSE;
+
+    PMSIHANDLE hView = NULL;
+    PMSIHANDLE hRec = NULL;
+
+    XML_CONFIG_CHANGE* pxfcHead = NULL;
+    XML_CONFIG_CHANGE* pxfcTail = NULL; // TODO: do we need this any more?
+    XML_CONFIG_CHANGE* pxfc = NULL;
+
+    eXmlAction xa = xaUnknown;
+    eXmlPreserveDate xd;
+
+    LPWSTR pwzCustomActionData = NULL;
+
+    DWORD cFiles = 0;
+
+    // initialize
+    hr = WcaInitialize(hInstall, "SchedXmlConfig");
+    ExitOnFailure(hr, "failed to initialize");
+
+    hr = ReadXmlConfigTable(&pxfcHead, &pxfcTail);
+    MessageExitOnFailure(hr, msierrXmlConfigFailedRead, "failed to read Wix4XmlConfig table");
+
+    hr = ProcessChanges(&pxfcHead);
+    ExitOnFailure(hr, "failed to process Wix4XmlConfig changes");
+
+    // loop through all the xml configurations
+    for (pxfc = pxfcHead; pxfc; pxfc = pxfc->pxfcNext)
+    {
+        // If this is a different file, or the first file...
+        if (NULL == pwzCurrentFile || 0 != lstrcmpW(pwzCurrentFile, pxfc->wzFile))
+        {
+            // Remember the file we're currently working on
+            hr = StrAllocString(&pwzCurrentFile, pxfc->wzFile, 0);
+            ExitOnFailure(hr, "failed to copy file name");
+
+            fCurrentFileChanged = TRUE;
+        }
+
+        //
+        // Figure out what action to take
+        //
+        xa = xaUnknown;
+
+        // If it's being installed or reinstalled or uninstalled and that matches
+        // what we are doing then calculate the right action.
+        if ((XMLCONFIG_INSTALL & pxfc->iXmlFlags && (WcaIsInstalling(pxfc->isInstalled, pxfc->isAction) || WcaIsReInstalling(pxfc->isInstalled, pxfc->isAction))) ||
+            (XMLCONFIG_UNINSTALL & pxfc->iXmlFlags && WcaIsUninstalling(pxfc->isInstalled, pxfc->isAction)))
+        {
+            if (XMLCONFIG_CREATE & pxfc->iXmlFlags && XMLCONFIG_ELEMENT & pxfc->iXmlFlags)
+            {
+                xa = xaCreateElement;
+            }
+            else if (XMLCONFIG_DELETE & pxfc->iXmlFlags && XMLCONFIG_ELEMENT & pxfc->iXmlFlags)
+            {
+                xa = xaDeleteElement;
+            }
+            else if (XMLCONFIG_DELETE & pxfc->iXmlFlags && XMLCONFIG_VALUE & pxfc->iXmlFlags)
+            {
+                xa = xaDeleteValue;
+            }
+            else if (XMLCONFIG_CREATE & pxfc->iXmlFlags && XMLCONFIG_VALUE & pxfc->iXmlFlags)
+            {
+                xa = xaWriteValue;
+            }
+            else if (XMLCONFIG_CREATE & pxfc->iXmlFlags && XMLCONFIG_DOCUMENT & pxfc->iXmlFlags)
+            {
+                xa = xaWriteDocument;
+            }
+            else if (XMLCONFIG_DELETE & pxfc->iXmlFlags && XMLCONFIG_DOCUMENT & pxfc->iXmlFlags)
+            {
+                hr = E_INVALIDARG;
+                ExitOnFailure(hr, "Invalid flag configuration.  Cannot delete a fragment node.");
+            }
+        }
+
+        if (XMLCONFIG_PRESERVE_MODIFIED & pxfc->iXmlFlags)
+        {
+            xd = xdPreserve;
+        }
+        else
+        {
+            xd= xdDontPreserve;
+        }
+
+        if (xaUnknown != xa)
+        {
+            if (fCurrentFileChanged)
+            {
+                hr = BeginChangeFile(pwzCurrentFile, pxfc->iCompAttributes, &pwzCustomActionData);
+                ExitOnFailure(hr, "failed to begin file change for file: %ls", pwzCurrentFile);
+
+                fCurrentFileChanged = FALSE;
+                ++cFiles;
+            }
+
+            hr = WcaWriteIntegerToCaData((int)xa, &pwzCustomActionData);
+            ExitOnFailure(hr, "failed to write action indicator custom action data");
+
+            hr = WcaWriteIntegerToCaData((int)xd, &pwzCustomActionData);
+            ExitOnFailure(hr, "failed to write Preserve Date indicator to custom action data");
+
+            hr = WriteChangeData(pxfc, xa, &pwzCustomActionData);
+            ExitOnFailure(hr, "failed to write change data");
+        }
+    }
+
+    // If we looped through all records all is well
+    if (E_NOMOREITEMS == hr)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "failed while looping through all objects to secure");
+
+    // Schedule the custom action and add to progress bar
+    if (pwzCustomActionData && *pwzCustomActionData)
+    {
+        Assert(0 < cFiles);
+
+        hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"ExecXmlConfig"), pwzCustomActionData, cFiles * COST_XMLFILE);
+        ExitOnFailure(hr, "failed to schedule ExecXmlConfig action");
+    }
+
+LExit:
+    ReleaseStr(pwzCurrentFile);
+    ReleaseStr(pwzCustomActionData);
+
+    FreeXmlConfigChangeList(pxfcHead);
+
+    if (FAILED(hr))
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+    return WcaFinalize(er);
+}
+
+
+/******************************************************************
+ ExecXmlConfig - entry point for XmlConfig Custom Action
+
+*******************************************************************/
+extern "C" UINT __stdcall ExecXmlConfig(
+    __in MSIHANDLE hInstall
+    )
+{
+    //AssertSz(FALSE, "debug ExecXmlConfig");
+    HRESULT hr = S_OK;
+    HRESULT hrOpenFailure = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+#ifndef _WIN64
+    BOOL fIsFSRedirectDisabled = FALSE;
+#endif
+    BOOL fPreserveDate = FALSE;
+
+    LPWSTR pwzCustomActionData = NULL;
+    LPWSTR pwzData = NULL;
+    LPWSTR pwzFile = NULL;
+    LPWSTR pwzElementPath = NULL;
+    LPWSTR pwzVerifyPath = NULL;
+    LPWSTR pwzName = NULL;
+    LPWSTR pwzValue = NULL;
+    LPWSTR pwz = NULL;
+    int cAdditionalChanges = 0;
+
+    IXMLDOMDocument* pixd = NULL;
+    IXMLDOMNode* pixn = NULL;
+    IXMLDOMNode* pixnVerify = NULL;
+    IXMLDOMNode* pixnNewNode = NULL;
+    IXMLDOMNode* pixnRemovedChild = NULL;
+
+    IXMLDOMDocument* pixdNew = NULL;
+    IXMLDOMElement* pixeNew = NULL;
+
+    FILETIME ft;
+
+    int id = IDRETRY;
+
+    eXmlAction xa;
+    eXmlPreserveDate xd;
+
+    // initialize
+    hr = WcaInitialize(hInstall, "ExecXmlConfig");
+    ExitOnFailure(hr, "failed to initialize");
+
+    hr = XmlInitialize();
+    ExitOnFailure(hr, "failed to initialize xml utilities");
+
+    hr = WcaGetProperty( L"CustomActionData", &pwzCustomActionData);
+    ExitOnFailure(hr, "failed to get CustomActionData");
+
+    WcaLog(LOGMSG_TRACEONLY, "CustomActionData: %ls", pwzCustomActionData);
+
+    pwz = pwzCustomActionData;
+
+    hr = WcaReadIntegerFromCaData(&pwz, (int*) &xa);
+    ExitOnFailure(hr, "failed to process CustomActionData");
+
+#ifndef _WIN64
+    // Initialize the Wow64 API - store the result in fWow64APIPresent
+    // If it fails, this doesn't warrant an error yet, because we only need the Wow64 API in some cases
+    WcaInitializeWow64();
+    BOOL fIsWow64Process = WcaIsWow64Process();
+#endif
+
+    if (xaOpenFile != xa && xaOpenFilex64 != xa)
+    {
+        ExitOnFailure(hr = E_INVALIDARG, "invalid custom action data");
+    }
+
+    // loop through all the passed in data
+    while (pwz && *pwz)
+    {
+        hr = WcaReadStringFromCaData(&pwz, &pwzFile);
+        ExitOnFailure(hr, "failed to read file name from custom action data");
+
+        // Default to not preserve date, preserve it if any modifications require us to
+        fPreserveDate = FALSE;
+
+        // Open the file
+        ReleaseNullObject(pixd);
+
+#ifndef _WIN64
+        if (xaOpenFilex64 == xa)
+        {
+            if (!fIsWow64Process)
+            {
+                hr = E_NOTIMPL;
+                ExitOnFailure(hr, "Custom action was told to act on a 64-bit component, but the custom action process is not running in WOW.");
+            }
+
+            hr = WcaDisableWow64FSRedirection();
+            ExitOnFailure(hr, "Custom action was told to act on a 64-bit component, but was unable to disable filesystem redirection through the Wow64 API.");
+
+            fIsFSRedirectDisabled = TRUE;
+        }
+#endif
+
+        hr = XmlLoadDocumentFromFileEx(pwzFile, XML_LOAD_PRESERVE_WHITESPACE, &pixd);
+        if (FAILED(hr))
+        {
+            // Ignore the return code for now.  If they try to add something, we'll fail the install.  If all they do is remove stuff then it doesn't matter.
+            hrOpenFailure = hr;
+            hr = S_OK;
+        }
+        else
+        {
+            hrOpenFailure = S_OK;
+        }
+
+        WcaLog(LOGMSG_VERBOSE, "Configuring Xml File: %ls", pwzFile);
+
+        while (pwz && *pwz)
+        {
+            // If we skip past an element that has additional changes we need to strip them off the stream before
+            // moving on to the next element. Do that now and then restart the outer loop.
+            if (cAdditionalChanges > 0)
+            {
+                while (cAdditionalChanges > 0)
+                {
+                    hr = WcaReadStringFromCaData(&pwz, &pwzName);
+                    ExitOnFailure(hr, "failed to process CustomActionData");
+                    hr = WcaReadStringFromCaData(&pwz, &pwzValue);
+                    ExitOnFailure(hr, "failed to process CustomActionData");
+
+                    cAdditionalChanges--;
+                }
+                continue;
+            }
+
+            hr = WcaReadIntegerFromCaData(&pwz, (int*) &xa);
+            ExitOnFailure(hr, "failed to process CustomActionData");
+
+            // Break if we need to move on to a different file
+            if (xaOpenFile == xa || xaOpenFilex64 == xa)
+            {
+                break;
+            }
+
+            hr = WcaReadIntegerFromCaData(&pwz, (int*) &xd);
+            ExitOnFailure(hr, "failed to process CustomActionData");
+
+            if (xdPreserve == xd)
+            {
+                fPreserveDate = TRUE;
+            }
+
+            // Get path, name, and value to be written
+            hr = WcaReadStringFromCaData(&pwz, &pwzElementPath);
+            ExitOnFailure(hr, "failed to process CustomActionData");
+            hr = WcaReadStringFromCaData(&pwz, &pwzVerifyPath);
+            ExitOnFailure(hr, "failed to process CustomActionData");
+            hr = WcaReadStringFromCaData(&pwz, &pwzName);
+            ExitOnFailure(hr, "failed to process CustomActionData");
+            hr = WcaReadStringFromCaData(&pwz, &pwzValue);
+            ExitOnFailure(hr, "failed to process CustomActionData");
+            hr = WcaReadIntegerFromCaData(&pwz, &cAdditionalChanges);
+            ExitOnFailure(hr, "failed to process CustomActionData");
+
+            // If we failed to open the file and we're adding something to the file, we've got a problem.  Otherwise, just continue on since the file's already gone.
+            if (FAILED(hrOpenFailure))
+            {
+                if (xaCreateElement == xa || xaWriteValue == xa || xaWriteDocument == xa)
+                {
+                    MessageExitOnFailure(hr = hrOpenFailure, msierrXmlConfigFailedOpen, "failed to load XML file: %ls", pwzFile);
+                }
+                else
+                {
+                    continue;
+                }
+            }
+
+            // Select the node we're about to modify
+            ReleaseNullObject(pixn);
+
+            hr = XmlSelectSingleNode(pixd, pwzElementPath, &pixn);
+
+            // If we failed to find the node that we are going to add to, we've got a problem. Otherwise, just continue since the node's already gone.
+            if (S_FALSE == hr)
+            {
+                if (xaCreateElement == xa || xaWriteValue == xa || xaWriteDocument == xa)
+                {
+                    hr = HRESULT_FROM_WIN32(ERROR_OBJECT_NOT_FOUND);
+                }
+                else
+                {
+                    hr = S_OK;
+                    continue;
+                }
+            }
+
+            MessageExitOnFailure(hr, msierrXmlConfigFailedSelect, "failed to find node: %ls in XML file: %ls", pwzElementPath, pwzFile);
+
+            // Make the modification
+            switch (xa)
+            {
+            case xaWriteValue:
+                if (pwzName && *pwzName)
+                {
+                    // We're setting an attribute
+                    hr = XmlSetAttribute(pixn, pwzName, pwzValue);
+                    ExitOnFailure(hr, "failed to set attribute: %ls to value %ls", pwzName, pwzValue);
+                }
+                else
+                {
+                    // We're setting the text of the node
+                    hr = XmlSetText(pixn, pwzValue);
+                    ExitOnFailure(hr, "failed to set text to: %ls for element %ls.  Make sure that XPath points to an element.", pwzValue, pwzElementPath);
+                }
+                break;
+            case xaWriteDocument:
+                if (NULL != pwzVerifyPath && 0 != pwzVerifyPath[0])
+                {
+                    hr = XmlSelectSingleNode(pixn, pwzVerifyPath, &pixnVerify);
+                    if (S_OK == hr)
+                    {
+                        // We found the verify path which means we have no further work to do
+                        continue;
+                    }
+                    ExitOnFailure(hr, "failed to query verify path: %ls", pwzVerifyPath);
+                }
+
+                hr = XmlLoadDocumentEx(pwzValue, XML_LOAD_PRESERVE_WHITESPACE, &pixdNew);
+                ExitOnFailure(hr, "Failed to load value as document.");
+
+                hr = pixdNew->get_documentElement(&pixeNew);
+                ExitOnFailure(hr, "Failed to get document element.");
+
+                hr = pixn->appendChild(pixeNew, NULL);
+                ExitOnFailure(hr, "Failed to append document element on to parent element.");
+
+                ReleaseNullObject(pixeNew);
+                ReleaseNullObject(pixdNew);
+                break;
+
+            case xaCreateElement:
+                if (NULL != pwzVerifyPath && 0 != pwzVerifyPath[0])
+                {
+                    hr = XmlSelectSingleNode(pixn, pwzVerifyPath, &pixnVerify);
+                    if (S_OK == hr)
+                    {
+                        // We found the verify path which means we have no further work to do
+                        continue;
+                    }
+                    ExitOnFailure(hr, "failed to query verify path: %ls", pwzVerifyPath);
+                }
+
+                hr = XmlCreateChild(pixn, pwzName, &pixnNewNode);
+                ExitOnFailure(hr, "failed to create child element: %ls", pwzName);
+
+                if (pwzValue && *pwzValue)
+                {
+                    hr = XmlSetText(pixnNewNode, pwzValue);
+                    ExitOnFailure(hr, "failed to set text to: %ls for node: %ls", pwzValue, pwzName);
+                }
+
+                while (cAdditionalChanges > 0)
+                {
+                    hr = WcaReadStringFromCaData(&pwz, &pwzName);
+                    ExitOnFailure(hr, "failed to process CustomActionData");
+                    hr = WcaReadStringFromCaData(&pwz, &pwzValue);
+                    ExitOnFailure(hr, "failed to process CustomActionData");
+
+                    // Set the additional attribute
+                    hr = XmlSetAttribute(pixnNewNode, pwzName, pwzValue);
+                    ExitOnFailure(hr, "failed to set attribute: %ls to value %ls", pwzName, pwzValue);
+
+                    cAdditionalChanges--;
+                }
+
+                ReleaseNullObject(pixnNewNode);
+                break;
+            case xaDeleteValue:
+                if (pwzName && *pwzName)
+                {
+                    // Delete the attribute
+                    hr = XmlRemoveAttribute(pixn, pwzName);
+                    ExitOnFailure(hr, "failed to remove attribute: %ls", pwzName);
+                }
+                else
+                {
+                    // Clear the text value for the node
+                    hr = XmlSetText(pixn, L"");
+                    ExitOnFailure(hr, "failed to clear text value");
+                }
+                break;
+            case xaDeleteElement:
+                if (NULL != pwzVerifyPath && 0 != pwzVerifyPath[0])
+                {
+                    hr = XmlSelectSingleNode(pixn, pwzVerifyPath, &pixnVerify);
+                    if (S_OK == hr)
+                    {
+                        hr = pixn->removeChild(pixnVerify, &pixnRemovedChild);
+                        ExitOnFailure(hr, "failed to remove created child element");
+
+                        ReleaseNullObject(pixnRemovedChild);
+                    }
+                    else
+                    {
+                        WcaLog(LOGMSG_VERBOSE, "Failed to select path %ls for deleting.  Skipping...", pwzVerifyPath);
+                        hr = S_OK;
+                    }
+                }
+                else
+                {
+                    // TODO: This requires a VerifyPath to delete an element.  Should we support not having one?
+                    WcaLog(LOGMSG_VERBOSE, "No VerifyPath specified for delete element of ID: %ls", pwzElementPath);
+                }
+                break;
+            default:
+                ExitOnFailure(hr = E_UNEXPECTED, "Invalid modification specified in custom action data");
+                break;
+            }
+        }
+
+
+        // Now that we've made all of the changes to this file, save it and move on to the next
+        if (S_OK == hrOpenFailure)
+        {
+            if (fPreserveDate)
+            {
+                hr = FileGetTime(pwzFile, NULL, NULL, &ft);
+                ExitOnFailure(hr, "failed to get modified time of file : %ls", pwzFile);
+            }
+
+            int iSaveAttempt = 0;
+
+            do
+            {
+                hr = XmlSaveDocument(pixd, pwzFile);
+                if (FAILED(hr))
+                {
+                    id = WcaErrorMessage(msierrXmlConfigFailedSave, hr, INSTALLMESSAGE_ERROR | MB_ABORTRETRYIGNORE, 1, pwzFile);
+                    switch (id)
+                    {
+                    case IDABORT:
+                        ExitOnFailure(hr, "Failed to save changes to XML file: %ls", pwzFile);
+                    case IDRETRY:
+                        hr = S_FALSE;   // hit me, baby, one more time
+                        break;
+                    case IDIGNORE:
+                        hr = S_OK;  // pretend everything is okay and bail
+                        break;
+                    case 0: // No UI case, MsiProcessMessage returns 0
+                        if (STIERR_SHARING_VIOLATION == hr)
+                        {
+                            // Only in case of sharing violation do we retry 30 times, once a second.
+                            if (iSaveAttempt < 30)
+                            {
+                                hr = S_FALSE;
+                                ++iSaveAttempt;
+                                WcaLog(LOGMSG_VERBOSE, "Unable to save changes to XML file: %ls, retry attempt: %x", pwzFile, iSaveAttempt);
+                                Sleep(1000);
+                            }
+                            else
+                            {
+                                ExitOnFailure(hr, "Failed to save changes to XML file: %ls", pwzFile);
+                            }
+                        }
+                        break;
+                    default: // Unknown error
+                        ExitOnFailure(hr, "Failed to save changes to XML file: %ls", pwzFile);
+                    }
+                }
+            } while (S_FALSE == hr);
+
+            if (fPreserveDate)
+            {
+                hr = FileSetTime(pwzFile, NULL, NULL, &ft);
+                ExitOnFailure(hr, "failed to set modified time of file : %ls", pwzFile);
+            }
+
+#ifndef _WIN64
+            if (fIsFSRedirectDisabled)
+            {
+                fIsFSRedirectDisabled = FALSE;
+                WcaRevertWow64FSRedirection();
+            }
+#endif
+        }
+    }
+
+LExit:
+#ifndef _WIN64
+    // Make sure we revert FS Redirection if necessary before exiting
+    if (fIsFSRedirectDisabled)
+    {
+        fIsFSRedirectDisabled = FALSE;
+        WcaRevertWow64FSRedirection();
+    }
+    WcaFinalizeWow64();
+#endif
+
+    ReleaseStr(pwzCustomActionData);
+    ReleaseStr(pwzData);
+    ReleaseStr(pwzFile);
+    ReleaseStr(pwzElementPath);
+    ReleaseStr(pwzVerifyPath);
+    ReleaseStr(pwzName);
+    ReleaseStr(pwzValue);
+
+    ReleaseObject(pixeNew);
+    ReleaseObject(pixdNew);
+
+    ReleaseObject(pixn);
+    ReleaseObject(pixd);
+    ReleaseObject(pixnNewNode);
+    ReleaseObject(pixnRemovedChild);
+
+    XmlUninitialize();
+
+    if (FAILED(hr))
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+    return WcaFinalize(er);
+}
+
+
+/******************************************************************
+ ExecXmlConfigRollback - entry point for XmlConfig rollback Custom Action
+
+*******************************************************************/
+extern "C" UINT __stdcall ExecXmlConfigRollback(
+    __in MSIHANDLE hInstall
+    )
+{
+//    AssertSz(FALSE, "debug ExecXmlConfigRollback");
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    int iIs64Bit;
+#ifndef _WIN64
+    BOOL fIs64Bit = FALSE;
+#endif
+
+    LPWSTR pwzCustomActionData = NULL;
+    LPWSTR pwz = NULL;
+    LPWSTR pwzFileName = NULL;
+    LPBYTE pbData = NULL;
+    DWORD_PTR cbData = 0;
+
+    FILETIME ft;
+
+    HANDLE hFile = INVALID_HANDLE_VALUE;
+
+    // initialize
+    hr = WcaInitialize(hInstall, "ExecXmlConfigRollback");
+    ExitOnFailure(hr, "failed to initialize");
+
+
+    hr = WcaGetProperty( L"CustomActionData", &pwzCustomActionData);
+    ExitOnFailure(hr, "failed to get CustomActionData");
+
+    WcaLog(LOGMSG_TRACEONLY, "CustomActionData: %ls", pwzCustomActionData);
+
+    pwz = pwzCustomActionData;
+
+    hr = WcaReadIntegerFromCaData(&pwz, &iIs64Bit);
+    ExitOnFailure(hr, "failed to read component bitness from custom action data");
+
+    hr = WcaReadStringFromCaData(&pwz, &pwzFileName);
+    ExitOnFailure(hr, "failed to read file name from custom action data");
+
+    hr = WcaReadStreamFromCaData(&pwz, &pbData, &cbData);
+    ExitOnFailure(hr, "failed to read file contents from custom action data");
+
+#ifndef _WIN64
+    fIs64Bit = (BOOL)iIs64Bit;
+
+    if (fIs64Bit)
+    {
+        hr = WcaInitializeWow64();
+        if (S_FALSE == hr)
+        {
+            hr = TYPE_E_DLLFUNCTIONNOTFOUND;
+        }
+        ExitOnFailure(hr, "failed to initialize Wow64 API");
+
+        if (!WcaIsWow64Process())
+        {
+            hr = E_NOTIMPL;
+            ExitOnFailure(hr, "Custom action was told to rollback a 64-bit component, but the Wow64 API is unavailable.");
+        }
+
+        hr = WcaDisableWow64FSRedirection();
+        ExitOnFailure(hr, "Custom action was told to rollback a 64-bit component, but was unable to Disable Filesystem Redirection through the Wow64 API.");
+    }
+#endif
+
+    hr = FileGetTime(pwzFileName, NULL, NULL, &ft);
+    ExitOnFailure(hr, "Failed to get modified date of file %ls.", pwzFileName);
+
+    // Open the file
+    hFile = ::CreateFileW(pwzFileName, GENERIC_WRITE, NULL, NULL, TRUNCATE_EXISTING, NULL, NULL);
+    ExitOnInvalidHandleWithLastError(hFile, hr, "failed to open file: %ls", pwzFileName);
+
+    // Write out the old data
+    hr = FileWriteHandle(hFile, pbData, cbData);
+    ExitOnFailure(hr, "failed to write to file: %ls", pwzFileName);
+
+    ReleaseFile(hFile);
+
+    hr = FileSetTime(pwzFileName, NULL, NULL, &ft);
+    ExitOnFailure(hr, "Failed to set modified date of file %ls.", pwzFileName);
+
+LExit:
+    ReleaseStr(pwzCustomActionData);
+    ReleaseStr(pwzFileName);
+
+    ReleaseFile(hFile);
+
+#ifndef _WIN64
+    if (fIs64Bit)
+    {
+        WcaRevertWow64FSRedirection();
+        WcaFinalizeWow64();
+    }
+#endif
+
+    ReleaseMem(pbData);
+
+    if (FAILED(hr))
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+    return WcaFinalize(er);
+}
diff --git a/src/ext/Util/ca/XmlFile.cpp b/src/ext/Util/ca/XmlFile.cpp
new file mode 100644
index 00000000..04a4ae98
--- /dev/null
+++ b/src/ext/Util/ca/XmlFile.cpp
@@ -0,0 +1,940 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+#define XMLFILE_CREATE_ELEMENT 0x00000001
+#define XMLFILE_DELETE_VALUE 0x00000002
+#define XMLFILE_BULKWRITE_VALUE 0x00000004
+
+#define XMLFILE_DONT_UNINSTALL 0x00010000
+#define XMLFILE_PRESERVE_MODIFIED 0x00001000
+#define XMLFILE_USE_XPATH 0x00000100
+
+extern BOOL vfMsxml30;
+
+enum eXmlAction
+{
+    xaOpenFile = 1,
+    xaOpenFilex64,
+    xaWriteValue,
+    xaDeleteValue,
+    xaCreateElement,
+    xaDeleteElement,
+    xaBulkWriteValue,
+};
+
+enum eXmlPreserveDate
+{
+    xdDontPreserve = 0,
+    xdPreserve
+};
+
+enum eXmlSelectionLanguage
+{
+    xsXSLPattern = 0,
+    xsXPath = 1,
+};
+
+LPCWSTR vcsXmlFileQuery =
+    L"SELECT `Wix4XmlFile`.`Wix4XmlFile`, `Wix4XmlFile`.`File`, `Wix4XmlFile`.`ElementPath`, `Wix4XmlFile`.`Name`, `Wix4XmlFile`.`Value`, "
+    L"`Wix4XmlFile`.`Flags`, `Wix4XmlFile`.`Component_`, `Component`.`Attributes` "
+    L"FROM `Wix4XmlFile`,`Component` WHERE `Wix4XmlFile`.`Component_`=`Component`.`Component` ORDER BY `File`, `Sequence`";
+enum eXmlFileQuery { xfqXmlFile = 1, xfqFile, xfqXPath, xfqName, xfqValue, xfqXmlFlags, xfqComponent, xfqCompAttributes  };
+
+struct XML_FILE_CHANGE
+{
+    WCHAR wzId[MAX_DARWIN_KEY];
+
+    INSTALLSTATE isInstalled;
+    INSTALLSTATE isAction;
+
+    WCHAR wzFile[MAX_PATH];
+    LPWSTR pwzElementPath;
+    WCHAR wzName[MAX_DARWIN_COLUMN];
+    LPWSTR pwzValue;
+
+    int iXmlFlags;
+    int iCompAttributes;
+
+    XML_FILE_CHANGE* pxfcPrev;
+    XML_FILE_CHANGE* pxfcNext;
+};
+
+//static HRESULT FreeXmlFileChangeList(
+//    __in XML_FILE_CHANGE* pxfcList
+//    )
+//{
+//    HRESULT hr = S_OK;
+//
+//    XML_FILE_CHANGE* pxfcDelete;
+//    while(pxfcList)
+//    {
+//        pxfcDelete = pxfcList;
+//        pxfcList = pxfcList->pxfcNext;
+//
+//        ReleaseStr(pxfcDelete->pwzElementPath);
+//        ReleaseStr(pxfcDelete->pwzValue);
+//
+//        hr = MemFree(pxfcDelete);
+//        ExitOnFailure(hr, "failed to free xml file change list item");
+//    }
+//
+//LExit:
+//    return hr;
+//}
+
+static HRESULT AddXmlFileChangeToList(
+    __inout XML_FILE_CHANGE** ppxfcHead,
+    __inout XML_FILE_CHANGE** ppxfcTail
+    )
+{
+    Assert(ppxfcHead && ppxfcTail);
+
+    HRESULT hr = S_OK;
+
+    XML_FILE_CHANGE* pxfc = static_cast<XML_FILE_CHANGE*>(MemAlloc(sizeof(XML_FILE_CHANGE), TRUE));
+    ExitOnNull(pxfc, hr, E_OUTOFMEMORY, "failed to allocate memory for new xml file change list element");
+
+    // Add it to the end of the list
+    if (NULL == *ppxfcHead)
+    {
+        *ppxfcHead = pxfc;
+        *ppxfcTail = pxfc;
+    }
+    else
+    {
+        Assert(*ppxfcTail && (*ppxfcTail)->pxfcNext == NULL);
+        (*ppxfcTail)->pxfcNext = pxfc;
+        pxfc->pxfcPrev = *ppxfcTail;
+        *ppxfcTail = pxfc;
+    }
+
+LExit:
+    return hr;
+}
+
+
+static HRESULT ReadXmlFileTable(
+    __inout XML_FILE_CHANGE** ppxfcHead,
+    __inout XML_FILE_CHANGE** ppxfcTail
+    )
+{
+    Assert(ppxfcHead && ppxfcTail);
+
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    PMSIHANDLE hView = NULL;
+    PMSIHANDLE hRec = NULL;
+
+    LPWSTR pwzData = NULL;
+
+    // check to see if necessary tables are specified
+    if (S_FALSE == WcaTableExists(L"Wix4XmlFile"))
+    {
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    // loop through all the xml configurations
+    hr = WcaOpenExecuteView(vcsXmlFileQuery, &hView);
+    ExitOnFailure(hr, "failed to open view on Wix4XmlFile table");
+
+    while (S_OK == (hr = WcaFetchRecord(hView, &hRec)))
+    {
+        hr = AddXmlFileChangeToList(ppxfcHead, ppxfcTail);
+        ExitOnFailure(hr, "failed to add xml file change to list");
+
+        // Get record Id
+        hr = WcaGetRecordString(hRec, xfqXmlFile, &pwzData);
+        ExitOnFailure(hr, "failed to get Wix4XmlFile record Id");
+        hr = StringCchCopyW((*ppxfcTail)->wzId, countof((*ppxfcTail)->wzId), pwzData);
+        ExitOnFailure(hr, "failed to copy Wix4XmlFile record Id");
+
+        // Get component name
+        hr = WcaGetRecordString(hRec, xfqComponent, &pwzData);
+        ExitOnFailure(hr, "failed to get component name for Wix4XmlFile: %ls", (*ppxfcTail)->wzId);
+
+        // Get the component's state
+        er = ::MsiGetComponentStateW(WcaGetInstallHandle(), pwzData, &(*ppxfcTail)->isInstalled, &(*ppxfcTail)->isAction);
+        ExitOnFailure(hr = HRESULT_FROM_WIN32(er), "failed to get install state for Component: %ls", pwzData);
+
+        // Get the xml file
+        hr = WcaGetRecordFormattedString(hRec, xfqFile, &pwzData);
+        ExitOnFailure(hr, "failed to get xml file for Wix4XmlFile: %ls", (*ppxfcTail)->wzId);
+        hr = StringCchCopyW((*ppxfcTail)->wzFile, countof((*ppxfcTail)->wzFile), pwzData);
+        ExitOnFailure(hr, "failed to copy xml file path");
+
+        // Get the Wix4XmlFile table flags
+        hr = WcaGetRecordInteger(hRec, xfqXmlFlags, &(*ppxfcTail)->iXmlFlags);
+        ExitOnFailure(hr, "failed to get Wix4XmlFile flags for Wix4XmlFile: %ls", (*ppxfcTail)->wzId);
+
+        // Get the XPath
+        hr = WcaGetRecordFormattedString(hRec, xfqXPath, &(*ppxfcTail)->pwzElementPath);
+        ExitOnFailure(hr, "failed to get XPath for Wix4XmlFile: %ls", (*ppxfcTail)->wzId);
+
+        // Get the name
+        hr = WcaGetRecordFormattedString(hRec, xfqName, &pwzData);
+        ExitOnFailure(hr, "failed to get Name for Wix4XmlFile: %ls", (*ppxfcTail)->wzId);
+        hr = StringCchCopyW((*ppxfcTail)->wzName, countof((*ppxfcTail)->wzName), pwzData);
+        ExitOnFailure(hr, "failed to copy name of element");
+
+        // Get the value
+        hr = WcaGetRecordFormattedString(hRec, xfqValue, &pwzData);
+        ExitOnFailure(hr, "failed to get Value for Wix4XmlFile: %ls", (*ppxfcTail)->wzId);
+        hr = StrAllocString(&(*ppxfcTail)->pwzValue, pwzData, 0);
+        ExitOnFailure(hr, "failed to allocate buffer for value");
+
+        // Get the component attributes
+        hr = WcaGetRecordInteger(hRec, xfqCompAttributes, &(*ppxfcTail)->iCompAttributes);
+        ExitOnFailure(hr, "failed to get component attributes for Wix4XmlFile: %ls", (*ppxfcTail)->wzId);
+    }
+
+    // if we looped through all records all is well
+    if (E_NOMOREITEMS == hr)
+        hr = S_OK;
+    ExitOnFailure(hr, "failed while looping through all objects to secure");
+
+LExit:
+    ReleaseStr(pwzData);
+
+    return hr;
+}
+
+
+static HRESULT BeginChangeFile(
+    __in LPCWSTR pwzFile,
+    __in XML_FILE_CHANGE* pxfc,
+    __inout LPWSTR* ppwzCustomActionData
+    )
+{
+    Assert(pwzFile && *pwzFile && ppwzCustomActionData);
+
+    HRESULT hr = S_OK;
+    BOOL fIs64Bit = pxfc->iCompAttributes & msidbComponentAttributes64bit;
+    BOOL fUseXPath = pxfc->iXmlFlags & XMLFILE_USE_XPATH;
+    LPBYTE pbData = NULL;
+    SIZE_T cbData = 0;
+
+    LPWSTR pwzRollbackCustomActionData = NULL;
+
+    if (fIs64Bit)
+    {
+        hr = WcaWriteIntegerToCaData((int)xaOpenFilex64, ppwzCustomActionData);
+        ExitOnFailure(hr, "failed to write 64-bit file indicator to custom action data");
+    }
+    else
+    {
+        hr = WcaWriteIntegerToCaData((int)xaOpenFile, ppwzCustomActionData);
+        ExitOnFailure(hr, "failed to write file indicator to custom action data");
+    }
+    if (fUseXPath)
+    {
+        hr = WcaWriteIntegerToCaData((int)xsXPath, ppwzCustomActionData);
+        ExitOnFailure(hr, "failed to write XPath selectionlanguage indicator to custom action data");
+    }
+    else
+    {
+        hr = WcaWriteIntegerToCaData((int)xsXSLPattern, ppwzCustomActionData);
+        ExitOnFailure(hr, "failed to write XSLPattern selectionlanguage indicator to custom action data");
+    }
+    hr = WcaWriteStringToCaData(pwzFile, ppwzCustomActionData);
+    ExitOnFailure(hr, "failed to write file to custom action data: %ls", pwzFile);
+
+    // If the file already exits, then we have to put it back the way it was on failure
+    if (FileExistsEx(pwzFile, NULL))
+    {
+        hr = FileRead(&pbData, &cbData, pwzFile);
+        ExitOnFailure(hr, "failed to read file: %ls", pwzFile);
+
+        // Set up the rollback for this file
+        hr = WcaWriteIntegerToCaData((int)fIs64Bit, &pwzRollbackCustomActionData);
+        ExitOnFailure(hr, "failed to write component bitness to rollback custom action data");
+
+        hr = WcaWriteStringToCaData(pwzFile, &pwzRollbackCustomActionData);
+        ExitOnFailure(hr, "failed to write file name to rollback custom action data: %ls", pwzFile);
+
+        hr = WcaWriteStreamToCaData(pbData, cbData, &pwzRollbackCustomActionData);
+        ExitOnFailure(hr, "failed to write file contents to rollback custom action data.");
+
+        hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"ExecXmlFileRollback"), pwzRollbackCustomActionData, COST_XMLFILE);
+        ExitOnFailure(hr, "failed to schedule ExecXmlFileRollback for file: %ls", pwzFile);
+
+        ReleaseStr(pwzRollbackCustomActionData);
+    }
+LExit:
+    ReleaseMem(pbData);
+
+    return hr;
+}
+
+
+static HRESULT WriteChangeData(
+    __in XML_FILE_CHANGE* pxfc,
+    __inout LPWSTR* ppwzCustomActionData
+    )
+{
+    Assert(pxfc && ppwzCustomActionData);
+
+    HRESULT hr = S_OK;
+
+    hr = WcaWriteStringToCaData(pxfc->pwzElementPath, ppwzCustomActionData);
+    ExitOnFailure(hr, "failed to write ElementPath to custom action data: %ls", pxfc->pwzElementPath);
+
+    hr = WcaWriteStringToCaData(pxfc->wzName, ppwzCustomActionData);
+    ExitOnFailure(hr, "failed to write Name to custom action data: %ls", pxfc->wzName);
+
+    hr = WcaWriteStringToCaData(pxfc->pwzValue, ppwzCustomActionData);
+    ExitOnFailure(hr, "failed to write Value to custom action data: %ls", pxfc->pwzValue);
+
+LExit:
+    return hr;
+}
+
+
+/******************************************************************
+ SchedXmlFile - entry point for XmlFile Custom Action
+
+********************************************************************/
+extern "C" UINT __stdcall SchedXmlFile(
+    __in MSIHANDLE hInstall
+    )
+{
+//    AssertSz(FALSE, "debug SchedXmlFile");
+
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    LPWSTR pwzCurrentFile = NULL;
+    BOOL fCurrentFileChanged = FALSE;
+    BOOL fCurrentUseXPath = FALSE;
+
+    PMSIHANDLE hView = NULL;
+    PMSIHANDLE hRec = NULL;
+
+    XML_FILE_CHANGE* pxfcHead = NULL;
+    XML_FILE_CHANGE* pxfcTail = NULL;
+    XML_FILE_CHANGE* pxfc = NULL;
+    XML_FILE_CHANGE* pxfcUninstall = NULL;
+
+    LPWSTR pwzCustomActionData = NULL;
+
+    DWORD cFiles = 0;
+
+    // initialize
+    hr = WcaInitialize(hInstall, "SchedXmlFile");
+    ExitOnFailure(hr, "failed to initialize");
+
+    hr = ReadXmlFileTable(&pxfcHead, &pxfcTail);
+    if (S_FALSE == hr)
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping SchedXmlFile because Wix4XmlFile table not present");
+        ExitFunction1(hr = S_OK);
+    }
+
+    MessageExitOnFailure(hr, msierrXmlFileFailedRead, "failed to read Wix4XmlFile table");
+
+    // loop through all the xml configurations
+    for (pxfc = pxfcHead; pxfc; pxfc = pxfc->pxfcNext)
+    {
+        // If this is the first file, a different file, the last file, or the SelectionLanguage property changes...
+        if (NULL == pwzCurrentFile || 0 != lstrcmpW(pwzCurrentFile, pxfc->wzFile) || NULL == pxfc->pxfcNext || fCurrentUseXPath != ((XMLFILE_USE_XPATH & pxfc->iXmlFlags)))
+        {
+            // If this isn't the first file
+            if (NULL != pwzCurrentFile)
+            {
+                // Do the uninstall work for the current file by walking backwards through the list (so the sequence is reversed)
+                for (pxfcUninstall = ((NULL != pxfc->pxfcNext) ? pxfc->pxfcPrev : pxfc); pxfcUninstall && 0 == lstrcmpW(pwzCurrentFile, pxfcUninstall->wzFile) &&  fCurrentUseXPath == ((XMLFILE_USE_XPATH & pxfcUninstall->iXmlFlags)); pxfcUninstall = pxfcUninstall->pxfcPrev)
+                {
+                    // If it's being uninstalled
+                    if (WcaIsUninstalling(pxfcUninstall->isInstalled, pxfcUninstall->isAction))
+                    {
+                        // Uninstall the change
+                        if (!(XMLFILE_DONT_UNINSTALL & pxfcUninstall->iXmlFlags))
+                        {
+                            if (!fCurrentFileChanged)
+                            {
+                                hr = BeginChangeFile(pwzCurrentFile, pxfcUninstall, &pwzCustomActionData);
+                                ExitOnFailure(hr, "failed to begin file change for file: %ls", pwzCurrentFile);
+
+                                fCurrentFileChanged = TRUE;
+                                ++cFiles;
+                            }
+                            if (XMLFILE_CREATE_ELEMENT & pxfcUninstall->iXmlFlags)
+                            {
+                                hr = WcaWriteIntegerToCaData((int)xaDeleteElement, &pwzCustomActionData);
+                                ExitOnFailure(hr, "failed to write delete element action indicator to custom action data");
+                            }
+                            else
+                            {
+                                hr = WcaWriteIntegerToCaData((int)xaDeleteValue, &pwzCustomActionData);
+                                ExitOnFailure(hr, "failed to write delete value action indicator to custom action data");
+                            }
+
+                            if (XMLFILE_PRESERVE_MODIFIED & pxfc->iXmlFlags)
+                            {
+                                hr = WcaWriteIntegerToCaData((int)xdPreserve, &pwzCustomActionData);
+                                ExitOnFailure(hr, "failed to write Preserve Date indicator to custom action data");
+                            }
+                            else
+                            {
+                                hr = WcaWriteIntegerToCaData((int)xdDontPreserve, &pwzCustomActionData);
+                                ExitOnFailure(hr, "failed to write Don't Preserve Date indicator to custom action data");
+                            }
+
+                            hr = WriteChangeData(pxfcUninstall, &pwzCustomActionData);
+                            ExitOnFailure(hr, "failed to write uninstall change data");
+                        }
+                    }
+                }
+            }
+
+            // Remember the file we're currently working on
+            hr = StrAllocString(&pwzCurrentFile, pxfc->wzFile, 0);
+            ExitOnFailure(hr, "failed to copy file name");
+            fCurrentUseXPath = (XMLFILE_USE_XPATH & pxfc->iXmlFlags);
+
+            // We haven't changed the current file yet
+            fCurrentFileChanged = FALSE;
+        }
+
+        // If it's being installed
+        if (WcaIsInstalling(pxfc->isInstalled, pxfc->isAction))
+        {
+            if (!fCurrentFileChanged)
+            {
+                hr = BeginChangeFile(pwzCurrentFile, pxfc, &pwzCustomActionData);
+                ExitOnFailure(hr, "failed to begin file change for file: %ls", pwzCurrentFile);
+                fCurrentFileChanged = TRUE;
+                ++cFiles;
+            }
+
+            // Install the change
+            if (XMLFILE_CREATE_ELEMENT & pxfc->iXmlFlags)
+            {
+                hr = WcaWriteIntegerToCaData((int)xaCreateElement, &pwzCustomActionData);
+                ExitOnFailure(hr, "failed to write create element action indicator to custom action data");
+            }
+            else if (XMLFILE_DELETE_VALUE & pxfc->iXmlFlags)
+            {
+                hr = WcaWriteIntegerToCaData((int)xaDeleteValue, &pwzCustomActionData);
+                ExitOnFailure(hr, "failed to write delete value action indicator to custom action data");
+            }
+            else if (XMLFILE_BULKWRITE_VALUE & pxfc->iXmlFlags)
+            {
+                hr = WcaWriteIntegerToCaData((int)xaBulkWriteValue, &pwzCustomActionData);
+                ExitOnFailure(hr, "failed to write builkwrite value action indicator to custom action data");
+            }
+            else
+            {
+                hr = WcaWriteIntegerToCaData((int)xaWriteValue, &pwzCustomActionData);
+                ExitOnFailure(hr, "failed to write file indicator to custom action data");
+            }
+
+            if (XMLFILE_PRESERVE_MODIFIED & pxfc->iXmlFlags)
+            {
+                hr = WcaWriteIntegerToCaData((int)xdPreserve, &pwzCustomActionData);
+                ExitOnFailure(hr, "failed to write Preserve Date indicator to custom action data");
+            }
+            else
+            {
+                hr = WcaWriteIntegerToCaData((int)xdDontPreserve, &pwzCustomActionData);
+                ExitOnFailure(hr, "failed to write Don't Preserve Date indicator to custom action data");
+            }
+
+            hr = WriteChangeData(pxfc, &pwzCustomActionData);
+            ExitOnFailure(hr, "failed to write change data");
+        }
+    }
+
+    // If we looped through all records all is well
+    if (E_NOMOREITEMS == hr)
+        hr = S_OK;
+    ExitOnFailure(hr, "failed while looping through all objects to secure");
+
+    // Schedule the custom action and add to progress bar
+    if (pwzCustomActionData && *pwzCustomActionData)
+    {
+        Assert(0 < cFiles);
+
+        hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"ExecXmlFile"), pwzCustomActionData, cFiles * COST_XMLFILE);
+        ExitOnFailure(hr, "failed to schedule ExecXmlFile action");
+    }
+
+LExit:
+    ReleaseStr(pwzCurrentFile);
+    ReleaseStr(pwzCustomActionData);
+
+    return WcaFinalize(FAILED(hr) ? ERROR_INSTALL_FAILURE : er);
+}
+
+
+/******************************************************************
+ ExecXmlFile - entry point for XmlFile Custom Action
+
+*******************************************************************/
+extern "C" UINT __stdcall ExecXmlFile(
+    __in MSIHANDLE hInstall
+    )
+{
+//    AssertSz(FALSE, "debug ExecXmlFile");
+    HRESULT hr = S_OK;
+    HRESULT hrOpenFailure = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    BOOL fIsFSRedirectDisabled = FALSE;
+    BOOL fPreserveDate = FALSE;
+
+    int id = IDRETRY;
+
+    LPWSTR pwzCustomActionData = NULL;
+    LPWSTR pwzData = NULL;
+    LPWSTR pwzFile = NULL;
+    LPWSTR pwzXPath = NULL;
+    LPWSTR pwzName = NULL;
+    LPWSTR pwzValue = NULL;
+    LPWSTR pwz = NULL;
+
+    IXMLDOMDocument* pixd = NULL;
+    IXMLDOMNode* pixn = NULL;
+    IXMLDOMNode* pixnNewNode = NULL;
+    IXMLDOMNodeList* pixNodes = NULL;
+    IXMLDOMDocument2 *pixdDocument2 = NULL;
+
+    FILETIME ft;
+
+    BSTR bstrProperty = ::SysAllocString(L"SelectionLanguage");
+    ExitOnNull(bstrProperty, hr, E_OUTOFMEMORY, "failed SysAllocString");
+    VARIANT varValue;
+    ::VariantInit(&varValue);
+    varValue.vt = VT_BSTR;
+    varValue.bstrVal = ::SysAllocString(L"XPath");
+    ExitOnNull(varValue.bstrVal, hr, E_OUTOFMEMORY, "failed SysAllocString");
+    eXmlAction xa;
+    eXmlPreserveDate xd;
+    eXmlSelectionLanguage xl;
+
+    // initialize
+    hr = WcaInitialize(hInstall, "ExecXmlFile");
+    ExitOnFailure(hr, "failed to initialize");
+
+    hr = XmlInitialize();
+    ExitOnFailure(hr, "failed to initialize xml utilities");
+
+    hr = WcaGetProperty( L"CustomActionData", &pwzCustomActionData);
+    ExitOnFailure(hr, "failed to get CustomActionData");
+
+    WcaLog(LOGMSG_TRACEONLY, "CustomActionData: %ls", pwzCustomActionData);
+
+    pwz = pwzCustomActionData;
+
+    hr = WcaReadIntegerFromCaData(&pwz, (int*) &xa);
+    ExitOnFailure(hr, "failed to process CustomActionData");
+
+#ifndef _WIN64
+    // Initialize the Wow64 API - store the result in fWow64APIPresent
+    // If it fails, this doesn't warrant an error yet, because we only need the Wow64 API in some cases
+    WcaInitializeWow64();
+    BOOL fIsWow64Process = WcaIsWow64Process();
+#endif
+
+    if (xaOpenFile != xa && xaOpenFilex64 != xa)
+        ExitOnFailure(hr = E_INVALIDARG, "invalid custom action data");
+
+    // loop through all the passed in data
+    while (pwz && *pwz)
+    {
+        hr = WcaReadIntegerFromCaData(&pwz, (int*) &xl);
+        ExitOnFailure(hr, "failed to process CustomActionData");
+
+        hr = WcaReadStringFromCaData(&pwz, &pwzFile);
+        ExitOnFailure(hr, "failed to read file name from custom action data");
+
+        // Default to not preserve the modified date
+        fPreserveDate = FALSE;
+
+        // Open the file
+        ReleaseNullObject(pixd);
+
+        if (xaOpenFilex64 == xa)
+        {
+#ifndef _WIN64
+            if (!fIsWow64Process)
+            {
+                hr = E_NOTIMPL;
+                ExitOnFailure(hr, "Custom action was told to act on a 64-bit component, but the custom action process is not running in WOW.");
+            }
+
+            hr = WcaDisableWow64FSRedirection();
+            ExitOnFailure(hr, "Custom action was told to act on a 64-bit component, but was unable to disable filesystem redirection through the Wow64 API.");
+
+            fIsFSRedirectDisabled = TRUE;
+#endif
+        }
+
+        hr = XmlLoadDocumentFromFileEx(pwzFile, XML_LOAD_PRESERVE_WHITESPACE, &pixd);
+        if (FAILED(hr))
+        {
+            // Ignore the return code for now.  If they try to add something, we'll fail the install.  If all they do is remove stuff then it doesn't matter.
+            hrOpenFailure = hr;
+            hr = S_OK;
+        }
+        else
+        {
+            hrOpenFailure = S_OK;
+        }
+        WcaLog(LOGMSG_VERBOSE, "Configuring Xml File: %ls", pwzFile);
+
+        if (xsXPath == xl)
+        {
+            if (vfMsxml30)
+            {
+                // If we failed to open the file, don't fail immediately; just skip setting the selection language, and we'll fail later if appropriate
+                if (SUCCEEDED(hrOpenFailure))
+                {
+                    hr = pixd->QueryInterface(XmlUtil_IID_IXMLDOMDocument2, (void**)&pixdDocument2);
+                    ExitOnFailure(hr, "failed in querying IXMLDOMDocument2 interface");
+                    hr = pixdDocument2->setProperty(bstrProperty, varValue);
+                    ExitOnFailure(hr, "failed in setting SelectionLanguage");
+                }
+            }
+            else
+            {
+                ExitOnFailure(hr = E_NOTIMPL, "Error: current MSXML version does not support xpath query.");
+            }
+        }
+
+        while (pwz && *pwz)
+        {
+            hr = WcaReadIntegerFromCaData(&pwz, (int*) &xa);
+            ExitOnFailure(hr, "failed to process CustomActionData");
+
+            // Break if we need to move on to a different file
+            if (xaOpenFile == xa || xaOpenFilex64 == xa)
+                break;
+
+            hr = WcaReadIntegerFromCaData(&pwz, (int*) &xd);
+            ExitOnFailure(hr, "failed to process CustomActionData");
+
+            if (xdPreserve == xd)
+            {
+                fPreserveDate = TRUE;
+            }
+
+            // Get path, name, and value to be written
+            hr = WcaReadStringFromCaData(&pwz, &pwzXPath);
+            ExitOnFailure(hr, "failed to process CustomActionData");
+            hr = WcaReadStringFromCaData(&pwz, &pwzName);
+            ExitOnFailure(hr, "failed to process CustomActionData");
+            hr = WcaReadStringFromCaData(&pwz, &pwzValue);
+            ExitOnFailure(hr, "failed to process CustomActionData");
+
+            // If we failed to open the file and we're adding something to the file, we've got a problem.  Otherwise, just continue on since the file's already gone.
+            if (FAILED(hrOpenFailure))
+            {
+                if (xaCreateElement == xa || xaWriteValue == xa || xaBulkWriteValue == xa)
+                {
+                    MessageExitOnFailure(hr = hrOpenFailure, msierrXmlFileFailedOpen, "failed to load XML file: %ls", pwzFile);
+                }
+                else
+                {
+                    continue;
+                }
+            }
+
+            // Select the node we're about to modify
+            ReleaseNullObject(pixn);
+
+            if (xaBulkWriteValue == xa)
+            {
+                hr = XmlSelectNodes(pixd, pwzXPath, &pixNodes);
+                if (S_FALSE == hr)
+                {
+                    hr = HRESULT_FROM_WIN32(ERROR_OBJECT_NOT_FOUND);
+                }
+
+                MessageExitOnFailure(hr, msierrXmlFileFailedSelect, "failed to find any nodes: %ls in XML file: %ls", pwzXPath, pwzFile);
+                for (;;)
+                {
+                    pixNodes->nextNode(&pixn);
+                    if (NULL == pixn)
+                        break;
+
+                    if (pwzName && *pwzName)
+                    {
+                        // We're setting an attribute
+                        hr = XmlSetAttribute(pixn, pwzName, pwzValue);
+                        ExitOnFailure(hr, "failed to set attribute: %ls to value %ls", pwzName, pwzValue);
+                    }
+                    else
+                    {
+                        // We're setting the text of the node
+                        hr = XmlSetText(pixn, pwzValue);
+                        ExitOnFailure(hr, "failed to set text to: %ls for element %ls.  Make sure that XPath points to an element.", pwzValue, pwzXPath);
+                    }
+                    ReleaseNullObject(pixn);
+                }
+            }
+            else
+            {
+                hr = XmlSelectSingleNode(pixd, pwzXPath, &pixn);
+                if (S_FALSE == hr)
+                    hr = HRESULT_FROM_WIN32(ERROR_OBJECT_NOT_FOUND);
+                MessageExitOnFailure(hr, msierrXmlFileFailedSelect, "failed to find node: %ls in XML file: %ls", pwzXPath, pwzFile);
+
+                // Make the modification
+                if (xaWriteValue == xa)
+                {
+                    if (pwzName && *pwzName)
+                    {
+                        // We're setting an attribute
+                        hr = XmlSetAttribute(pixn, pwzName, pwzValue);
+                        ExitOnFailure(hr, "failed to set attribute: %ls to value %ls", pwzName, pwzValue);
+                    }
+                    else
+                    {
+                        // We're setting the text of the node
+                        hr = XmlSetText(pixn, pwzValue);
+                        ExitOnFailure(hr, "failed to set text to: %ls for element %ls.  Make sure that XPath points to an element.", pwzValue, pwzXPath);
+                    }
+                }
+                else if (xaCreateElement == xa)
+                {
+                    hr = XmlCreateChild(pixn, pwzName, &pixnNewNode);
+                    ExitOnFailure(hr, "failed to create child element: %ls", pwzName);
+
+                    if (pwzValue && *pwzValue)
+                    {
+                        hr = XmlSetText(pixnNewNode, pwzValue);
+                        ExitOnFailure(hr, "failed to set text to: %ls for node: %ls", pwzValue, pwzName);
+                    }
+
+                    ReleaseNullObject(pixnNewNode);
+                }
+                else if (xaDeleteValue == xa)
+                {
+                    if (pwzName && *pwzName)
+                    {
+                        // Delete the attribute
+                        hr = XmlRemoveAttribute(pixn, pwzName);
+                        ExitOnFailure(hr, "failed to remove attribute: %ls", pwzName);
+                    }
+                    else
+                    {
+                        // Clear the text value for the node
+                        hr = XmlSetText(pixn, L"");
+                        ExitOnFailure(hr, "failed to clear text value");
+                    }
+                }
+                else if (xaDeleteElement == xa)
+                {
+                    // TODO: This may be a little heavy handed
+                    hr = XmlRemoveChildren(pixn, pwzName);
+                    ExitOnFailure(hr, "failed to delete child node: %ls", pwzName);
+                }
+                else
+                {
+                    ExitOnFailure(hr = E_UNEXPECTED, "Invalid modification specified in custom action data");
+                }
+            }
+        }
+
+        // Now that we've made all of the changes to this file, save it and move on to the next
+        if (S_OK == hrOpenFailure)
+        {
+            if (fPreserveDate)
+            {
+                hr = FileGetTime(pwzFile, NULL, NULL, &ft);
+                ExitOnFailure(hr, "failed to get modified time of file : %ls", pwzFile);
+            }
+
+            int iSaveAttempt = 0;
+
+            do
+            {
+                hr = XmlSaveDocument(pixd, pwzFile);
+                if (FAILED(hr))
+                {
+                    id = WcaErrorMessage(msierrXmlConfigFailedSave, hr, INSTALLMESSAGE_ERROR | MB_ABORTRETRYIGNORE, 1, pwzFile);
+                    switch (id)
+                    {
+                    case IDABORT:
+                        ExitOnFailure(hr, "Failed to save changes to XML file: %ls", pwzFile);
+                    case IDRETRY:
+                        hr = S_FALSE;   // hit me, baby, one more time
+                        break;
+                    case IDIGNORE:
+                        hr = S_OK;  // pretend everything is okay and bail
+                        break;
+                    case 0: // No UI case, MsiProcessMessage returns 0
+                        if (STIERR_SHARING_VIOLATION == hr)
+                        {
+                            // Only in case of sharing violation do we retry 30 times, once a second.
+                            if (iSaveAttempt < 30)
+                            {
+                                hr = S_FALSE;
+                                ++iSaveAttempt;
+                                WcaLog(LOGMSG_VERBOSE, "Unable to save changes to XML file: %ls, retry attempt: %x", pwzFile, iSaveAttempt);
+                                Sleep(1000);
+                            }
+                            else
+                            {
+                                ExitOnFailure(hr, "Failed to save changes to XML file: %ls", pwzFile);
+                            }
+                        }
+                        break;
+                    default: // Unknown error
+                        ExitOnFailure(hr, "Failed to save changes to XML file: %ls", pwzFile);
+                    }
+                }
+            } while (S_FALSE == hr);
+
+            if (fPreserveDate)
+            {
+                hr = FileSetTime(pwzFile, NULL, NULL, &ft);
+                ExitOnFailure(hr, "failed to set modified time of file : %ls", pwzFile);
+            }
+
+            if (fIsFSRedirectDisabled)
+            {
+                fIsFSRedirectDisabled = FALSE;
+                WcaRevertWow64FSRedirection();
+            }
+        }
+    }
+
+LExit:
+    // Make sure we revert FS Redirection if necessary before exiting
+    if (fIsFSRedirectDisabled)
+    {
+        fIsFSRedirectDisabled = FALSE;
+        WcaRevertWow64FSRedirection();
+    }
+#ifndef _WIN64
+    WcaFinalizeWow64();
+#endif
+
+    ReleaseStr(pwzCustomActionData);
+    ReleaseStr(pwzData);
+    ReleaseStr(pwzFile);
+    ReleaseStr(pwzXPath);
+    ReleaseStr(pwzName);
+    ReleaseStr(pwzValue);
+    ReleaseBSTR(bstrProperty);
+    ReleaseVariant(varValue);
+
+    ReleaseObject(pixdDocument2);
+    ReleaseObject(pixn);
+    ReleaseObject(pixd);
+    ReleaseObject(pixnNewNode);
+    ReleaseObject(pixNodes);
+
+    XmlUninitialize();
+
+    return WcaFinalize(FAILED(hr) ? ERROR_INSTALL_FAILURE : er);
+}
+
+
+/******************************************************************
+ ExecXmlFileRollback - entry point for XmlFile rollback Custom Action
+
+*******************************************************************/
+extern "C" UINT __stdcall ExecXmlFileRollback(
+    __in MSIHANDLE hInstall
+    )
+{
+//    AssertSz(FALSE, "debug ExecXmlFileRollback");
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    int iIs64Bit;
+    BOOL fIs64Bit = FALSE;
+
+    LPWSTR pwzCustomActionData = NULL;
+    LPWSTR pwz = NULL;
+    LPWSTR pwzFileName = NULL;
+    LPBYTE pbData = NULL;
+    DWORD_PTR cbData = 0;
+
+    FILETIME ft;
+
+    HANDLE hFile = INVALID_HANDLE_VALUE;
+
+    // initialize
+    hr = WcaInitialize(hInstall, "ExecXmlFileRollback");
+    ExitOnFailure(hr, "failed to initialize");
+
+
+    hr = WcaGetProperty( L"CustomActionData", &pwzCustomActionData);
+    ExitOnFailure(hr, "failed to get CustomActionData");
+
+    WcaLog(LOGMSG_TRACEONLY, "CustomActionData: %ls", pwzCustomActionData);
+
+    pwz = pwzCustomActionData;
+
+    hr = WcaReadIntegerFromCaData(&pwz, &iIs64Bit);
+    ExitOnFailure(hr, "failed to read component bitness from custom action data");
+
+    hr = WcaReadStringFromCaData(&pwz, &pwzFileName);
+    ExitOnFailure(hr, "failed to read file name from custom action data");
+
+    hr = WcaReadStreamFromCaData(&pwz, &pbData, &cbData);
+    ExitOnFailure(hr, "failed to read file contents from custom action data");
+
+#ifndef _WIN64
+    fIs64Bit = (BOOL)iIs64Bit;
+
+    if (fIs64Bit)
+    {
+        hr = WcaInitializeWow64();
+        if (S_FALSE == hr)
+        {
+            hr = TYPE_E_DLLFUNCTIONNOTFOUND;
+        }
+        ExitOnFailure(hr, "failed to initialize Wow64 API");
+
+        if (!WcaIsWow64Process())
+        {
+            hr = E_NOTIMPL;
+            ExitOnFailure(hr, "Custom action was told to rollback a 64-bit component, but the custom action process is not running in WOW.");
+        }
+
+        hr = WcaDisableWow64FSRedirection();
+        ExitOnFailure(hr, "Custom action was told to rollback a 64-bit component, but was unable to Disable Filesystem Redirection through the Wow64 API.");
+    }
+#endif
+
+    // Always preserve the modified date on rollback
+    hr = FileGetTime(pwzFileName, NULL, NULL, &ft);
+    ExitOnFailure(hr, "Failed to get modified date of file %ls.", pwzFileName);
+
+    // Open the file
+    hFile = ::CreateFileW(pwzFileName, GENERIC_WRITE, NULL, NULL, TRUNCATE_EXISTING, NULL, NULL);
+    ExitOnInvalidHandleWithLastError(hFile, hr, "failed to open file: %ls", pwzFileName);
+
+    // Write out the old data
+    hr = FileWriteHandle(hFile, pbData, cbData);
+    ExitOnFailure(hr, "failed to write to file: %ls", pwzFileName);
+
+    ReleaseFile(hFile);
+
+    // Always preserve the modified date on rollback
+    hr = FileSetTime(pwzFileName, NULL, NULL, &ft);
+    ExitOnFailure(hr, "Failed to set modified date of file %ls.", pwzFileName);
+
+LExit:
+    ReleaseStr(pwzCustomActionData);
+    ReleaseStr(pwzFileName);
+
+    ReleaseFile(hFile);
+
+    if (fIs64Bit)
+    {
+        WcaRevertWow64FSRedirection();
+        WcaFinalizeWow64();
+    }
+
+    ReleaseMem(pbData);
+
+    return WcaFinalize(FAILED(hr) ? ERROR_INSTALL_FAILURE : er);
+}
+
diff --git a/src/ext/Util/ca/caDecor.h b/src/ext/Util/ca/caDecor.h
new file mode 100644
index 00000000..da274650
--- /dev/null
+++ b/src/ext/Util/ca/caDecor.h
@@ -0,0 +1,13 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+#if defined(_M_ARM64)
+#define CUSTOM_ACTION_DECORATION(f) L"Wix4" f L"_A64"
+#elif defined(_M_AMD64)
+#define CUSTOM_ACTION_DECORATION(f) L"Wix4" f L"_X64"
+#elif defined(_M_ARM)
+#define CUSTOM_ACTION_DECORATION(f) L"Wix4" f L"_ARM"
+#else
+#define CUSTOM_ACTION_DECORATION(f) L"Wix4" f L"_X86"
+#endif
diff --git a/src/ext/Util/ca/cost.h b/src/ext/Util/ca/cost.h
new file mode 100644
index 00000000..6507e85d
--- /dev/null
+++ b/src/ext/Util/ca/cost.h
@@ -0,0 +1,9 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+const UINT COST_SECUREOBJECT = 1000;
+const UINT COST_SERVICECONFIG = 1000;
+const UINT COST_XMLFILE = 1000;
+const UINT COST_CLOSEAPP = 500;
+const UINT COST_INTERNETSHORTCUT = 2000;
diff --git a/src/ext/Util/ca/dllmain.cpp b/src/ext/Util/ca/dllmain.cpp
new file mode 100644
index 00000000..35ae6d1c
--- /dev/null
+++ b/src/ext/Util/ca/dllmain.cpp
@@ -0,0 +1,26 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+/********************************************************************
+DllMain - standard entry point for all WiX custom actions
+
+********************************************************************/
+extern "C" BOOL WINAPI DllMain(
+    IN HINSTANCE hInst,
+    IN ULONG ulReason,
+    IN LPVOID)
+{
+    switch(ulReason)
+    {
+    case DLL_PROCESS_ATTACH:
+        WcaGlobalInitialize(hInst);
+        break;
+
+    case DLL_PROCESS_DETACH:
+        WcaGlobalFinalize();
+        break;
+    }
+
+    return TRUE;
+}
diff --git a/src/ext/Util/ca/exitearlywithsuccess.cpp b/src/ext/Util/ca/exitearlywithsuccess.cpp
new file mode 100644
index 00000000..00828329
--- /dev/null
+++ b/src/ext/Util/ca/exitearlywithsuccess.cpp
@@ -0,0 +1,27 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+
+/******************************************************************
+WixExitEarlyWithSuccess - entry point for WixExitEarlyWithSuccess
+    custom action which does nothing except return exit code
+    ERROR_NO_MORE_ITEMS. The Windows Installer documentation at
+    http://msdn.microsoft.com/library/aa368072.aspx indicates that
+    this exit code is not treated as an error. This will cause a
+    calling application to receive a successful return code if
+    this custom action executes. This can be useful for backwards
+    compatibility when an application redistributes an MSI and
+    a future major upgrade is released for that MSI. It should be
+    conditioned on a property set by an entry in the Upgrade table 
+    of the MSI that detects newer major upgrades of the same MSI
+    already installed on the system. It should be scheduled after
+    the FindRelatedProducts action so that the property will be
+    set if appropriate.
+********************************************************************/
+extern "C" UINT __stdcall WixExitEarlyWithSuccess(
+    __in MSIHANDLE /*hInstall*/
+    )
+{
+    return ERROR_NO_MORE_ITEMS;
+}
diff --git a/src/ext/Util/ca/netshortcuts.cpp b/src/ext/Util/ca/netshortcuts.cpp
new file mode 100644
index 00000000..06826264
--- /dev/null
+++ b/src/ext/Util/ca/netshortcuts.cpp
@@ -0,0 +1,437 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+LPCWSTR vcsShortcutsQuery =
+    L"SELECT `Component_`, `Directory_`, `Name`, `Target`, `Attributes`, `IconFile`, `IconIndex` "
+    L"FROM `Wix4InternetShortcut`";
+enum eShortcutsQuery { esqComponent = 1, esqDirectory, esqFilename, esqTarget, esqAttributes, esqIconFile, esqIconIndex };
+enum eShortcutsAttributes { esaLink = 0, esaURL = 1 };
+
+/******************************************************************
+ WixSchedInternetShortcuts - entry point
+
+********************************************************************/
+extern "C" UINT __stdcall WixSchedInternetShortcuts(
+    __in MSIHANDLE hInstall
+    )
+{
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    UINT uiCost = 0;
+
+    PMSIHANDLE hView = NULL;
+    PMSIHANDLE hRec = NULL;
+
+    MSIHANDLE hCreateFolderTable = NULL;
+    MSIHANDLE hCreateFolderColumns = NULL;
+
+    LPWSTR pwzCustomActionData = NULL;
+    LPWSTR pwzComponent = NULL;
+    LPWSTR pwzDirectory = NULL;
+    LPWSTR pwzFilename = NULL;
+    LPWSTR pwzTarget = NULL;
+    LPWSTR pwzShortcutPath = NULL;
+    int iAttr = 0;
+    LPWSTR pwzIconFile = NULL;
+    int iIconIndex = 0;
+    IUniformResourceLocatorW* piURL = NULL;
+    IShellLinkW* piShellLink = NULL;
+    BOOL fInitializedCom = FALSE;
+
+    hr = WcaInitialize(hInstall, "WixSchedInternetShortcuts");
+    ExitOnFailure(hr, "failed to initialize WixSchedInternetShortcuts.");
+
+    // anything to do?
+    if (S_OK != WcaTableExists(L"Wix4InternetShortcut"))
+    {
+        WcaLog(LOGMSG_STANDARD, "Wix4InternetShortcut table doesn't exist, so there are no Internet shortcuts to process");
+        goto LExit;
+    }
+
+    // check to see if we can create a shortcut - Server Core and others may not have a shell registered.  
+    hr = ::CoInitialize(NULL);
+    ExitOnFailure(hr, "failed to initialize COM");
+    fInitializedCom = TRUE;
+
+    hr = ::CoCreateInstance(CLSID_InternetShortcut, NULL, CLSCTX_ALL, IID_IUniformResourceLocatorW, (void**)&piURL);
+    if (S_OK != hr)
+    {
+        WcaLog(LOGMSG_STANDARD, "failed to create an instance of IUniformResourceLocatorW, skipping shortcut creation");
+        ExitFunction1(hr = S_OK);
+    }
+
+    hr = ::CoCreateInstance(CLSID_ShellLink, NULL, CLSCTX_ALL, IID_IShellLinkW, (void**)&piShellLink);
+    if (S_OK != hr)
+    {
+        WcaLog(LOGMSG_STANDARD, "failed to create an instance of IShellLinkW, skipping shortcut creation");
+        ExitFunction1(hr = S_OK);
+    }
+
+    // query and loop through all the shortcuts
+    hr = WcaOpenExecuteView(vcsShortcutsQuery, &hView);
+    ExitOnFailure(hr, "failed to open view on Wix4InternetShortcut table");
+
+    while (S_OK == (hr = WcaFetchRecord(hView, &hRec)))
+    {
+        // read column values
+        hr = WcaGetRecordString(hRec, esqComponent, &pwzComponent);
+        ExitOnFailure(hr, "failed to get shortcut component");
+        hr = WcaGetRecordString(hRec, esqDirectory, &pwzDirectory);
+        ExitOnFailure(hr, "failed to get shortcut directory");
+        hr = WcaGetRecordString(hRec, esqFilename, &pwzFilename);
+        ExitOnFailure(hr, "failed to get shortcut filename");
+        hr = WcaGetRecordFormattedString(hRec, esqTarget, &pwzTarget);
+        ExitOnFailure(hr, "failed to get shortcut target");
+        hr = WcaGetRecordInteger(hRec, esqAttributes, &iAttr);
+        ExitOnFailure(hr, "failed to get shortcut attributes");
+        hr = WcaGetRecordFormattedString(hRec, esqIconFile, &pwzIconFile);
+        ExitOnFailure(hr, "failed to get shortcut icon file");
+        hr = WcaGetRecordInteger(hRec, esqIconIndex, &iIconIndex);
+        ExitOnFailure(hr, "failed to get shortcut icon index");
+
+        // skip processing this Wix4InternetShortcut row if the component isn't being configured
+        WCA_TODO todo = WcaGetComponentToDo(pwzComponent);
+        if (WCA_TODO_UNKNOWN == todo)
+        {
+            WcaLog(LOGMSG_VERBOSE, "Skipping shortcut for null-action component '%ls'", pwzComponent);
+            continue;
+        }
+
+        // we need to create the directory where the shortcut is supposed to live; rather
+        // than doing so in our deferred custom action, use the CreateFolder table to have MSI 
+        // make (and remove) them on our behalf (including the correct cleanup of parent directories).
+        MSIDBERROR dbError = MSIDBERROR_NOERROR;
+        WcaLog(LOGMSG_STANDARD, "Adding folder '%ls', component '%ls' to the CreateFolder table", pwzDirectory, pwzComponent);
+        hr = WcaAddTempRecord(&hCreateFolderTable, &hCreateFolderColumns, L"CreateFolder", &dbError, 0, 2, pwzDirectory, pwzComponent);
+        if (MSIDBERROR_DUPLICATEKEY == dbError)
+        {
+            WcaLog(LOGMSG_STANDARD, "Folder '%ls' already exists in the CreateFolder table; the above error is harmless", pwzDirectory);
+            hr = S_OK;
+        }
+        ExitOnFailure(hr, "Couldn't add temporary CreateFolder row");
+
+        // only if we're installing/reinstalling do we need to schedule the deferred CA
+        // (uninstallation is handled via permanent RemoveFile rows and temporary CreateFolder rows)
+        if (WCA_TODO_INSTALL == todo || WCA_TODO_REINSTALL == todo)
+        {
+            // turn the Directory_ id into a path
+            hr = WcaGetTargetPath(pwzDirectory, &pwzShortcutPath);
+            ExitOnFailure(hr, "failed to allocate string for shortcut directory");
+
+            // append the shortcut filename
+            hr = StrAllocConcat(&pwzShortcutPath, pwzFilename, 0);
+            ExitOnFailure(hr, "failed to allocate string for shortcut filename");
+
+            // write the shortcut path and target to custom action data for deferred CAs
+            hr = WcaWriteStringToCaData(pwzShortcutPath, &pwzCustomActionData);
+            ExitOnFailure(hr, "failed to write shortcut path to custom action data");
+            hr = WcaWriteStringToCaData(pwzTarget, &pwzCustomActionData);
+            ExitOnFailure(hr, "failed to write shortcut target to custom action data");
+            hr = WcaWriteIntegerToCaData(iAttr, &pwzCustomActionData);
+            ExitOnFailure(hr, "failed to write shortcut attributes to custom action data");
+            hr = WcaWriteStringToCaData(pwzIconFile, &pwzCustomActionData);
+            ExitOnFailure(hr, "failed to write icon file to custom action data");
+            hr = WcaWriteIntegerToCaData(iIconIndex, &pwzCustomActionData);
+            ExitOnFailure(hr, "failed to write icon index to custom action data");
+
+            uiCost += COST_INTERNETSHORTCUT;
+        }
+    }
+
+    if (E_NOMOREITEMS == hr)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "Failure occured while processing Wix4InternetShortcut table");
+
+    // if we have any shortcuts to install
+    if (pwzCustomActionData && *pwzCustomActionData)
+    {
+        // add cost to progress bar
+        hr = WcaProgressMessage(uiCost, TRUE);
+        ExitOnFailure(hr, "failed to extend progress bar for InternetShortcuts");
+
+        // provide custom action data to deferred and rollback CAs
+        hr = WcaSetProperty(CUSTOM_ACTION_DECORATION(L"RollbackInternetShortcuts"), pwzCustomActionData);
+        ExitOnFailure(hr, "failed to set WixRollbackInternetShortcuts rollback custom action data");
+        hr = WcaSetProperty(CUSTOM_ACTION_DECORATION(L"CreateInternetShortcuts"), pwzCustomActionData);
+        ExitOnFailure(hr, "failed to set WixCreateInternetShortcuts custom action data");
+    }
+
+LExit:
+    if (hCreateFolderTable)
+    {
+        ::MsiCloseHandle(hCreateFolderTable);
+    }
+
+    if (hCreateFolderColumns)
+    {
+        ::MsiCloseHandle(hCreateFolderColumns);
+    }
+
+    ReleaseStr(pwzCustomActionData);
+    ReleaseStr(pwzComponent);
+    ReleaseStr(pwzDirectory);
+    ReleaseStr(pwzFilename);
+    ReleaseStr(pwzTarget);
+    ReleaseStr(pwzShortcutPath);
+    ReleaseObject(piShellLink);
+    ReleaseObject(piURL);
+
+    if (fInitializedCom)
+    {
+        ::CoUninitialize();
+    }
+
+    er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+
+
+/******************************************************************
+ CreateUrl - Creates a shortcut via IUniformResourceLocatorW
+
+*******************************************************************/
+static HRESULT CreateUrl(
+    __in_z LPCWSTR wzTarget,
+    __in_z LPCWSTR wzShortcutPath,
+    __in_z_opt LPCWSTR wzIconPath,
+    __in int iconIndex
+)
+{
+    HRESULT hr = S_OK;
+    IUniformResourceLocatorW* piURL = NULL;
+    IPersistFile* piPersistFile = NULL;
+    IPropertySetStorage* piProperties = NULL;
+    IPropertyStorage* piStorage = NULL;
+
+    // create an internet shortcut object
+    WcaLog(LOGMSG_STANDARD, "Creating IUniformResourceLocatorW shortcut '%ls' target '%ls'", wzShortcutPath, wzTarget);
+    hr = ::CoCreateInstance(CLSID_InternetShortcut, NULL, CLSCTX_ALL, IID_IUniformResourceLocatorW, (void**)&piURL);
+    ExitOnFailure(hr, "failed to create an instance of IUniformResourceLocatorW");
+
+    // set shortcut target
+    hr = piURL->SetURL(wzTarget, 0);
+    ExitOnFailure(hr, "failed to set shortcut '%ls' target '%ls'", wzShortcutPath, wzTarget);
+
+    if (wzIconPath)
+    {
+        WcaLog(LOGMSG_STANDARD, "Adding icon '%ls' index '%d'", wzIconPath, iconIndex);
+
+        hr = piURL->QueryInterface(IID_IPropertySetStorage, (void **)&piProperties);
+        ExitOnFailure(hr, "failed to get IPropertySetStorage for shortcut '%ls'", wzShortcutPath);
+
+        hr = piProperties->Open(FMTID_Intshcut, STGM_WRITE, &piStorage);
+        ExitOnFailure(hr, "failed to open storage for shortcut '%ls'", wzShortcutPath);
+
+        PROPSPEC ppids[2] = { {PRSPEC_PROPID, PID_IS_ICONINDEX}, {PRSPEC_PROPID, PID_IS_ICONFILE} };
+        PROPVARIANT ppvar[2];
+
+        PropVariantInit(ppvar);
+        PropVariantInit(ppvar + 1);
+
+        ppvar[0].vt = VT_I4;
+        ppvar[0].lVal = iconIndex;
+        ppvar[1].vt = VT_LPWSTR;
+        ppvar[1].pwszVal = const_cast<LPWSTR>(wzIconPath);
+
+        hr = piStorage->WriteMultiple(2, ppids, ppvar, 0);
+        ExitOnFailure(hr, "failed to write icon storage for shortcut '%ls'", wzShortcutPath);
+        
+        hr = piStorage->Commit(STGC_DEFAULT);
+        ExitOnFailure(hr, "failed to commit icon storage for shortcut '%ls'", wzShortcutPath);
+    }
+
+    // get an IPersistFile and save the shortcut
+    hr = piURL->QueryInterface(IID_IPersistFile, (void**)&piPersistFile);
+    ExitOnFailure(hr, "failed to get IPersistFile for shortcut '%ls'", wzShortcutPath);
+
+    hr = piPersistFile->Save(wzShortcutPath, TRUE);
+    ExitOnFailure(hr, "failed to save shortcut '%ls'", wzShortcutPath);
+
+LExit:
+    ReleaseObject(piPersistFile);
+    ReleaseObject(piURL);
+    ReleaseObject(piStorage);
+    ReleaseObject(piProperties);
+
+    return hr;
+}
+
+/******************************************************************
+ CreateLink - Creates a shortcut via IShellLinkW
+
+*******************************************************************/
+static HRESULT CreateLink(
+    __in_z LPCWSTR wzTarget,
+    __in_z LPCWSTR wzShortcutPath,
+    __in_z_opt LPCWSTR wzIconPath,
+    __in int iconIndex
+)
+{
+    HRESULT hr = S_OK;
+    IShellLinkW* piShellLink = NULL;
+    IPersistFile* piPersistFile = NULL;
+
+    // create an internet shortcut object
+    WcaLog(LOGMSG_STANDARD, "Creating IShellLinkW shortcut '%ls' target '%ls'", wzShortcutPath, wzTarget);
+    hr = ::CoCreateInstance(CLSID_ShellLink, NULL, CLSCTX_ALL, IID_IShellLinkW, (void**)&piShellLink);
+    ExitOnFailure(hr, "failed to create an instance of IShellLinkW");
+
+    // set shortcut target
+    hr = piShellLink->SetPath(wzTarget);
+    ExitOnFailure(hr, "failed to set shortcut '%ls' target '%ls'", wzShortcutPath, wzTarget);
+
+    if (wzIconPath)
+    {
+        WcaLog(LOGMSG_STANDARD, "Adding icon '%ls' index '%d'", wzIconPath, iconIndex);
+        hr = piShellLink->SetIconLocation(wzIconPath, iconIndex);
+        ExitOnFailure(hr, "failed to set icon for shortcut '%ls'", wzShortcutPath);
+    }
+
+    // get an IPersistFile and save the shortcut
+    hr = piShellLink->QueryInterface(IID_IPersistFile, (void**)&piPersistFile);
+    ExitOnFailure(hr, "failed to get IPersistFile for shortcut '%ls'", wzShortcutPath);
+
+    hr = piPersistFile->Save(wzShortcutPath, TRUE);
+    ExitOnFailure(hr, "failed to save shortcut '%ls'", wzShortcutPath);
+
+LExit:
+    ReleaseObject(piPersistFile);
+    ReleaseObject(piShellLink);
+
+    return hr;
+}
+
+
+
+/******************************************************************
+ WixCreateInternetShortcuts - entry point for Internet shortcuts
+    custom action
+*******************************************************************/
+extern "C" UINT __stdcall WixCreateInternetShortcuts(
+    __in MSIHANDLE hInstall
+    )
+{
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    LPWSTR pwz = NULL;
+    LPWSTR pwzCustomActionData = NULL;
+    LPWSTR pwzTarget = NULL;
+    LPWSTR pwzShortcutPath = NULL;
+    LPWSTR pwzIconPath = NULL;
+    BOOL fInitializedCom = FALSE;
+    int iAttr = 0;
+    int iIconIndex = 0;
+
+    // initialize
+    hr = WcaInitialize(hInstall, "WixCreateInternetShortcuts");
+    ExitOnFailure(hr, "failed to initialize WixCreateInternetShortcuts");
+
+    hr = ::CoInitialize(NULL);
+    ExitOnFailure(hr, "failed to initialize COM");
+    fInitializedCom = TRUE;
+
+    // extract the custom action data
+    hr = WcaGetProperty(L"CustomActionData", &pwzCustomActionData);
+    ExitOnFailure(hr, "failed to get CustomActionData");
+
+    // loop through all the custom action data
+    pwz = pwzCustomActionData;
+    while (pwz && *pwz)
+    {
+        hr = WcaReadStringFromCaData(&pwz, &pwzShortcutPath);
+        ExitOnFailure(hr, "failed to read shortcut path from custom action data");
+        hr = WcaReadStringFromCaData(&pwz, &pwzTarget);
+        ExitOnFailure(hr, "failed to read shortcut target from custom action data");
+        hr = WcaReadIntegerFromCaData(&pwz, &iAttr);
+        ExitOnFailure(hr, "failed to read shortcut attributes from custom action data");
+        hr = WcaReadStringFromCaData(&pwz, &pwzIconPath);
+        ExitOnFailure(hr, "failed to read shortcut icon path from custom action data");
+        hr = WcaReadIntegerFromCaData(&pwz, &iIconIndex);
+        ExitOnFailure(hr, "failed to read shortcut icon index from custom action data");
+
+        if ((iAttr & esaURL) == esaURL)
+        {
+            hr = CreateUrl(pwzTarget, pwzShortcutPath, pwzIconPath, iIconIndex);
+        }
+        else
+        {
+            hr = CreateLink(pwzTarget, pwzShortcutPath, pwzIconPath, iIconIndex);
+        }
+        ExitOnFailure(hr, "failed to create Internet shortcut");
+
+        // tick the progress bar
+        hr = WcaProgressMessage(COST_INTERNETSHORTCUT, FALSE);
+        ExitOnFailure(hr, "failed to tick progress bar for shortcut: %ls", pwzShortcutPath);
+    }
+
+LExit:
+    ReleaseStr(pwzCustomActionData);
+    ReleaseStr(pwzTarget);
+    ReleaseStr(pwzShortcutPath);
+
+    if (fInitializedCom)
+    {
+        ::CoUninitialize();
+    }
+
+    er = FAILED(hr) ? ERROR_INSTALL_FAILURE : er;
+    return WcaFinalize(er);
+}
+
+
+
+/******************************************************************
+ WixRollbackInternetShortcuts - entry point for Internet shortcuts
+    custom action (rollback)
+*******************************************************************/
+extern "C" UINT __stdcall WixRollbackInternetShortcuts(
+    __in MSIHANDLE hInstall
+    )
+{
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    LPWSTR pwz = NULL;
+    LPWSTR pwzCustomActionData = NULL;
+    LPWSTR pwzShortcutPath = NULL;
+    int iAttr = 0;
+
+    // initialize
+    hr = WcaInitialize(hInstall, "WixRemoveInternetShortcuts");
+    ExitOnFailure(hr, "failed to initialize WixRemoveInternetShortcuts");
+
+    hr = WcaGetProperty(L"CustomActionData", &pwzCustomActionData);
+    ExitOnFailure(hr, "failed to get CustomActionData");
+
+    // loop through all the custom action data
+    pwz = pwzCustomActionData;
+    while (pwz && *pwz)
+    {
+        // extract the custom action data we're interested in
+        hr = WcaReadStringFromCaData(&pwz, &pwzShortcutPath);
+        ExitOnFailure(hr, "failed to read shortcut path from custom action data for rollback");
+
+        // delete file
+        hr = FileEnsureDelete(pwzShortcutPath);
+        ExitOnFailure(hr, "failed to delete file '%ls'", pwzShortcutPath);
+
+        // skip over the shortcut target and attributes
+        hr = WcaReadStringFromCaData(&pwz, &pwzShortcutPath);
+        ExitOnFailure(hr, "failed to skip shortcut target from custom action data for rollback");
+        hr = WcaReadIntegerFromCaData(&pwz, &iAttr);
+        ExitOnFailure(hr, "failed to read shortcut attributes from custom action data");
+    }
+
+LExit:
+    ReleaseStr(pwzCustomActionData);
+    ReleaseStr(pwzShortcutPath);
+
+    er = FAILED(hr) ? ERROR_INSTALL_FAILURE : er;
+    return WcaFinalize(er);
+}
diff --git a/src/ext/Util/ca/precomp.h b/src/ext/Util/ca/precomp.h
new file mode 100644
index 00000000..c5d6afe5
--- /dev/null
+++ b/src/ext/Util/ca/precomp.h
@@ -0,0 +1,54 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+#if _WIN32_MSI < 150
+#define _WIN32_MSI 150
+#endif
+
+#include <windows.h>
+#include <msiquery.h>
+#include <msidefs.h>
+#include <stierr.h>
+
+#include <strsafe.h>
+
+#include <msxml2.h>
+#include <Iads.h>
+#include <activeds.h> 
+#include <lm.h>        // NetApi32.lib
+#include <Ntsecapi.h>
+#include <Dsgetdc.h>
+#include <shlobj.h>
+#include <intshcut.h>
+
+#define MAXUINT USHRT_MAX
+
+#include "wcautil.h"
+#include "wcawow64.h"
+#include "wcawrapquery.h"
+#include "aclutil.h"
+#include "dirutil.h"
+#include "fileutil.h"
+#include "memutil.h"
+#include "osutil.h"
+#include "pathutil.h"
+#include "procutil.h"
+#include "shelutil.h"
+#include "strutil.h"
+#include "sczutil.h"
+#include "rmutil.h"
+#include "userutil.h"
+#include "xmlutil.h"
+#include "wiutil.h"
+
+#include "CustomMsiErrors.h"
+
+#include "sca.h"
+#include "scacost.h"
+#include "cost.h"
+#include "scauser.h"
+#include "scasmb.h"
+#include "scasmbexec.h"
+
+#include "caDecor.h"
diff --git a/src/ext/Util/ca/qtexecca.cpp b/src/ext/Util/ca/qtexecca.cpp
new file mode 100644
index 00000000..ddcc812f
--- /dev/null
+++ b/src/ext/Util/ca/qtexecca.cpp
@@ -0,0 +1,316 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+#define OUTPUT_BUFFER 1024
+
+// These old "CA" prefix names are deprecated, and intended to go away in wix 4.0, only staying now for compatibility reasons
+const LPCWSTR CAQUIET_TIMEOUT_PROPERTY = L"QtExecCmdTimeout";
+const LPCWSTR CAQUIET_ARGUMENTS_PROPERTY = L"QtExecCmdLine";
+const LPCWSTR CAQUIET64_ARGUMENTS_PROPERTY = L"QtExec64CmdLine";
+// end deprecated section
+
+// WixCA name quiet commandline argument properties
+const LPCWSTR WIX_QUIET_ARGUMENTS_PROPERTY = L"WixQuietExecCmdLine";
+const LPCWSTR WIX_QUIET64_ARGUMENTS_PROPERTY = L"WixQuietExec64CmdLine";
+
+// WixCA quiet timeout properties
+const LPCWSTR WIX_QUIET_TIMEOUT_PROPERTY = L"WixQuietExecCmdTimeout";
+const LPCWSTR WIX_QUIET64_TIMEOUT_PROPERTY = L"WixQuietExec64CmdTimeout";
+
+// WixCA silent commandline argument properties
+const LPCWSTR WIX_SILENT_ARGUMENTS_PROPERTY = L"WixSilentExecCmdLine";
+const LPCWSTR WIX_SILENT64_ARGUMENTS_PROPERTY = L"WixSilentExec64CmdLine";
+
+// WixCA silent timeout properties
+const LPCWSTR WIX_SILENT_TIMEOUT_PROPERTY = L"WixSilentExecCmdTimeout";
+const LPCWSTR WIX_SILENT64_TIMEOUT_PROPERTY = L"WixSilentExec64CmdTimeout";
+
+HRESULT BuildCommandLine(
+    __in LPCWSTR wzProperty,
+    __out LPWSTR *ppwzCommand
+    )
+{
+    Assert(ppwzCommand);
+
+    HRESULT hr = S_OK;
+    BOOL fScheduled = ::MsiGetMode(WcaGetInstallHandle(), MSIRUNMODE_SCHEDULED);
+    BOOL fRollback = ::MsiGetMode(WcaGetInstallHandle(), MSIRUNMODE_ROLLBACK);
+    BOOL fCommit = ::MsiGetMode(WcaGetInstallHandle(), MSIRUNMODE_COMMIT);
+
+    if (fScheduled || fRollback || fCommit)
+    {
+        if (WcaIsPropertySet("CustomActionData"))
+        {
+            hr = WcaGetProperty( L"CustomActionData", ppwzCommand);
+            ExitOnFailure(hr, "Failed to get CustomActionData");
+        }
+    }
+    else if (WcaIsUnicodePropertySet(wzProperty))
+    {
+        hr = WcaGetFormattedProperty(wzProperty, ppwzCommand);
+        ExitOnFailure(hr, "Failed to get %ls", wzProperty);
+        hr = WcaSetProperty(wzProperty, L""); // clear out the property now that we've read it
+        ExitOnFailure(hr, "Failed to set %ls", wzProperty);
+    }
+
+    if (!*ppwzCommand)
+    {
+        ExitOnFailure(hr = E_INVALIDARG, "Failed to get command line data");
+    }
+
+    if (L'"' != **ppwzCommand)
+    {
+        WcaLog(LOGMSG_STANDARD, "Command string must begin with quoted application name.");
+        ExitOnFailure(hr = E_INVALIDARG, "invalid command line property value");
+    }
+
+LExit:
+    return hr;
+}
+
+#define ONEMINUTE 60000
+
+DWORD GetTimeout(LPCWSTR wzPropertyName)
+{
+    DWORD dwTimeout = ONEMINUTE;
+    HRESULT hr = S_OK;
+
+    LPWSTR pwzData = NULL;
+
+    if (WcaIsUnicodePropertySet(wzPropertyName))
+    {
+        hr = WcaGetProperty(wzPropertyName, &pwzData);
+        ExitOnFailure(hr, "Failed to get %ls", wzPropertyName);
+
+        if ((dwTimeout = (DWORD)_wtoi(pwzData)) == 0)
+        {
+            dwTimeout = ONEMINUTE;
+        }
+    }
+
+LExit:
+    ReleaseStr(pwzData);
+
+    return dwTimeout;
+
+}
+
+HRESULT ExecCommon(
+    __in LPCWSTR wzArgumentsProperty,
+    __in LPCWSTR wzTimeoutProperty,
+    __in BOOL fLogCommand,
+    __in BOOL fLogOutput
+    )
+{
+    HRESULT hr = S_OK;
+    LPWSTR pwzCommand = NULL;
+    DWORD dwTimeout = 0;
+
+    hr = BuildCommandLine(wzArgumentsProperty, &pwzCommand);
+    ExitOnFailure(hr, "Failed to get Command Line");
+
+    dwTimeout = GetTimeout(wzTimeoutProperty);
+
+    hr = QuietExec(pwzCommand, dwTimeout, fLogCommand, fLogOutput);
+    ExitOnFailure(hr, "QuietExec Failed");
+
+LExit:
+    ReleaseStr(pwzCommand);
+
+    return hr;
+}
+
+HRESULT ExecCommon64(
+    __in LPCWSTR wzArgumentsProperty,
+    __in LPCWSTR wzTimeoutProperty,
+    __in BOOL fLogCommand,
+    __in BOOL fLogOutput
+    )
+{
+    HRESULT hr = S_OK;
+    LPWSTR pwzCommand = NULL;
+    DWORD dwTimeout = 0;
+#ifndef _WIN64
+    BOOL fIsWow64Initialized = FALSE;
+    BOOL fRedirected = FALSE;
+
+    hr = WcaInitializeWow64();
+    if (S_FALSE == hr)
+    {
+        hr = TYPE_E_DLLFUNCTIONNOTFOUND;
+    }
+    ExitOnFailure(hr, "Failed to intialize WOW64.");
+    fIsWow64Initialized = TRUE;
+
+    hr = WcaDisableWow64FSRedirection();
+    ExitOnFailure(hr, "Failed to enable filesystem redirection.");
+    fRedirected = TRUE;
+#endif
+
+    hr = BuildCommandLine(wzArgumentsProperty, &pwzCommand);
+    ExitOnFailure(hr, "Failed to get Command Line");
+
+    dwTimeout = GetTimeout(wzTimeoutProperty);
+
+    hr = QuietExec(pwzCommand, dwTimeout, fLogCommand, fLogOutput);
+    ExitOnFailure(hr, "QuietExec64 Failed");
+
+LExit:
+    ReleaseStr(pwzCommand);
+
+#ifndef _WIN64
+    if (fRedirected)
+    {
+        WcaRevertWow64FSRedirection();
+    }
+
+    if (fIsWow64Initialized)
+    {
+        WcaFinalizeWow64();
+    }
+#endif
+
+    return hr;
+}
+
+// These two custom actions are deprecated, and should go away in wix v4.0. WixQuietExec replaces this one,
+// and is not intended to have any difference in behavior apart from CA name and property names.
+extern "C" UINT __stdcall CAQuietExec(
+    __in MSIHANDLE hInstall
+    )
+{
+    Assert(hInstall);
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    hr = WcaInitialize(hInstall, "CAQuietExec");
+    ExitOnFailure(hr, "Failed to initialize");
+
+    hr = ExecCommon(CAQUIET_ARGUMENTS_PROPERTY, CAQUIET_TIMEOUT_PROPERTY, TRUE, TRUE);
+    ExitOnFailure(hr, "Failed in ExecCommon method");
+
+LExit:
+    if (FAILED(hr))
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+
+    return WcaFinalize(er); 
+}
+
+// 2nd deprecated custom action name, superseded by WixQuietExec64
+extern "C" UINT __stdcall CAQuietExec64(
+    __in MSIHANDLE hInstall
+    )
+{
+    Assert(hInstall);
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    hr = WcaInitialize(hInstall, "CAQuietExec64");
+    ExitOnFailure(hr, "Failed to initialize");
+
+    hr = ExecCommon64(CAQUIET64_ARGUMENTS_PROPERTY, CAQUIET_TIMEOUT_PROPERTY, TRUE, TRUE);
+    ExitOnFailure(hr, "Failed in ExecCommon64 method");
+
+LExit:
+    if (FAILED(hr))
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+
+    return WcaFinalize(er);
+}
+
+extern "C" UINT __stdcall WixQuietExec(
+    __in MSIHANDLE hInstall
+    )
+{
+    Assert(hInstall);
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    hr = WcaInitialize(hInstall, "WixQuietExec");
+    ExitOnFailure(hr, "Failed to initialize");
+
+    hr = ExecCommon(WIX_QUIET_ARGUMENTS_PROPERTY, WIX_QUIET_TIMEOUT_PROPERTY, TRUE, TRUE);
+    ExitOnFailure(hr, "Failed in ExecCommon method");
+
+LExit:
+    if (FAILED(hr))
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+
+    return WcaFinalize(er); 
+}
+
+extern "C" UINT __stdcall WixQuietExec64(
+    __in MSIHANDLE hInstall
+    )
+{
+    Assert(hInstall);
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    hr = WcaInitialize(hInstall, "WixQuietExec64");
+    ExitOnFailure(hr, "Failed to initialize");
+
+    hr = ExecCommon64(WIX_QUIET64_ARGUMENTS_PROPERTY, WIX_QUIET64_TIMEOUT_PROPERTY, TRUE, TRUE);
+    ExitOnFailure(hr, "Failed in ExecCommon method");
+
+LExit:
+    if (FAILED(hr))
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+
+    return WcaFinalize(er);
+}
+
+extern "C" UINT __stdcall WixSilentExec(
+    __in MSIHANDLE hInstall
+    )
+{
+    Assert(hInstall);
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    hr = WcaInitialize(hInstall, "WixSilentExec");
+    ExitOnFailure(hr, "Failed to initialize");
+
+    hr = ExecCommon(WIX_SILENT_ARGUMENTS_PROPERTY, WIX_SILENT_TIMEOUT_PROPERTY, FALSE, FALSE);
+    ExitOnFailure(hr, "Failed in ExecCommon method");
+
+LExit:
+    if (FAILED(hr))
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+
+    return WcaFinalize(er); 
+}
+
+extern "C" UINT __stdcall WixSilentExec64(
+    __in MSIHANDLE hInstall
+    )
+{
+    Assert(hInstall);
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    hr = WcaInitialize(hInstall, "WixSilentExec64");
+    ExitOnFailure(hr, "Failed to initialize");
+
+    hr = ExecCommon64(WIX_SILENT64_ARGUMENTS_PROPERTY, WIX_SILENT64_TIMEOUT_PROPERTY, FALSE, FALSE);
+    ExitOnFailure(hr, "Failed in ExecCommon method");
+
+LExit:
+    if (FAILED(hr))
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+
+    return WcaFinalize(er);
+}
diff --git a/src/ext/Util/ca/sca.h b/src/ext/Util/ca/sca.h
new file mode 100644
index 00000000..599122ff
--- /dev/null
+++ b/src/ext/Util/ca/sca.h
@@ -0,0 +1,19 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+// user creation attributes definitions
+enum SCAU_ATTRIBUTES
+{
+    SCAU_DONT_EXPIRE_PASSWRD = 0x00000001,
+    SCAU_PASSWD_CANT_CHANGE = 0x00000002,
+    SCAU_PASSWD_CHANGE_REQD_ON_LOGIN = 0x00000004,
+    SCAU_DISABLE_ACCOUNT = 0x00000008,
+    SCAU_FAIL_IF_EXISTS = 0x00000010,
+    SCAU_UPDATE_IF_EXISTS = 0x00000020,
+    SCAU_ALLOW_LOGON_AS_SERVICE = 0x00000040,
+    SCAU_ALLOW_LOGON_AS_BATCH = 0x00000080,
+
+    SCAU_DONT_REMOVE_ON_UNINSTALL = 0x00000100,
+    SCAU_DONT_CREATE_USER = 0x00000200,
+    SCAU_NON_VITAL = 0x00000400,
+};
\ No newline at end of file
diff --git a/src/ext/Util/ca/scacost.h b/src/ext/Util/ca/scacost.h
new file mode 100644
index 00000000..5b215035
--- /dev/null
+++ b/src/ext/Util/ca/scacost.h
@@ -0,0 +1,18 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+const UINT COST_PERFMON_REGISTER = 1000;
+const UINT COST_PERFMON_UNREGISTER = 1000;
+
+const UINT COST_SMB_CREATESMB = 10000;
+const UINT COST_SMB_DROPSMB = 5000;
+const UINT COST_USER_ADD = 10000;
+const UINT COST_USER_DELETE = 10000;
+
+const UINT COST_PERFMONMANIFEST_REGISTER = 1000;
+const UINT COST_PERFMONMANIFEST_UNREGISTER = 1000;
+
+const UINT COST_EVENTMANIFEST_REGISTER = 1000;
+const UINT COST_EVENTMANIFEST_UNREGISTER = 1000;
+
diff --git a/src/ext/Util/ca/scaexec.cpp b/src/ext/Util/ca/scaexec.cpp
new file mode 100644
index 00000000..5845c1b4
--- /dev/null
+++ b/src/ext/Util/ca/scaexec.cpp
@@ -0,0 +1,1082 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+
+/********************************************************************
+ * CreateSmb - CUSTOM ACTION ENTRY POINT for creating fileshares
+ *
+ * Input:  deferred CustomActionData -
+ *    wzFsKey\twzShareDesc\twzFullPath\tfIntegratedAuth\twzUserName\tnPermissions\twzUserName\tnPermissions...
+ *
+ * ****************************************************************/
+extern "C" UINT __stdcall CreateSmb(MSIHANDLE hInstall)
+{
+//AssertSz(0, "debug CreateSmb");
+    UINT er = ERROR_SUCCESS;
+    HRESULT hr = S_OK;
+
+    LPWSTR pwzData = NULL;
+    LPWSTR pwz = NULL;
+    LPWSTR pwzFsKey = NULL;
+    LPWSTR pwzShareDesc = NULL;
+    LPWSTR pwzDirectory = NULL;
+    int iAccessMode = 0;
+    DWORD nExPermissions = 0;
+    BOOL fIntegratedAuth;
+    LPWSTR pwzExUser = NULL;
+    SCA_SMBP ssp = {0};
+    DWORD dwExUserPerms = 0;
+    DWORD dwCounter = 0;
+    SCA_SMBP_USER_PERMS* pUserPermsList = NULL;
+
+    hr = WcaInitialize(hInstall, "CreateSmb");
+    ExitOnFailure(hr, "failed to initialize");
+
+    hr = WcaGetProperty( L"CustomActionData", &pwzData);
+    ExitOnFailure(hr, "failed to get CustomActionData");
+
+    WcaLog(LOGMSG_TRACEONLY, "CustomActionData: %ls", pwzData);
+
+    pwz = pwzData;
+    hr = WcaReadStringFromCaData(&pwz, &pwzFsKey); // share name
+    ExitOnFailure(hr, "failed to read share name");
+    hr = WcaReadStringFromCaData(&pwz, &pwzShareDesc); // share description
+    ExitOnFailure(hr, "failed to read share name");
+    hr = WcaReadStringFromCaData(&pwz, &pwzDirectory); // full path to share
+    ExitOnFailure(hr, "failed to read share name");
+    hr = WcaReadIntegerFromCaData(&pwz, reinterpret_cast<int *>(&fIntegratedAuth));
+    ExitOnFailure(hr, "failed to read integrated authentication");
+
+    hr = WcaReadIntegerFromCaData(&pwz, reinterpret_cast<int *>(&dwExUserPerms));
+    ExitOnFailure(hr, "failed to read count of permissions to set");
+    if(dwExUserPerms > 0)
+    {
+        pUserPermsList = static_cast<SCA_SMBP_USER_PERMS*>(MemAlloc(sizeof(SCA_SMBP_USER_PERMS)*dwExUserPerms, TRUE));
+        ExitOnNull(pUserPermsList, hr, E_OUTOFMEMORY, "failed to allocate memory for permissions structure");
+
+        //Pull out all of the ExUserPerm strings
+        for (dwCounter = 0; dwCounter < dwExUserPerms; ++dwCounter)
+        {
+            hr = WcaReadStringFromCaData(&pwz, &pwzExUser); // user account
+            ExitOnFailure(hr, "failed to read user account");
+            pUserPermsList[dwCounter].wzUser = pwzExUser;
+            pwzExUser = NULL;
+
+            hr = WcaReadIntegerFromCaData(&pwz, &iAccessMode);
+            ExitOnFailure(hr, "failed to read access mode");
+            pUserPermsList[dwCounter].accessMode = (ACCESS_MODE)iAccessMode;
+            iAccessMode = 0;
+
+            hr = WcaReadIntegerFromCaData(&pwz, reinterpret_cast<int *>(&nExPermissions));
+            ExitOnFailure(hr, "failed to read count of permissions");
+            pUserPermsList[dwCounter].nPermissions = nExPermissions;
+            nExPermissions = 0;
+        }
+    }
+
+    ssp.wzKey = pwzFsKey;
+    ssp.wzDescription = pwzShareDesc;
+    ssp.wzDirectory = pwzDirectory;
+    ssp.fUseIntegratedAuth = fIntegratedAuth;
+    ssp.dwUserPermissionCount = dwExUserPerms;
+    ssp.pUserPerms = pUserPermsList;
+
+    hr = ScaEnsureSmbExists(&ssp);
+    MessageExitOnFailure(hr, msierrSMBFailedCreate, "failed to create share: '%ls'", pwzFsKey);
+
+    hr = WcaProgressMessage(COST_SMB_CREATESMB, FALSE);
+
+LExit:
+    ReleaseStr(pwzFsKey);
+    ReleaseStr(pwzShareDesc);
+    ReleaseStr(pwzDirectory);
+    ReleaseStr(pwzData);
+
+    if (pUserPermsList)
+    {
+        MemFree(pUserPermsList);
+    }
+
+    if (FAILED(hr))
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+    return WcaFinalize(er);
+}
+
+
+
+/********************************************************************
+ DropSmb - CUSTOM ACTION ENTRY POINT for creating fileshares
+
+ Input:  deferred CustomActionData - wzFsKey\twzShareDesc\twzFullPath\tnPermissions\tfIntegratedAuth\twzUserName\twzPassword
+
+ * ****************************************************************/
+extern "C" UINT __stdcall DropSmb(MSIHANDLE hInstall)
+{
+    //AssertSz(0, "debug DropSmb");
+    UINT er = ERROR_SUCCESS;
+    HRESULT hr = S_OK;
+
+    LPWSTR pwzData = NULL;
+    LPWSTR pwz = NULL;
+    LPWSTR pwzFsKey = NULL;
+    SCA_SMBP ssp = {0};
+
+    hr = WcaInitialize(hInstall, "DropSmb");
+    ExitOnFailure(hr, "failed to initialize");
+
+    hr = WcaGetProperty( L"CustomActionData", &pwzData);
+    ExitOnFailure(hr, "failed to get CustomActionData");
+
+    WcaLog(LOGMSG_TRACEONLY, "CustomActionData: %ls", pwzData);
+
+    pwz = pwzData;
+    hr = WcaReadStringFromCaData(&pwz, &pwzFsKey); // share name
+    ExitOnFailure(hr, "failed to read share name");
+
+    ssp.wzKey = pwzFsKey;
+
+    hr = ScaDropSmb(&ssp);
+    MessageExitOnFailure(hr, msierrSMBFailedDrop, "failed to delete share: '%ls'", pwzFsKey);
+
+    hr = WcaProgressMessage(COST_SMB_DROPSMB, FALSE);
+
+LExit:
+    ReleaseStr(pwzFsKey);
+    ReleaseStr(pwzData);
+
+    if (FAILED(hr))
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+    return WcaFinalize(er);
+}
+
+
+static HRESULT AddUserToGroup(
+    __in LPWSTR wzUser,
+    __in LPCWSTR wzUserDomain,
+    __in LPCWSTR wzGroup,
+    __in LPCWSTR wzGroupDomain
+    )
+{
+    Assert(wzUser && *wzUser && wzUserDomain && wzGroup && *wzGroup && wzGroupDomain);
+
+    HRESULT hr = S_OK;
+    IADsGroup *pGroup = NULL;
+    BSTR bstrUser = NULL;
+    BSTR bstrGroup = NULL;
+    LPCWSTR wz = NULL;
+    LPWSTR pwzUser = NULL;
+    LOCALGROUP_MEMBERS_INFO_3 lgmi;
+
+    if (*wzGroupDomain)
+    {
+        wz = wzGroupDomain;
+    }
+
+    // Try adding it to the global group first
+    UINT ui = ::NetGroupAddUser(wz, wzGroup, wzUser);
+    if (NERR_GroupNotFound == ui)
+    {
+        // Try adding it to the local group
+        if (wzUserDomain)
+        {
+            hr = StrAllocFormatted(&pwzUser, L"%s\\%s", wzUserDomain, wzUser);
+            ExitOnFailure(hr, "failed to allocate user domain string");
+        }
+
+        lgmi.lgrmi3_domainandname = (NULL == pwzUser ? wzUser : pwzUser);
+        ui = ::NetLocalGroupAddMembers(wz, wzGroup, 3 , reinterpret_cast<LPBYTE>(&lgmi), 1);
+    }
+    hr = HRESULT_FROM_WIN32(ui);
+    if (HRESULT_FROM_WIN32(ERROR_MEMBER_IN_ALIAS) == hr) // if they're already a member of the group don't report an error
+        hr = S_OK;
+
+    //
+    // If we failed, try active directory
+    //
+    if (FAILED(hr))
+    {
+        WcaLog(LOGMSG_VERBOSE, "Failed to add user: %ls, domain %ls to group: %ls, domain: %ls with error 0x%x.  Attempting to use Active Directory", wzUser, wzUserDomain, wzGroup, wzGroupDomain, hr);
+
+        hr = UserCreateADsPath(wzUserDomain, wzUser, &bstrUser);
+        ExitOnFailure(hr, "failed to create user ADsPath for user: %ls domain: %ls", wzUser, wzUserDomain);
+
+        hr = UserCreateADsPath(wzGroupDomain, wzGroup, &bstrGroup);
+        ExitOnFailure(hr, "failed to create group ADsPath for group: %ls domain: %ls", wzGroup, wzGroupDomain);
+
+        hr = ::ADsGetObject(bstrGroup,IID_IADsGroup, reinterpret_cast<void**>(&pGroup));
+        ExitOnFailure(hr, "Failed to get group '%ls'.", reinterpret_cast<WCHAR*>(bstrGroup) );
+
+        hr = pGroup->Add(bstrUser);
+        if ((HRESULT_FROM_WIN32(ERROR_OBJECT_ALREADY_EXISTS) == hr) || (HRESULT_FROM_WIN32(ERROR_MEMBER_IN_ALIAS) == hr))
+            hr = S_OK;
+
+        ExitOnFailure(hr, "Failed to add user %ls to group '%ls'.", reinterpret_cast<WCHAR*>(bstrUser), reinterpret_cast<WCHAR*>(bstrGroup) );
+    }
+
+LExit:
+    ReleaseObject(pGroup);
+    ReleaseBSTR(bstrUser);
+    ReleaseBSTR(bstrGroup);
+
+    return hr;
+}
+
+static HRESULT RemoveUserFromGroup(
+    __in LPWSTR wzUser,
+    __in LPCWSTR wzUserDomain,
+    __in LPCWSTR wzGroup,
+    __in LPCWSTR wzGroupDomain
+    )
+{
+    Assert(wzUser && *wzUser && wzUserDomain && wzGroup && *wzGroup && wzGroupDomain);
+
+    HRESULT hr = S_OK;
+    IADsGroup *pGroup = NULL;
+    BSTR bstrUser = NULL;
+    BSTR bstrGroup = NULL;
+    LPCWSTR wz = NULL;
+    LPWSTR pwzUser = NULL;
+    LOCALGROUP_MEMBERS_INFO_3 lgmi;
+
+    if (*wzGroupDomain)
+    {
+        wz = wzGroupDomain;
+    }
+
+    // Try removing it from the global group first
+    UINT ui = ::NetGroupDelUser(wz, wzGroup, wzUser);
+    if (NERR_GroupNotFound == ui)
+    {
+        // Try removing it from the local group
+        if (wzUserDomain)
+        {
+            hr = StrAllocFormatted(&pwzUser, L"%s\\%s", wzUserDomain, wzUser);
+            ExitOnFailure(hr, "failed to allocate user domain string");
+        }
+
+        lgmi.lgrmi3_domainandname = (NULL == pwzUser ? wzUser : pwzUser);
+        ui = ::NetLocalGroupDelMembers(wz, wzGroup, 3 , reinterpret_cast<LPBYTE>(&lgmi), 1);
+    }
+    hr = HRESULT_FROM_WIN32(ui);
+
+    //
+    // If we failed, try active directory
+    //
+    if (FAILED(hr))
+    {
+        WcaLog(LOGMSG_VERBOSE, "Failed to remove user: %ls, domain %ls from group: %ls, domain: %ls with error 0x%x.  Attempting to use Active Directory", wzUser, wzUserDomain, wzGroup, wzGroupDomain, hr);
+
+        hr = UserCreateADsPath(wzUserDomain, wzUser, &bstrUser);
+        ExitOnFailure(hr, "failed to create user ADsPath in order to remove user: %ls domain: %ls from a group", wzUser, wzUserDomain);
+
+        hr = UserCreateADsPath(wzGroupDomain, wzGroup, &bstrGroup);
+        ExitOnFailure(hr, "failed to create group ADsPath in order to remove user from group: %ls domain: %ls", wzGroup, wzGroupDomain);
+
+        hr = ::ADsGetObject(bstrGroup,IID_IADsGroup, reinterpret_cast<void**>(&pGroup));
+        ExitOnFailure(hr, "Failed to get group '%ls'.", reinterpret_cast<WCHAR*>(bstrGroup) );
+
+        hr = pGroup->Remove(bstrUser);
+        ExitOnFailure(hr, "Failed to remove user %ls from group '%ls'.", reinterpret_cast<WCHAR*>(bstrUser), reinterpret_cast<WCHAR*>(bstrGroup) );
+    }
+
+LExit:
+    ReleaseObject(pGroup);
+    ReleaseBSTR(bstrUser);
+    ReleaseBSTR(bstrGroup);
+
+    return hr;
+}
+
+
+static HRESULT GetUserHasRight(
+    __in LSA_HANDLE hPolicy,
+    __in PSID pUserSid,
+    __in LPWSTR wzRight,
+    __out BOOL* fHasRight
+)
+{
+    HRESULT hr = S_OK;
+    NTSTATUS nt = 0;
+    LSA_UNICODE_STRING lucPrivilege = { 0 };
+    PLSA_ENUMERATION_INFORMATION rgSids = NULL;
+    ULONG cSids = 0;
+    *fHasRight = FALSE;
+
+    lucPrivilege.Buffer = wzRight;
+    lucPrivilege.Length = static_cast<USHORT>(lstrlenW(lucPrivilege.Buffer) * sizeof(WCHAR));
+    lucPrivilege.MaximumLength = (lucPrivilege.Length + 1) * sizeof(WCHAR);
+
+    nt = ::LsaEnumerateAccountsWithUserRight(hPolicy, &lucPrivilege, reinterpret_cast<PVOID*>(&rgSids), &cSids);
+    hr = HRESULT_FROM_WIN32(::LsaNtStatusToWinError(nt));
+    ExitOnFailure(hr, "Failed to enumerate users for right: %ls", lucPrivilege.Buffer);
+
+    for (DWORD i = 0; i < cSids; ++i)
+    {
+        PLSA_ENUMERATION_INFORMATION pInfo = rgSids + i;
+        if (::EqualSid(pUserSid, pInfo->Sid))
+        {
+            *fHasRight = TRUE;
+            break;
+        }
+    }
+
+LExit:
+    if (rgSids)
+    {
+        ::LsaFreeMemory(rgSids);
+    }
+
+    return hr;
+}
+
+
+static HRESULT GetExistingUserRightsAssignments(
+    __in_opt LPCWSTR wzDomain,
+    __in LPCWSTR wzName,
+    __inout int* iAttributes
+)
+{
+    HRESULT hr = S_OK;
+    NTSTATUS nt = 0;
+    BOOL fHasRight = FALSE;
+
+    LSA_HANDLE hPolicy = NULL;
+    LSA_OBJECT_ATTRIBUTES objectAttributes = { 0 };
+
+    LPWSTR pwzUser = NULL;
+    PSID psid = NULL;
+
+    if (wzDomain && *wzDomain)
+    {
+        hr = StrAllocFormatted(&pwzUser, L"%s\\%s", wzDomain, wzName);
+        ExitOnFailure(hr, "Failed to allocate user with domain string");
+    }
+    else
+    {
+        hr = StrAllocString(&pwzUser, wzName, 0);
+        ExitOnFailure(hr, "Failed to allocate string from user name.");
+    }
+
+    hr = AclGetAccountSid(NULL, pwzUser, &psid);
+    ExitOnFailure(hr, "Failed to get SID for user: %ls", pwzUser);
+
+    nt = ::LsaOpenPolicy(NULL, &objectAttributes, POLICY_LOOKUP_NAMES | POLICY_VIEW_LOCAL_INFORMATION, &hPolicy);
+    hr = HRESULT_FROM_WIN32(::LsaNtStatusToWinError(nt));
+    ExitOnFailure(hr, "Failed to open LSA policy store");
+
+    hr = GetUserHasRight(hPolicy, psid, L"SeServiceLogonRight", &fHasRight);
+    ExitOnFailure(hr, "Failed to check LogonAsService right");
+
+    if (fHasRight)
+    {
+        *iAttributes |= SCAU_ALLOW_LOGON_AS_SERVICE;
+    }
+
+    hr = GetUserHasRight(hPolicy, psid, L"SeBatchLogonRight", &fHasRight);
+    ExitOnFailure(hr, "Failed to check LogonAsBatchJob right");
+
+    if (fHasRight)
+    {
+        *iAttributes |= SCAU_ALLOW_LOGON_AS_BATCH;
+    }
+
+LExit:
+    if (hPolicy)
+    {
+        ::LsaClose(hPolicy);
+    }
+
+    ReleaseSid(psid);
+    ReleaseStr(pwzUser);
+    return hr;
+}
+
+
+static HRESULT ModifyUserLocalServiceRight(
+    __in_opt LPCWSTR wzDomain,
+    __in LPCWSTR wzName,
+    __in BOOL fAdd
+    )
+{
+    HRESULT hr = S_OK;
+    NTSTATUS nt = 0;
+
+    LPWSTR pwzUser = NULL;
+    PSID psid = NULL;
+    LSA_HANDLE hPolicy = NULL;
+    LSA_OBJECT_ATTRIBUTES ObjectAttributes = { 0 };
+    LSA_UNICODE_STRING lucPrivilege = { 0 };
+
+    if (wzDomain && *wzDomain)
+    {
+        hr = StrAllocFormatted(&pwzUser, L"%s\\%s", wzDomain, wzName);
+        ExitOnFailure(hr, "Failed to allocate user with domain string");
+    }
+    else
+    {
+        hr = StrAllocString(&pwzUser, wzName, 0);
+        ExitOnFailure(hr, "Failed to allocate string from user name.");
+    }
+
+    hr = AclGetAccountSid(NULL, pwzUser, &psid);
+    ExitOnFailure(hr, "Failed to get SID for user: %ls", pwzUser);
+
+    nt = ::LsaOpenPolicy(NULL, &ObjectAttributes, POLICY_ALL_ACCESS, &hPolicy);
+    hr = HRESULT_FROM_WIN32(::LsaNtStatusToWinError(nt));
+    ExitOnFailure(hr, "Failed to open LSA policy store.");
+
+    lucPrivilege.Buffer = L"SeServiceLogonRight";
+    lucPrivilege.Length = static_cast<USHORT>(lstrlenW(lucPrivilege.Buffer) * sizeof(WCHAR));
+    lucPrivilege.MaximumLength = (lucPrivilege.Length + 1) * sizeof(WCHAR);
+
+    if (fAdd)
+    {
+        nt = ::LsaAddAccountRights(hPolicy, psid, &lucPrivilege, 1);
+        hr = HRESULT_FROM_WIN32(::LsaNtStatusToWinError(nt));
+        ExitOnFailure(hr, "Failed to add 'logon as service' bit to user: %ls", pwzUser);
+    }
+    else
+    {
+        nt = ::LsaRemoveAccountRights(hPolicy, psid, FALSE, &lucPrivilege, 1);
+        hr = HRESULT_FROM_WIN32(::LsaNtStatusToWinError(nt));
+        ExitOnFailure(hr, "Failed to remove 'logon as service' bit from user: %ls", pwzUser);
+    }
+
+LExit:
+    if (hPolicy)
+    {
+        ::LsaClose(hPolicy);
+    }
+
+    ReleaseSid(psid);
+    ReleaseStr(pwzUser);
+    return hr;
+}
+
+
+static HRESULT ModifyUserLocalBatchRight(
+  __in_opt LPCWSTR wzDomain,
+  __in LPCWSTR wzName,
+  __in BOOL fAdd
+  )
+{
+    HRESULT hr = S_OK;
+    NTSTATUS nt = 0;
+
+    LPWSTR pwzUser = NULL;
+    PSID psid = NULL;
+    LSA_HANDLE hPolicy = NULL;
+    LSA_OBJECT_ATTRIBUTES ObjectAttributes = { 0 };
+    LSA_UNICODE_STRING lucPrivilege = { 0 };
+
+    if (wzDomain && *wzDomain)
+    {
+        hr = StrAllocFormatted(&pwzUser, L"%s\\%s", wzDomain, wzName);
+        ExitOnFailure(hr, "Failed to allocate user with domain string");
+    }
+    else
+    {
+        hr = StrAllocString(&pwzUser, wzName, 0);
+        ExitOnFailure(hr, "Failed to allocate string from user name.");
+    }
+
+    hr = AclGetAccountSid(NULL, pwzUser, &psid);
+    ExitOnFailure(hr, "Failed to get SID for user: %ls", pwzUser);
+
+    nt = ::LsaOpenPolicy(NULL, &ObjectAttributes, POLICY_ALL_ACCESS, &hPolicy);
+    hr = HRESULT_FROM_WIN32(::LsaNtStatusToWinError(nt));
+    ExitOnFailure(hr, "Failed to open LSA policy store.");
+
+    lucPrivilege.Buffer = L"SeBatchLogonRight";
+    lucPrivilege.Length = static_cast<USHORT>(lstrlenW(lucPrivilege.Buffer) * sizeof(WCHAR));
+    lucPrivilege.MaximumLength = (lucPrivilege.Length + 1) * sizeof(WCHAR);
+
+    if (fAdd)
+    {
+        nt = ::LsaAddAccountRights(hPolicy, psid, &lucPrivilege, 1);
+        hr = HRESULT_FROM_WIN32(::LsaNtStatusToWinError(nt));
+        ExitOnFailure(hr, "Failed to add 'logon as batch job' bit to user: %ls", pwzUser);
+    }
+    else
+    {
+        nt = ::LsaRemoveAccountRights(hPolicy, psid, FALSE, &lucPrivilege, 1);
+        hr = HRESULT_FROM_WIN32(::LsaNtStatusToWinError(nt));
+        ExitOnFailure(hr, "Failed to remove 'logon as batch job' bit from user: %ls", pwzUser);
+    }
+
+  LExit:
+    if (hPolicy)
+    {
+        ::LsaClose(hPolicy);
+    }
+
+    ReleaseSid(psid);
+    ReleaseStr(pwzUser);
+    return hr;
+}
+
+static void SetUserPasswordAndAttributes(
+    __in USER_INFO_1* puserInfo,
+    __in LPWSTR wzPassword,
+    __in int iAttributes
+    )
+{
+    Assert(puserInfo);
+
+    // Set the User's password
+    puserInfo->usri1_password = wzPassword;
+
+    // Apply the Attributes
+    if (SCAU_DONT_EXPIRE_PASSWRD & iAttributes)
+    {
+        puserInfo->usri1_flags |= UF_DONT_EXPIRE_PASSWD;
+    }
+    else
+    {
+        puserInfo->usri1_flags &= ~UF_DONT_EXPIRE_PASSWD;
+    }
+
+    if (SCAU_PASSWD_CANT_CHANGE & iAttributes)
+    {
+        puserInfo->usri1_flags |= UF_PASSWD_CANT_CHANGE;
+    }
+    else
+    {
+        puserInfo->usri1_flags &= ~UF_PASSWD_CANT_CHANGE;
+    }
+
+    if (SCAU_DISABLE_ACCOUNT & iAttributes)
+    {
+        puserInfo->usri1_flags |= UF_ACCOUNTDISABLE;
+    }
+    else
+    {
+        puserInfo->usri1_flags &= ~UF_ACCOUNTDISABLE;
+    }
+
+    if (SCAU_PASSWD_CHANGE_REQD_ON_LOGIN & iAttributes) // TODO: for some reason this doesn't work
+    {
+        puserInfo->usri1_flags |= UF_PASSWORD_EXPIRED;
+    }
+    else
+    {
+        puserInfo->usri1_flags &= ~UF_PASSWORD_EXPIRED;
+    }
+}
+
+
+static HRESULT RemoveUserInternal(
+    LPWSTR wzGroupCaData,
+    LPWSTR wzDomain,
+    LPWSTR wzName,
+    int iAttributes
+)
+{
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    LPWSTR pwz = NULL;
+    LPWSTR pwzGroup = NULL;
+    LPWSTR pwzGroupDomain = NULL;
+    LPCWSTR wz = NULL;
+    PDOMAIN_CONTROLLER_INFOW pDomainControllerInfo = NULL;
+
+    //
+    // Remove the logon as service privilege.
+    //
+    if (SCAU_ALLOW_LOGON_AS_SERVICE & iAttributes)
+    {
+        hr = ModifyUserLocalServiceRight(wzDomain, wzName, FALSE);
+        if (FAILED(hr))
+        {
+            WcaLogError(hr, "Failed to remove logon as service right from user, continuing...");
+            hr = S_OK;
+        }
+    }
+
+    if (SCAU_ALLOW_LOGON_AS_BATCH & iAttributes)
+    {
+        hr = ModifyUserLocalBatchRight(wzDomain, wzName, FALSE);
+        if (FAILED(hr))
+        {
+            WcaLogError(hr, "Failed to remove logon as batch job right from user, continuing...");
+            hr = S_OK;
+        }
+    }
+
+    //
+    // Remove the User Account if the user was created by us.
+    //
+    if (!(SCAU_DONT_CREATE_USER & iAttributes))
+    {
+        if (wzDomain && *wzDomain)
+        {
+            er = ::DsGetDcNameW(NULL, (LPCWSTR)wzDomain, NULL, NULL, NULL, &pDomainControllerInfo);
+            if (RPC_S_SERVER_UNAVAILABLE == er)
+            {
+                // MSDN says, if we get the above error code, try again with the "DS_FORCE_REDISCOVERY" flag
+                er = ::DsGetDcNameW(NULL, (LPCWSTR)wzDomain, NULL, NULL, DS_FORCE_REDISCOVERY, &pDomainControllerInfo);
+            }
+            if (ERROR_SUCCESS == er)
+            {
+                wz = pDomainControllerInfo->DomainControllerName + 2;  //Add 2 so that we don't get the \\ prefix
+            }
+            else
+            {
+                wz = wzDomain;
+            }
+        }
+
+        er = ::NetUserDel(wz, wzName);
+        if (NERR_UserNotFound == er)
+        {
+            er = NERR_Success;
+        }
+        ExitOnFailure(hr = HRESULT_FROM_WIN32(er), "failed to delete user account: %ls", wzName);
+    }
+    else
+    {
+        //
+        // Remove the user from the groups
+        //
+        pwz = wzGroupCaData;
+        while (S_OK == (hr = WcaReadStringFromCaData(&pwz, &pwzGroup)))
+        {
+            hr = WcaReadStringFromCaData(&pwz, &pwzGroupDomain);
+
+            if (FAILED(hr))
+            {
+                WcaLogError(hr, "failed to get domain for group: %ls, continuing anyway.", pwzGroup);
+            }
+            else
+            {
+                hr = RemoveUserFromGroup(wzName, wzDomain, pwzGroup, pwzGroupDomain);
+                if (FAILED(hr))
+                {
+                    WcaLogError(hr, "failed to remove user: %ls from group %ls, continuing anyway.", wzName, pwzGroup);
+                }
+            }
+        }
+
+        if (E_NOMOREITEMS == hr) // if there are no more items, all is well
+        {
+            hr = S_OK;
+        }
+
+        ExitOnFailure(hr, "failed to get next group from which to remove user:%ls", wzName);
+    }
+
+LExit:
+    if (pDomainControllerInfo)
+    {
+        ::NetApiBufferFree(static_cast<LPVOID>(pDomainControllerInfo));
+    }
+
+    return hr;
+}
+
+
+/********************************************************************
+ CreateUser - CUSTOM ACTION ENTRY POINT for creating users
+
+  Input:  deferred CustomActionData - UserName\tDomain\tPassword\tAttributes\tGroupName\tDomain\tGroupName\tDomain...
+ * *****************************************************************/
+extern "C" UINT __stdcall CreateUser(
+    __in MSIHANDLE hInstall
+    )
+{
+    //AssertSz(0, "Debug CreateUser");
+
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    LPWSTR pwzData = NULL;
+    LPWSTR pwz = NULL;
+    LPWSTR pwzName = NULL;
+    LPWSTR pwzDomain = NULL;
+    LPWSTR pwzScriptKey = NULL;
+    LPWSTR pwzPassword = NULL;
+    LPWSTR pwzGroup = NULL;
+    LPWSTR pwzGroupDomain = NULL;
+    PDOMAIN_CONTROLLER_INFOW pDomainControllerInfo = NULL;
+    int iAttributes = 0;
+    BOOL fInitializedCom = FALSE;
+
+    WCA_CASCRIPT_HANDLE hRollbackScript = NULL;
+    int iOriginalAttributes = 0;
+    int iRollbackAttributes = 0;
+
+    USER_INFO_1 userInfo;
+    USER_INFO_1* puserInfo = NULL;
+    DWORD dw;
+    LPCWSTR wz = NULL;
+
+    hr = WcaInitialize(hInstall, "CreateUser");
+    ExitOnFailure(hr, "failed to initialize");
+
+    hr = ::CoInitialize(NULL);
+    ExitOnFailure(hr, "failed to initialize COM");
+    fInitializedCom = TRUE;
+
+    hr = WcaGetProperty( L"CustomActionData", &pwzData);
+    ExitOnFailure(hr, "failed to get CustomActionData");
+
+    WcaLog(LOGMSG_TRACEONLY, "CustomActionData: %ls", pwzData);
+
+    //
+    // Read in the CustomActionData
+    //
+    pwz = pwzData;
+    hr = WcaReadStringFromCaData(&pwz, &pwzName);
+    ExitOnFailure(hr, "failed to read user name from custom action data");
+
+    hr = WcaReadStringFromCaData(&pwz, &pwzDomain);
+    ExitOnFailure(hr, "failed to read domain from custom action data");
+
+    hr = WcaReadIntegerFromCaData(&pwz, &iAttributes);
+    ExitOnFailure(hr, "failed to read attributes from custom action data");
+
+    hr = WcaReadStringFromCaData(&pwz, &pwzScriptKey);
+    ExitOnFailure(hr, "failed to read encoding key from custom action data");
+
+    hr = WcaReadStringFromCaData(&pwz, &pwzPassword);
+    ExitOnFailure(hr, "failed to read password from custom action data");
+
+    // There is no rollback scheduled if the key is empty.
+    // Best effort to get original configuration and save it in the script so rollback can restore it.
+    if (*pwzScriptKey)
+    {
+        hr = WcaCaScriptCreate(WCA_ACTION_INSTALL, WCA_CASCRIPT_ROLLBACK, FALSE, pwzScriptKey, FALSE, &hRollbackScript);
+        ExitOnFailure(hr, "Failed to open rollback CustomAction script.");
+
+        iRollbackAttributes = 0;
+        hr = GetExistingUserRightsAssignments(pwzDomain, pwzName, &iOriginalAttributes);
+        if (FAILED(hr))
+        {
+            WcaLogError(hr, "failed to get existing user rights: %ls, continuing anyway.", pwzName);
+        }
+        else
+        {
+            if (!(SCAU_ALLOW_LOGON_AS_SERVICE & iOriginalAttributes) && (SCAU_ALLOW_LOGON_AS_SERVICE & iAttributes))
+            {
+                iRollbackAttributes |= SCAU_ALLOW_LOGON_AS_SERVICE;
+            }
+            if (!(SCAU_ALLOW_LOGON_AS_BATCH & iOriginalAttributes) && (SCAU_ALLOW_LOGON_AS_BATCH & iAttributes))
+            {
+                iRollbackAttributes |= SCAU_ALLOW_LOGON_AS_BATCH;
+            }
+        }
+
+        hr = WcaCaScriptWriteNumber(hRollbackScript, iRollbackAttributes);
+        ExitOnFailure(hr, "Failed to add data to rollback script.");
+
+        // Nudge the system to get all our rollback data written to disk.
+        WcaCaScriptFlush(hRollbackScript);
+    }
+
+    if (!(SCAU_DONT_CREATE_USER & iAttributes))
+    {
+        ::ZeroMemory(&userInfo, sizeof(USER_INFO_1));
+        userInfo.usri1_name = pwzName;
+        userInfo.usri1_priv = USER_PRIV_USER;
+        userInfo.usri1_flags = UF_SCRIPT;
+        userInfo.usri1_home_dir = NULL;
+        userInfo.usri1_comment = NULL;
+        userInfo.usri1_script_path = NULL;
+
+        SetUserPasswordAndAttributes(&userInfo, pwzPassword, iAttributes);
+
+        //
+        // Create the User
+        //
+        if (pwzDomain && *pwzDomain)
+        {
+            er = ::DsGetDcNameW( NULL, (LPCWSTR)pwzDomain, NULL, NULL, NULL, &pDomainControllerInfo );
+            if (RPC_S_SERVER_UNAVAILABLE == er)
+            {
+                // MSDN says, if we get the above error code, try again with the "DS_FORCE_REDISCOVERY" flag
+                er = ::DsGetDcNameW( NULL, (LPCWSTR)pwzDomain, NULL, NULL, DS_FORCE_REDISCOVERY, &pDomainControllerInfo );
+            }
+            if (ERROR_SUCCESS == er)
+            {
+                wz = pDomainControllerInfo->DomainControllerName + 2;  //Add 2 so that we don't get the \\ prefix
+            }
+            else
+            {
+                wz = pwzDomain;
+            }
+        }
+
+        er = ::NetUserAdd(wz, 1, reinterpret_cast<LPBYTE>(&userInfo), &dw);
+        if (NERR_UserExists == er)
+        {
+            if (SCAU_UPDATE_IF_EXISTS & iAttributes)
+            {
+                er = ::NetUserGetInfo(wz, pwzName, 1, reinterpret_cast<LPBYTE*>(&puserInfo));
+                if (NERR_Success == er)
+                {
+                    // Change the existing user's password and attributes again then try
+                    // to update user with this new data
+                    SetUserPasswordAndAttributes(puserInfo, pwzPassword, iAttributes);
+
+                    er = ::NetUserSetInfo(wz, pwzName, 1, reinterpret_cast<LPBYTE>(puserInfo), &dw);
+                }
+            }
+            else if (!(SCAU_FAIL_IF_EXISTS & iAttributes))
+            {
+                er = NERR_Success;
+            }
+        }
+        else if (NERR_PasswordTooShort == er || NERR_PasswordTooLong == er)
+        {
+            MessageExitOnFailure(hr = HRESULT_FROM_WIN32(er), msierrUSRFailedUserCreatePswd, "failed to create user: %ls due to invalid password.", pwzName);
+        }
+        MessageExitOnFailure(hr = HRESULT_FROM_WIN32(er), msierrUSRFailedUserCreate, "failed to create user: %ls", pwzName);
+    }
+
+    if (SCAU_ALLOW_LOGON_AS_SERVICE & iAttributes)
+    {
+        hr = ModifyUserLocalServiceRight(pwzDomain, pwzName, TRUE);
+        MessageExitOnFailure(hr, msierrUSRFailedGrantLogonAsService, "Failed to grant logon as service rights to user: %ls", pwzName);
+    }
+
+    if (SCAU_ALLOW_LOGON_AS_BATCH & iAttributes)
+    {
+        hr = ModifyUserLocalBatchRight(pwzDomain, pwzName, TRUE);
+        MessageExitOnFailure(hr, msierrUSRFailedGrantLogonAsService, "Failed to grant logon as batch job rights to user: %ls", pwzName);
+    }
+
+    //
+    // Add the users to groups
+    //
+    while (S_OK == (hr = WcaReadStringFromCaData(&pwz, &pwzGroup)))
+    {
+        hr = WcaReadStringFromCaData(&pwz, &pwzGroupDomain);
+        ExitOnFailure(hr, "failed to get domain for group: %ls", pwzGroup);
+
+        hr = AddUserToGroup(pwzName, pwzDomain, pwzGroup, pwzGroupDomain);
+        MessageExitOnFailure(hr, msierrUSRFailedUserGroupAdd, "failed to add user: %ls to group %ls", pwzName, pwzGroup);
+    }
+    if (E_NOMOREITEMS == hr) // if there are no more items, all is well
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "failed to get next group in which to include user:%ls", pwzName);
+
+LExit:
+    WcaCaScriptClose(hRollbackScript, WCA_CASCRIPT_CLOSE_PRESERVE);
+
+    if (puserInfo)
+    {
+        ::NetApiBufferFree((LPVOID)puserInfo);
+    }
+
+    if (pDomainControllerInfo)
+    {
+        ::NetApiBufferFree((LPVOID)pDomainControllerInfo);
+    }
+
+    ReleaseStr(pwzData);
+    ReleaseStr(pwzName);
+    ReleaseStr(pwzDomain);
+    ReleaseStr(pwzScriptKey);
+    ReleaseStr(pwzPassword);
+    ReleaseStr(pwzGroup);
+    ReleaseStr(pwzGroupDomain);
+
+    if (fInitializedCom)
+    {
+        ::CoUninitialize();
+    }
+
+    if (SCAU_NON_VITAL & iAttributes)
+    {
+        er = ERROR_SUCCESS;
+    }
+    else if (FAILED(hr))
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+
+    return WcaFinalize(er);
+}
+
+
+/********************************************************************
+ CreateUserRollback - CUSTOM ACTION ENTRY POINT for CreateUser rollback
+
+ * *****************************************************************/
+extern "C" UINT __stdcall CreateUserRollback(
+    MSIHANDLE hInstall
+)
+{
+    //AssertSz(0, "Debug CreateUserRollback");
+
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    LPWSTR pwzData = NULL;
+    LPWSTR pwz = NULL;
+    LPWSTR pwzName = NULL;
+    LPWSTR pwzDomain = NULL;
+    LPWSTR pwzScriptKey = NULL;
+    int iAttributes = 0;
+    BOOL fInitializedCom = FALSE;
+
+    WCA_CASCRIPT_HANDLE hRollbackScript = NULL;
+    LPWSTR pwzRollbackData = NULL;
+    int iOriginalAttributes = 0;
+
+    hr = WcaInitialize(hInstall, "CreateUserRollback");
+    ExitOnFailure(hr, "failed to initialize");
+
+    hr = ::CoInitialize(NULL);
+    ExitOnFailure(hr, "failed to initialize COM");
+    fInitializedCom = TRUE;
+
+    hr = WcaGetProperty(L"CustomActionData", &pwzData);
+    ExitOnFailure(hr, "failed to get CustomActionData");
+
+    WcaLog(LOGMSG_TRACEONLY, "CustomActionData: %ls", pwzData);
+
+    //
+    // Read in the CustomActionData
+    //
+    pwz = pwzData;
+    hr = WcaReadStringFromCaData(&pwz, &pwzScriptKey);
+    ExitOnFailure(hr, "failed to read encoding key from custom action data");
+
+    hr = WcaReadStringFromCaData(&pwz, &pwzName);
+    ExitOnFailure(hr, "failed to read name from custom action data");
+
+    hr = WcaReadStringFromCaData(&pwz, &pwzDomain);
+    ExitOnFailure(hr, "failed to read domain from custom action data");
+
+    hr = WcaReadIntegerFromCaData(&pwz, &iAttributes);
+    ExitOnFailure(hr, "failed to read attributes from custom action data");
+
+    // Best effort to read original configuration from CreateUser.
+    hr = WcaCaScriptOpen(WCA_ACTION_INSTALL, WCA_CASCRIPT_ROLLBACK, FALSE, pwzScriptKey, &hRollbackScript);
+    if (FAILED(hr))
+    {
+        WcaLogError(hr, "Failed to open rollback CustomAction script, continuing anyway.");
+    }
+    else
+    {
+        hr = WcaCaScriptReadAsCustomActionData(hRollbackScript, &pwzRollbackData);
+        if (FAILED(hr))
+        {
+            WcaLogError(hr, "Failed to read rollback script into CustomAction data, continuing anyway.");
+        }
+        else
+        {
+            WcaLog(LOGMSG_TRACEONLY, "Rollback Data: %ls", pwzRollbackData);
+
+            pwz = pwzRollbackData;
+            hr = WcaReadIntegerFromCaData(&pwz, &iOriginalAttributes);
+            if (FAILED(hr))
+            {
+                WcaLogError(hr, "failed to read attributes from rollback data, continuing anyway");
+            }
+            else
+            {
+                iAttributes |= iOriginalAttributes;
+            }
+        }
+    }
+
+    hr = RemoveUserInternal(pwz, pwzDomain, pwzName, iAttributes);
+
+LExit:
+    WcaCaScriptClose(hRollbackScript, WCA_CASCRIPT_CLOSE_DELETE);
+
+    ReleaseStr(pwzData);
+    ReleaseStr(pwzName);
+    ReleaseStr(pwzDomain);
+    ReleaseStr(pwzScriptKey);
+    ReleaseStr(pwzRollbackData);
+
+    if (fInitializedCom)
+    {
+        ::CoUninitialize();
+    }
+
+    if (FAILED(hr))
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+
+    return WcaFinalize(er);
+}
+
+
+/********************************************************************
+ RemoveUser - CUSTOM ACTION ENTRY POINT for removing users
+
+  Input:  deferred CustomActionData - Name\tDomain
+ * *****************************************************************/
+extern "C" UINT __stdcall RemoveUser(
+    MSIHANDLE hInstall
+)
+{
+    //AssertSz(0, "Debug RemoveUser");
+
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    LPWSTR pwzData = NULL;
+    LPWSTR pwz = NULL;
+    LPWSTR pwzName = NULL;
+    LPWSTR pwzDomain = NULL;
+    int iAttributes = 0;
+    BOOL fInitializedCom = FALSE;
+
+    hr = WcaInitialize(hInstall, "RemoveUser");
+    ExitOnFailure(hr, "failed to initialize");
+
+    hr = ::CoInitialize(NULL);
+    ExitOnFailure(hr, "failed to initialize COM");
+    fInitializedCom = TRUE;
+
+    hr = WcaGetProperty(L"CustomActionData", &pwzData);
+    ExitOnFailure(hr, "failed to get CustomActionData");
+
+    WcaLog(LOGMSG_TRACEONLY, "CustomActionData: %ls", pwzData);
+
+    //
+    // Read in the CustomActionData
+    //
+    pwz = pwzData;
+    hr = WcaReadStringFromCaData(&pwz, &pwzName);
+    ExitOnFailure(hr, "failed to read name from custom action data");
+
+    hr = WcaReadStringFromCaData(&pwz, &pwzDomain);
+    ExitOnFailure(hr, "failed to read domain from custom action data");
+
+    hr = WcaReadIntegerFromCaData(&pwz, &iAttributes);
+    ExitOnFailure(hr, "failed to read attributes from custom action data");
+
+    hr = RemoveUserInternal(pwz, pwzDomain, pwzName, iAttributes);
+
+LExit:
+    ReleaseStr(pwzData);
+    ReleaseStr(pwzName);
+    ReleaseStr(pwzDomain);
+
+    if (fInitializedCom)
+    {
+        ::CoUninitialize();
+    }
+
+    if (FAILED(hr))
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+
+    return WcaFinalize(er);
+}
diff --git a/src/ext/Util/ca/scamanifest.cpp b/src/ext/Util/ca/scamanifest.cpp
new file mode 100644
index 00000000..adb8d3d3
--- /dev/null
+++ b/src/ext/Util/ca/scamanifest.cpp
@@ -0,0 +1,377 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+LPCWSTR vcsPerfmonManifestQuery = L"SELECT `Component_`, `File`, `ResourceFileDirectory` FROM `Wix4PerfmonManifest`";
+LPCWSTR vcsEventManifestQuery = L"SELECT `Component_`, `File` FROM `Wix4EventManifest`";
+enum ePerfMonManifestQuery { pfmComponent = 1, pfmFile, pfmResourceFileDir };
+enum eEventManifestQuery { emComponent = 1, emFile};
+
+BOOL IsVistaOrAbove()
+{
+    OSVERSIONINFO osvi;
+    ZeroMemory(&osvi, sizeof(OSVERSIONINFO));
+    osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
+    #pragma warning(suppress: 4996) //TODO: use non-deprecated function to check OS version
+    if (!::GetVersionEx(&osvi))
+    {
+        return false;
+    }
+    return osvi.dwMajorVersion >= 6;
+}
+
+
+/********************************************************************
+ ConfigurePerfmonManifestRegister - CUSTOM ACTION ENTRY POINT for scheduling
+ Perfmon counter manifest registering
+ 
+********************************************************************/
+extern "C" UINT __stdcall ConfigurePerfmonManifestRegister(
+    __in MSIHANDLE hInstall
+    )
+{
+    HRESULT hr;
+    UINT er = ERROR_SUCCESS;
+
+    PMSIHANDLE hView, hRec;
+    LPWSTR pwzData = NULL, pwzResourceFilePath = NULL, pwzFile = NULL, pwzCommand = NULL;
+    INSTALLSTATE isInstalled, isAction;
+
+    hr = WcaInitialize(hInstall, "ConfigurePerfmonManifestReg");
+    ExitOnFailure(hr, "Failed to initialize");
+
+    if (!IsVistaOrAbove())
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping ConfigurePerfmonManifestRegister() because the target system does not support perfmon manifest");
+        ExitFunction1(hr = S_FALSE);
+    }
+    // check to see if necessary tables are specified
+    if (S_OK != WcaTableExists(L"Wix4PerfmonManifest"))
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping ConfigurePerfmonManifestRegister() because Wix4PerfmonManifest table not present");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    hr = WcaOpenExecuteView(vcsPerfmonManifestQuery, &hView);
+    ExitOnFailure(hr, "failed to open view on PerfMonManifest table");
+    while ((hr = WcaFetchRecord(hView, &hRec)) == S_OK)
+    {
+        // get component install state
+        hr = WcaGetRecordString(hRec, pfmComponent, &pwzData);
+        ExitOnFailure(hr, "failed to get Component for PerfMonManifest");
+        er = ::MsiGetComponentStateW(hInstall, pwzData, &isInstalled, &isAction);
+        hr = HRESULT_FROM_WIN32(er);
+        ExitOnFailure(hr, "failed to get Component state for PerfMonManifest");
+        if (!WcaIsInstalling(isInstalled, isAction))
+        {
+            continue;
+        }
+
+        hr = WcaGetRecordFormattedString(hRec, pfmFile, &pwzFile);
+        ExitOnFailure(hr, "failed to get File for PerfMonManifest");
+
+        hr = WcaGetRecordFormattedString(hRec, pfmResourceFileDir, &pwzResourceFilePath);
+        ExitOnFailure(hr, "failed to get ApplicationIdentity for PerfMonManifest");
+        size_t iResourcePath = lstrlenW(pwzResourceFilePath);
+        if ( iResourcePath > 0 && *(pwzResourceFilePath + iResourcePath -1) == L'\\') 
+            *(pwzResourceFilePath + iResourcePath -1) = 0;  //remove the trailing '\'
+
+        hr = StrAllocFormatted(&pwzCommand, L"\"unlodctr.exe\" /m:\"%s\"", pwzFile);
+        ExitOnFailure(hr, "failed to copy string in PerfMonManifest");
+
+        hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"RollbackRegisterPerfmonManifest"), pwzCommand, COST_PERFMONMANIFEST_UNREGISTER);
+        ExitOnFailure(hr, "failed to schedule RollbackRegisterPerfmonManifest action");
+
+        if ( *pwzResourceFilePath )
+        {
+            hr = StrAllocFormatted(&pwzCommand, L"\"lodctr.exe\" /m:\"%s\" \"%s\"", pwzFile, pwzResourceFilePath);
+            ExitOnFailure(hr, "failed to copy string in PerfMonManifest");
+        }
+        else
+        {
+            hr = StrAllocFormatted(&pwzCommand, L"\"lodctr.exe\" /m:\"%s\"", pwzFile);
+            ExitOnFailure(hr, "failed to copy string in PerfMonManifest");
+        }
+        
+        WcaLog(LOGMSG_VERBOSE, "RegisterPerfmonManifest's CustomActionData: '%ls'", pwzCommand);
+        
+        hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"RegisterPerfmonManifest"), pwzCommand, COST_PERFMONMANIFEST_REGISTER);
+        ExitOnFailure(hr, "failed to schedule RegisterPerfmonManifest action");
+    }
+
+    if (hr == E_NOMOREITEMS)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "Failure while processing PerfMonManifest");
+
+    hr = S_OK;
+
+LExit:
+    ReleaseStr(pwzData);
+    ReleaseStr(pwzResourceFilePath);
+    ReleaseStr(pwzFile);
+    ReleaseStr(pwzCommand);
+
+    er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+
+/********************************************************************
+ ConfigurePerfmonUninstall - CUSTOM ACTION ENTRY POINT for uninstalling 
+                             Perfmon counters
+
+********************************************************************/
+extern "C" UINT __stdcall ConfigurePerfmonManifestUnregister(
+    __in MSIHANDLE hInstall
+    )
+{
+    HRESULT hr;
+    UINT er = ERROR_SUCCESS;
+
+    PMSIHANDLE hView, hRec;
+    LPWSTR pwzData = NULL, pwzResourceFilePath = NULL, pwzFile = NULL, pwzCommand = NULL;
+    INSTALLSTATE isInstalled, isAction;
+
+    hr = WcaInitialize(hInstall, "ConfigurePerfmonManifestUnreg");
+    ExitOnFailure(hr, "Failed to initialize");
+
+    if (!IsVistaOrAbove())
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping ConfigurePerfmonManifestUnregister() because the target system does not support perfmon manifest");
+        ExitFunction1(hr = S_FALSE);
+    }
+    // check to see if necessary tables are specified
+    if (WcaTableExists(L"Wix4PerfmonManifest") != S_OK)
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping ConfigurePerfmonManifestUnregister() because Wix4PerfmonManifest table not present");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    hr = WcaOpenExecuteView(vcsPerfmonManifestQuery, &hView);
+    ExitOnFailure(hr, "failed to open view on Wix4PerfmonManifest table");
+    while ((hr = WcaFetchRecord(hView, &hRec)) == S_OK)
+    {
+        // get component install state
+        hr = WcaGetRecordString(hRec, pfmComponent, &pwzData);
+        ExitOnFailure(hr, "failed to get Component for Wix4PerfmonManifest");
+        er = ::MsiGetComponentStateW(hInstall, pwzData, &isInstalled, &isAction);
+        hr = HRESULT_FROM_WIN32(er);
+        ExitOnFailure(hr, "failed to get Component state for Wix4PerfmonManifest");
+        if (!WcaIsUninstalling(isInstalled, isAction))
+        {
+            continue;
+        }
+
+        hr = WcaGetRecordFormattedString(hRec, pfmFile, &pwzFile);
+        ExitOnFailure(hr, "failed to get File for Wix4PerfmonManifest");
+
+        hr = WcaGetRecordFormattedString(hRec, pfmResourceFileDir, &pwzResourceFilePath);
+        ExitOnFailure(hr, "failed to get ApplicationIdentity for Wix4PerfmonManifest");
+        size_t iResourcePath = lstrlenW(pwzResourceFilePath);
+        if ( iResourcePath > 0 && *(pwzResourceFilePath + iResourcePath -1) == L'\\') 
+            *(pwzResourceFilePath + iResourcePath -1) = 0;  //remove the trailing '\'
+
+        hr = StrAllocFormatted(&pwzCommand, L"\"lodctr.exe\" /m:\"%s\" \"%s\"", pwzFile, pwzResourceFilePath);
+        ExitOnFailure(hr, "failed to copy string in Wix4PerfmonManifest");
+
+        hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"RollbackUnregisterPerfmonManifest"), pwzCommand, COST_PERFMONMANIFEST_REGISTER);
+        ExitOnFailure(hr, "failed to schedule RollbackUnregisterPerfmonManifest action");
+
+        hr = StrAllocFormatted(&pwzCommand, L"\"unlodctr.exe\" /m:\"%s\"", pwzFile);
+        ExitOnFailure(hr, "failed to copy string in PerfMonManifest");
+
+        WcaLog(LOGMSG_VERBOSE, "UnRegisterPerfmonManifest's CustomActionData: '%ls'", pwzCommand);
+        
+        hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"UnregisterPerfmonManifest"), pwzCommand, COST_PERFMONMANIFEST_UNREGISTER);
+        ExitOnFailure(hr, "failed to schedule UnregisterPerfmonManifest action");
+    }
+
+    if (hr == E_NOMOREITEMS)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "Failure while processing PerfMonManifest");
+
+    hr = S_OK;
+
+LExit:
+    ReleaseStr(pwzData);
+    ReleaseStr(pwzResourceFilePath);
+    ReleaseStr(pwzFile);
+    ReleaseStr(pwzCommand);
+    
+    er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+/********************************************************************
+ ConfigureEventManifestRegister - CUSTOM ACTION ENTRY POINT for scheduling
+ Event manifest registering
+ 
+********************************************************************/
+extern "C" UINT __stdcall ConfigureEventManifestRegister(
+    __in MSIHANDLE hInstall
+    )
+{
+    HRESULT hr;
+    UINT er = ERROR_SUCCESS;
+
+    PMSIHANDLE hView, hRec;
+    LPWSTR pwzData = NULL, pwzFile = NULL, pwzCommand = NULL;
+    INSTALLSTATE isInstalled, isAction;
+
+    hr = WcaInitialize(hInstall, "ConfigureEventManifestReg");
+    ExitOnFailure(hr, "Failed to initialize");
+    
+    if (!IsVistaOrAbove())
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping ConfigureEventManifestRegister() because the target system does not support event manifest");
+        ExitFunction1(hr = S_FALSE);
+    }
+    // check to see if necessary tables are specified
+    if (S_OK != WcaTableExists(L"Wix4EventManifest"))
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping ConfigureEventManifestRegister() because Wix4EventManifest table not present");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    hr = WcaOpenExecuteView(vcsEventManifestQuery, &hView);
+    ExitOnFailure(hr, "failed to open view on Wix4EventManifest table");
+    while ((hr = WcaFetchRecord(hView, &hRec)) == S_OK)
+    {
+        // get component install state
+        hr = WcaGetRecordString(hRec, emComponent, &pwzData);
+        ExitOnFailure(hr, "failed to get Component for Wix4EventManifest");
+        er = ::MsiGetComponentStateW(hInstall, pwzData, &isInstalled, &isAction);
+        hr = HRESULT_FROM_WIN32(er);
+        ExitOnFailure(hr, "failed to get Component state for Wix4EventManifest");
+        if (!WcaIsInstalling(isInstalled, isAction))
+        {
+            continue;
+        }
+
+        hr = WcaGetRecordFormattedString(hRec, emFile, &pwzFile);
+        ExitOnFailure(hr, "failed to get File for Wix4EventManifest");
+
+        hr = StrAllocFormatted(&pwzCommand, L"\"wevtutil.exe\" um \"%s\"", pwzFile);
+        ExitOnFailure(hr, "failed to copy string in Wix4EventManifest");
+
+        hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"RollbackRegisterEventManifest"), pwzCommand, COST_PERFMONMANIFEST_UNREGISTER);
+        ExitOnFailure(hr, "failed to schedule RollbackRegisterEventManifest action");
+
+        hr = StrAllocFormatted(&pwzCommand, L"\"wevtutil.exe\" im \"%s\"", pwzFile);
+        ExitOnFailure(hr, "failed to copy string in Wix4EventManifest");
+        WcaLog(LOGMSG_VERBOSE, "RegisterEventManifest's CustomActionData: '%ls'", pwzCommand);
+        
+        hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"RegisterEventManifest"), pwzCommand, COST_EVENTMANIFEST_REGISTER);
+        ExitOnFailure(hr, "failed to schedule RegisterEventManifest action");
+    }
+
+    if (hr == E_NOMOREITEMS)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "Failure while processing Wix4EventManifest");
+
+    hr = S_OK;
+
+LExit:
+    ReleaseStr(pwzData);
+    ReleaseStr(pwzFile);
+    ReleaseStr(pwzCommand);
+    
+    er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+
+
+/********************************************************************
+ ConfigureEventManifestRegister - CUSTOM ACTION ENTRY POINT for scheduling
+ Event manifest registering
+ 
+********************************************************************/
+extern "C" UINT __stdcall ConfigureEventManifestUnregister(
+    __in MSIHANDLE hInstall
+    )
+{
+    HRESULT hr;
+    UINT er = ERROR_SUCCESS;
+
+    PMSIHANDLE hView, hRec;
+    LPWSTR pwzData = NULL, pwzFile = NULL, pwzCommand = NULL;
+    INSTALLSTATE isInstalled, isAction;
+
+    hr = WcaInitialize(hInstall, "ConfigureEventManifestUnreg");
+    ExitOnFailure(hr, "Failed to initialize");
+    
+    if (!IsVistaOrAbove())
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping ConfigureEventManifestUnregister() because the target system does not support event manifest");
+        ExitFunction1(hr = S_FALSE);
+    }
+    // check to see if necessary tables are specified
+    if (S_OK != WcaTableExists(L"Wix4EventManifest"))
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping ConfigureEventManifestUnregister() because Wix4EventManifest table not present");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    hr = WcaOpenExecuteView(vcsEventManifestQuery, &hView);
+    ExitOnFailure(hr, "failed to open view on Wix4EventManifest table");
+    while ((hr = WcaFetchRecord(hView, &hRec)) == S_OK)
+    {
+        // get component install state
+        hr = WcaGetRecordString(hRec, emComponent, &pwzData);
+        ExitOnFailure(hr, "failed to get Component for Wix4EventManifest");
+        er = ::MsiGetComponentStateW(hInstall, pwzData, &isInstalled, &isAction);
+        hr = HRESULT_FROM_WIN32(er);
+        ExitOnFailure(hr, "failed to get Component state for Wix4EventManifest");
+
+        // nothing to do on an install
+        // schedule the rollback action when reinstalling to re-register pre-patch manifest
+        if (!WcaIsUninstalling(isInstalled, isAction) && !WcaIsReInstalling(isInstalled, isAction))
+        {
+            continue;
+        }
+
+        hr = WcaGetRecordFormattedString(hRec, emFile, &pwzFile);
+        ExitOnFailure(hr, "failed to get File for Wix4EventManifest");
+
+        hr = StrAllocFormatted(&pwzCommand, L"\"wevtutil.exe\" im \"%s\"", pwzFile);
+        ExitOnFailure(hr, "failed to copy string in Wix4EventManifest");
+
+        hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"RollbackUnregisterEventManifest"), pwzCommand, COST_PERFMONMANIFEST_REGISTER);
+        ExitOnFailure(hr, "failed to schedule RollbackUnregisterEventManifest action");
+
+        // no need to uninstall on a repair/patch.  Register action will re-register and update the manifest.
+        if (!WcaIsReInstalling(isInstalled, isAction))
+        {
+            hr = StrAllocFormatted(&pwzCommand, L"\"wevtutil.exe\" um \"%s\"", pwzFile);
+            ExitOnFailure(hr, "failed to copy string in Wix4EventManifest");
+            WcaLog(LOGMSG_VERBOSE, "UnregisterEventManifest's CustomActionData: '%ls'", pwzCommand);
+            
+            hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"UnregisterEventManifest"), pwzCommand, COST_PERFMONMANIFEST_UNREGISTER);
+            ExitOnFailure(hr, "failed to schedule UnregisterEventManifest action");
+        }
+    }
+
+    if (hr == E_NOMOREITEMS)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "Failure while processing Wix4EventManifest");
+
+    hr = S_OK;
+
+LExit:
+    ReleaseStr(pwzData);
+    ReleaseStr(pwzFile);
+    ReleaseStr(pwzCommand);
+
+    er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
diff --git a/src/ext/Util/ca/scaperf.cpp b/src/ext/Util/ca/scaperf.cpp
new file mode 100644
index 00000000..fd301278
--- /dev/null
+++ b/src/ext/Util/ca/scaperf.cpp
@@ -0,0 +1,310 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+LPCWSTR vcsPerfCounterDataQuery = L"SELECT `Wix4PerformanceCategory`, `Component_`, `Name`, `IniData`, `ConstantData` FROM `Wix4PerformanceCategory`";
+enum ePerfCounterDataQuery { pcdqId = 1, pcdqComponent, pcdqName, pcdqIniData, pcdqConstantData };
+
+LPCWSTR vcsPerfMonQuery = L"SELECT `Component_`, `File`, `Name` FROM `Wix4Perfmon`";
+enum ePerfMonQuery { pmqComponent = 1, pmqFile, pmqName };
+
+
+static HRESULT ProcessPerformanceCategory(
+    __in MSIHANDLE hInstall,
+    __in BOOL fInstall
+    );
+
+
+/********************************************************************
+ InstallPerfCounterData - CUSTOM ACTION ENTRY POINT for installing
+                          Performance Counters.
+
+********************************************************************/
+extern "C" UINT __stdcall InstallPerfCounterData(
+    __in MSIHANDLE hInstall
+    )
+{
+    // AssertSz(FALSE, "debug InstallPerfCounterData{}");
+    HRESULT hr;
+    UINT er = ERROR_SUCCESS;
+
+    hr = WcaInitialize(hInstall, "InstallPerfCounterData");
+    ExitOnFailure(hr, "Failed to initialize InstallPerfCounterData.");
+
+    hr = ProcessPerformanceCategory(hInstall, TRUE);
+    MessageExitOnFailure(hr, msierrInstallPerfCounterData, "Failed to process Wix4PerformanceCategory table.");
+
+LExit:
+    er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+
+/********************************************************************
+ UninstallPerfCounterData - CUSTOM ACTION ENTRY POINT for installing
+                          Performance Counters.
+
+********************************************************************/
+extern "C" UINT __stdcall UninstallPerfCounterData(
+    __in MSIHANDLE hInstall
+    )
+{
+    // AssertSz(FALSE, "debug UninstallPerfCounterData{}");
+    HRESULT hr;
+    UINT er = ERROR_SUCCESS;
+
+    hr = WcaInitialize(hInstall, "UninstallPerfCounterData");
+    ExitOnFailure(hr, "Failed to initialize UninstallPerfCounterData.");
+
+    hr = ProcessPerformanceCategory(hInstall, FALSE);
+    MessageExitOnFailure(hr, msierrUninstallPerfCounterData, "Failed to process Wix4PerformanceCategory table.");
+
+LExit:
+    er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+
+/********************************************************************
+ RegisterPerfmon - CUSTOM ACTION ENTRY POINT for installing Perfmon counters
+
+********************************************************************/
+extern "C" UINT __stdcall ConfigurePerfmonInstall(
+    __in MSIHANDLE hInstall
+    )
+{
+//    Assert(FALSE);
+    HRESULT hr;
+    UINT er = ERROR_SUCCESS;
+
+    PMSIHANDLE hView, hRec;
+    LPWSTR pwzData = NULL, pwzName = NULL, pwzFile = NULL;
+    INSTALLSTATE isInstalled, isAction;
+
+    hr = WcaInitialize(hInstall, "ConfigurePerfmonInstall");
+    ExitOnFailure(hr, "Failed to initialize");
+
+    // check to see if necessary tables are specified
+    if (S_OK != WcaTableExists(L"Wix4Perfmon"))
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping RegisterPerfmon() because Wix4Perfmon table not present");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    hr = WcaOpenExecuteView(vcsPerfMonQuery, &hView);
+    ExitOnFailure(hr, "failed to open view on PerfMon table");
+    while ((hr = WcaFetchRecord(hView, &hRec)) == S_OK)
+    {
+        // get component install state
+        hr = WcaGetRecordString(hRec, pmqComponent, &pwzData);
+        ExitOnFailure(hr, "failed to get Component for PerfMon");
+        er = ::MsiGetComponentStateW(hInstall, pwzData, &isInstalled, &isAction);
+        hr = HRESULT_FROM_WIN32(er);
+        ExitOnFailure(hr, "failed to get Component state for PerfMon");
+        if (!WcaIsInstalling(isInstalled, isAction))
+        {
+            continue;
+        }
+
+        hr = WcaGetRecordString(hRec, pmqName, &pwzName);
+        ExitOnFailure(hr, "failed to get Name for PerfMon");
+
+        hr = WcaGetRecordFormattedString(hRec, pmqFile, &pwzFile);
+        ExitOnFailure(hr, "failed to get File for PerfMon");
+
+        WcaLog(LOGMSG_VERBOSE, "ConfigurePerfmonInstall's CustomActionData: '%ls', '%ls'", pwzName, pwzFile);
+        hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"RegisterPerfmon"), pwzFile, COST_PERFMON_REGISTER);
+        ExitOnFailure(hr, "failed to schedule RegisterPerfmon action");
+        hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"RollbackRegisterPerfmon"), pwzName, COST_PERFMON_UNREGISTER);
+        ExitOnFailure(hr, "failed to schedule RollbackRegisterPerfmon action");
+    }
+
+    if (hr == E_NOMOREITEMS)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "Failure while processing PerfMon");
+
+    hr = S_OK;
+
+LExit:
+    ReleaseStr(pwzData);
+    ReleaseStr(pwzName);
+    ReleaseStr(pwzFile);
+
+    er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+
+/********************************************************************
+ ConfigurePerfmonUninstall - CUSTOM ACTION ENTRY POINT for uninstalling 
+                             Perfmon counters
+
+********************************************************************/
+extern "C" UINT __stdcall ConfigurePerfmonUninstall(
+    __in MSIHANDLE hInstall
+    )
+{
+//    Assert(FALSE);
+    HRESULT hr;
+    UINT er = ERROR_SUCCESS;
+
+    PMSIHANDLE hView, hRec;
+    LPWSTR pwzData = NULL, pwzName = NULL, pwzFile = NULL;
+    INSTALLSTATE isInstalled, isAction;
+
+    hr = WcaInitialize(hInstall, "ConfigurePerfmonUninstall");
+    ExitOnFailure(hr, "Failed to initialize");
+
+    // check to see if necessary tables are specified
+    if (WcaTableExists(L"Wix4Perfmon") != S_OK)
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping UnregisterPerfmon() because Wix4Perfmon table not present");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    hr = WcaOpenExecuteView(vcsPerfMonQuery, &hView);
+    ExitOnFailure(hr, "failed to open view on PerfMon table");
+    while ((hr = WcaFetchRecord(hView, &hRec)) == S_OK)
+    {
+        // get component install state
+        hr = WcaGetRecordString(hRec, pmqComponent, &pwzData);
+        ExitOnFailure(hr, "failed to get Component for PerfMon");
+        er = ::MsiGetComponentStateW(hInstall, pwzData, &isInstalled, &isAction);
+        hr = HRESULT_FROM_WIN32(er);
+        ExitOnFailure(hr, "failed to get Component state for PerfMon");
+        if (!WcaIsUninstalling(isInstalled, isAction))
+        {
+            continue;
+        }
+
+        hr = WcaGetRecordString(hRec, pmqName, &pwzName);
+        ExitOnFailure(hr, "failed to get Name for PerfMon");
+
+        hr = WcaGetRecordFormattedString(hRec, pmqFile, &pwzFile);
+        ExitOnFailure(hr, "failed to get File for PerfMon");
+
+        WcaLog(LOGMSG_VERBOSE, "ConfigurePerfmonUninstall's CustomActionData: '%ls', '%ls'", pwzName, pwzFile);
+        hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"UnregisterPerfmon"), pwzName, COST_PERFMON_UNREGISTER);
+        ExitOnFailure(hr, "failed to schedule UnregisterPerfmon action");
+        hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"RollbackUnregisterPerfmon"), pwzFile, COST_PERFMON_REGISTER);
+        ExitOnFailure(hr, "failed to schedule RollbackUnregisterPerfmon action");
+    }
+
+    if (hr == E_NOMOREITEMS)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "Failure while processing PerfMon");
+
+    hr = S_OK;
+
+LExit:
+    ReleaseStr(pwzData);
+    ReleaseStr(pwzName);
+    ReleaseStr(pwzFile);
+
+    er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+
+
+static HRESULT ProcessPerformanceCategory(
+    __in MSIHANDLE hInstall,
+    __in BOOL fInstall
+    )
+{
+    HRESULT hr = S_OK;
+    DWORD er = ERROR_SUCCESS;
+
+    PMSIHANDLE hView, hRec;
+    LPWSTR pwzId = NULL;
+    LPWSTR pwzComponent = NULL;
+    LPWSTR pwzName = NULL;
+    LPWSTR pwzData = NULL;
+    INSTALLSTATE isInstalled, isAction;
+
+    LPWSTR pwzCustomActionData = NULL;
+
+    // check to see if necessary tables are specified
+    if (S_OK != WcaTableExists(L"Wix4PerformanceCategory"))
+    {
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    hr = WcaOpenExecuteView(vcsPerfCounterDataQuery, &hView);
+    ExitOnFailure(hr, "failed to open view on Wix4PerformanceCategory table");
+    while (S_OK == (hr = WcaFetchRecord(hView, &hRec)))
+    {
+        hr = WcaGetRecordString(hRec, pcdqId, &pwzId);
+        ExitOnFailure(hr, "Failed to get id for Wix4PerformanceCategory.");
+
+        // Check to see if the Component is being installed or uninstalled
+        // when we are processing the same.
+        hr = WcaGetRecordString(hRec, pcdqComponent, &pwzComponent);
+        ExitOnFailure(hr, "Failed to get Component for Wix4PerformanceCategory: %ls", pwzId);
+
+        er = ::MsiGetComponentStateW(hInstall, pwzComponent, &isInstalled, &isAction);
+        hr = HRESULT_FROM_WIN32(er);
+        ExitOnFailure(hr, "Failed to get Component state for Wix4PerformanceCategory: %ls", pwzId);
+
+        if ((fInstall && !WcaIsInstalling(isInstalled, isAction)) ||
+            (!fInstall && !WcaIsUninstalling(isInstalled, isAction)))
+        {
+            continue;
+        }
+
+        hr = WcaGetRecordString(hRec, pcdqName, &pwzName);
+        ExitOnFailure(hr, "Failed to get Name for Wix4PerformanceCategory: %ls", pwzId);
+        hr = WcaWriteStringToCaData(pwzName, &pwzCustomActionData);
+        ExitOnFailure(hr, "Failed to add Name to CustomActionData for Wix4PerformanceCategory: %ls", pwzId);
+
+        hr = WcaGetRecordString(hRec, pcdqIniData, &pwzData);
+        ExitOnFailure(hr, "Failed to get IniData for Wix4PerformanceCategory: %ls", pwzId);
+        hr = WcaWriteStringToCaData(pwzData, &pwzCustomActionData);
+        ExitOnFailure(hr, "Failed to add IniData to CustomActionData for Wix4PerformanceCategory: %ls", pwzId);
+
+        hr = WcaGetRecordString(hRec, pcdqConstantData, &pwzData);
+        ExitOnFailure(hr, "Failed to get ConstantData for Wix4PerformanceCategory: %ls", pwzId);
+        hr = WcaWriteStringToCaData(pwzData, &pwzCustomActionData);
+        ExitOnFailure(hr, "Failed to add ConstantData to CustomActionData for Wix4PerformanceCategory: %ls", pwzId);
+    }
+
+    if (hr == E_NOMOREITEMS)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "Failure while processing Wix4PerformanceCategory table.");
+
+    // If there was any data built up, schedule it for execution.
+    if (pwzCustomActionData)
+    {
+        if (fInstall)
+        {
+            hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"RollbackRegisterPerfCounterData"), pwzCustomActionData, COST_PERFMON_UNREGISTER);
+            ExitOnFailure(hr, "Failed to schedule RollbackRegisterPerfCounterData action for Wix4PerformanceCategory: %ls", pwzId);
+
+            hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"RegisterPerfCounterData"), pwzCustomActionData, COST_PERFMON_REGISTER);
+            ExitOnFailure(hr, "Failed to schedule RegisterPerfCounterData action for Wix4PerformanceCategory: %ls", pwzId);
+        }
+        else
+        {
+            hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"RollbackUnregisterPerfCounterData"), pwzCustomActionData, COST_PERFMON_REGISTER);
+            ExitOnFailure(hr, "Failed to schedule RollbackUnregisterPerfCounterData action for Wix4PerformanceCategory: %ls", pwzId);
+
+            hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"UnregisterPerfCounterData"), pwzCustomActionData, COST_PERFMON_UNREGISTER);
+            ExitOnFailure(hr, "Failed to schedule UnregisterPerfCounterData action for Wix4PerformanceCategory: %ls", pwzId);
+        }
+    }
+
+LExit:
+    ReleaseStr(pwzCustomActionData);
+    ReleaseStr(pwzData);
+    ReleaseStr(pwzName);
+    ReleaseStr(pwzComponent);
+    ReleaseStr(pwzId);
+
+    return hr;
+}
diff --git a/src/ext/Util/ca/scaperfexec.cpp b/src/ext/Util/ca/scaperfexec.cpp
new file mode 100644
index 00000000..c5425754
--- /dev/null
+++ b/src/ext/Util/ca/scaperfexec.cpp
@@ -0,0 +1,423 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+typedef DWORD (STDAPICALLTYPE *PFNPERFCOUNTERTEXTSTRINGS)(LPWSTR lpCommandLine, BOOL bQuietModeArg);
+
+static HRESULT ExecutePerfCounterData(
+    __in MSIHANDLE hInstall,
+    __in BOOL fInstall
+    );
+static HRESULT CreateDataFile(
+    __in LPCWSTR wzTempFolder,
+    __in LPCWSTR wzData,
+    __in BOOL fIniData,
+    __out HANDLE *phFile,
+    __out_opt LPWSTR *ppwzFile
+    );
+
+
+/********************************************************************
+ RegisterPerfCounterData - CUSTOM ACTION ENTRY POINT for registering
+                           performance counters
+
+ Input: deferred CustomActionData: wzName\twzIniData\twzConstantData\twzName\twzIniData\twzConstantData\t...
+*******************************************************************/
+extern "C" UINT __stdcall RegisterPerfCounterData(
+    __in MSIHANDLE hInstall
+    )
+{
+    // AssertSz(FALSE, "debug RegisterPerfCounterData()");
+    HRESULT hr = S_OK;
+    DWORD er = ERROR_SUCCESS;
+
+    hr = WcaInitialize(hInstall, "RegisterPerfCounterData");
+    ExitOnFailure(hr, "Failed to initialize RegisterPerfCounterData.");
+
+    hr = ExecutePerfCounterData(hInstall, TRUE);
+    MessageExitOnFailure(hr, msierrInstallPerfCounterData, "Failed to execute Wix4PerformanceCategory table.");
+
+LExit:
+    er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+
+/********************************************************************
+ UnregisterPerfCounterData - CUSTOM ACTION ENTRY POINT for registering
+                           performance counters
+
+ Input: deferred CustomActionData: wzName\twzIniData\twzConstantData\twzName\twzIniData\twzConstantData\t...
+*******************************************************************/
+extern "C" UINT __stdcall UnregisterPerfCounterData(
+    __in MSIHANDLE hInstall
+    )
+{
+    // AssertSz(FALSE, "debug UnregisterPerfCounterData()");
+    HRESULT hr = S_OK;
+    DWORD er = ERROR_SUCCESS;
+
+    hr = WcaInitialize(hInstall, "UnregisterPerfCounterData");
+    ExitOnFailure(hr, "Failed to initialize UnregisterPerfCounterData.");
+
+    hr = ExecutePerfCounterData(hInstall, FALSE);
+    MessageExitOnFailure(hr, msierrUninstallPerfCounterData, "Failed to execute Wix4PerformanceCategory table.");
+
+LExit:
+    er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+
+/********************************************************************
+ RegisterPerfmon - CUSTOM ACTION ENTRY POINT for registering
+                   counters
+
+ Input:  deferred CustomActionData - 
+    wzFile or wzName
+*******************************************************************/
+extern "C" UINT __stdcall RegisterPerfmon(
+    __in MSIHANDLE hInstall
+    )
+{
+//    Assert(FALSE);
+    UINT er = ERROR_SUCCESS;
+    HRESULT hr = S_OK;
+    LPWSTR pwzData = NULL;
+
+    HMODULE hMod = NULL;
+    PFNPERFCOUNTERTEXTSTRINGS pfnPerfCounterTextString;
+    DWORD dwRet;
+    LPWSTR pwzShortPath = NULL;
+    DWORD cchShortPath = MAX_PATH;
+    DWORD cchShortPathLength  = 0;
+
+    LPWSTR pwzCommand = NULL;
+
+    hr = WcaInitialize(hInstall, "RegisterPerfmon");
+    ExitOnFailure(hr, "failed to initialize");
+
+    hr = WcaGetProperty(L"CustomActionData", &pwzData);
+    ExitOnFailure(hr, "failed to get CustomActionData");
+
+    WcaLog(LOGMSG_TRACEONLY, "CustomActionData: %ls", pwzData);
+
+    // do the perfmon registration
+    if (NULL == hMod)
+    {
+        hr = LoadSystemLibrary(L"loadperf.dll", &hMod);
+    }
+    ExitOnFailure(hr, "failed to load DLL for PerfMon");
+
+    pfnPerfCounterTextString = (PFNPERFCOUNTERTEXTSTRINGS)::GetProcAddress(hMod, "LoadPerfCounterTextStringsW");
+    ExitOnNullWithLastError(pfnPerfCounterTextString, hr, "failed to get DLL function for PerfMon");
+
+    hr = StrAlloc(&pwzShortPath, cchShortPath);
+    ExitOnFailure(hr, "failed to allocate string");
+
+    WcaLog(LOGMSG_VERBOSE, "Converting DLL path to short format: %ls", pwzData);
+    cchShortPathLength = ::GetShortPathNameW(pwzData, pwzShortPath, cchShortPath);
+    if (cchShortPathLength > cchShortPath)
+    {
+        cchShortPath = cchShortPathLength + 1;
+        hr = StrAlloc(&pwzShortPath, cchShortPath);
+        ExitOnFailure(hr, "failed to allocate string");
+
+        cchShortPathLength = ::GetShortPathNameW(pwzData, pwzShortPath, cchShortPath);
+    }
+
+    if (0 == cchShortPathLength)
+    {
+        ExitOnLastError(hr, "failed to get short path format of path: %ls", pwzData);
+    }
+
+    hr = StrAllocFormatted(&pwzCommand, L"lodctr \"%s\"", pwzShortPath);
+    ExitOnFailure(hr, "failed to format lodctr string");
+
+    WcaLog(LOGMSG_VERBOSE, "RegisterPerfmon running command: '%ls'", pwzCommand);
+    dwRet = (*pfnPerfCounterTextString)(pwzCommand, TRUE);
+    if (dwRet != ERROR_SUCCESS && dwRet != ERROR_ALREADY_EXISTS)
+    {
+        hr = HRESULT_FROM_WIN32(dwRet);
+        MessageExitOnFailure(hr, msierrPERFMONFailedRegisterDLL, "failed to register with PerfMon, DLL: %ls", pwzData);
+    }
+
+    hr = S_OK;
+LExit:
+    ReleaseStr(pwzData);
+
+    if (FAILED(hr))
+        er = ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+
+extern "C" UINT __stdcall UnregisterPerfmon(
+    __in MSIHANDLE hInstall
+    )
+{
+//    Assert(FALSE);
+    UINT er = ERROR_SUCCESS;
+    HRESULT hr = S_OK;
+    LPWSTR pwzData = NULL;
+
+    HMODULE hMod = NULL;
+    PFNPERFCOUNTERTEXTSTRINGS pfnPerfCounterTextString;
+    DWORD dwRet;
+    WCHAR wz[255];
+
+    hr = WcaInitialize(hInstall, "UnregisterPerfmon");
+    ExitOnFailure(hr, "failed to initialize");
+
+    hr = WcaGetProperty(L"CustomActionData", &pwzData);
+    ExitOnFailure(hr, "failed to get CustomActionData");
+
+    WcaLog(LOGMSG_TRACEONLY, "CustomActionData: %ls", pwzData);
+
+    // do the perfmon unregistration
+    hr = E_FAIL;
+    if (hMod == NULL)
+    {
+        hr = LoadSystemLibrary(L"loadperf.dll", &hMod);
+    }
+    ExitOnFailure(hr, "failed to load DLL for PerfMon");
+
+    pfnPerfCounterTextString = (PFNPERFCOUNTERTEXTSTRINGS)::GetProcAddress(hMod, "UnloadPerfCounterTextStringsW");
+    ExitOnNullWithLastError(pfnPerfCounterTextString, hr, "failed to get DLL function for PerfMon");
+
+    hr = ::StringCchPrintfW(wz, countof(wz), L"unlodctr \"%s\"", pwzData);
+    ExitOnFailure(hr, "Failed to format unlodctr string with: %ls", pwzData);
+    WcaLog(LOGMSG_VERBOSE, "UnregisterPerfmon running command: '%ls'", wz);
+    dwRet = (*pfnPerfCounterTextString)(wz, TRUE);
+    // if the counters aren't registered, then OK to continue
+    if (dwRet != ERROR_SUCCESS && dwRet != ERROR_FILE_NOT_FOUND && dwRet != ERROR_BADKEY)
+    {
+        hr = HRESULT_FROM_WIN32(dwRet);
+        MessageExitOnFailure(hr, msierrPERFMONFailedUnregisterDLL, "failed to unregsister with PerfMon, DLL: %ls", pwzData);
+    }
+
+    hr = S_OK;
+LExit:
+    ReleaseStr(pwzData);
+
+    if (FAILED(hr))
+        er = ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+
+static HRESULT ExecutePerfCounterData(
+    __in MSIHANDLE /*hInstall*/,
+    __in BOOL fInstall
+    )
+{
+    HRESULT hr = S_OK;
+    DWORD er = ERROR_SUCCESS;
+
+    HMODULE hModule = NULL;
+    PFNPERFCOUNTERTEXTSTRINGS pfnPerfCounterTextString = NULL;
+    LPCWSTR wzPrefix = NULL;
+
+    LPWSTR pwzCustomActionData = NULL;
+    LPWSTR pwz = NULL;
+
+    LPWSTR pwzName = NULL;
+    LPWSTR pwzIniData = NULL;
+    LPWSTR pwzConstantData = NULL;
+    LPWSTR pwzTempFolder = NULL;
+    LPWSTR pwzIniFile = NULL;
+    LPWSTR pwzExecute = NULL;
+
+    HANDLE hIniData = INVALID_HANDLE_VALUE;
+    HANDLE hConstantData = INVALID_HANDLE_VALUE;
+
+    // Load the system performance counter helper DLL then get the appropriate
+    // entrypoint out of it. Fortunately, they have the same signature so we
+    // can use one function pointer to point to both.
+    hr = LoadSystemLibrary(L"loadperf.dll", &hModule);
+    ExitOnFailure(hr, "failed to load DLL for PerfMon");
+
+    if (fInstall)
+    {
+        wzPrefix = L"lodctr";
+        pfnPerfCounterTextString = (PFNPERFCOUNTERTEXTSTRINGS)::GetProcAddress(hModule, "LoadPerfCounterTextStringsW");
+    }
+    else
+    {
+        wzPrefix = L"unlodctr";
+        pfnPerfCounterTextString = (PFNPERFCOUNTERTEXTSTRINGS)::GetProcAddress(hModule, "UnloadPerfCounterTextStringsW");
+    }
+    ExitOnNullWithLastError(pfnPerfCounterTextString, hr, "Failed to get DLL function for PerfMon");
+
+    // Now get the CustomActionData and execute it.
+    hr = WcaGetProperty(L"CustomActionData", &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to get CustomActionData.");
+
+    WcaLog(LOGMSG_TRACEONLY, "CustomActionData: %ls", pwzCustomActionData);
+
+    pwz = pwzCustomActionData;
+
+    while (S_OK == (hr = WcaReadStringFromCaData(&pwz, &pwzName)))
+    {
+        hr = WcaReadStringFromCaData(&pwz, &pwzIniData);
+        ExitOnFailure(hr, "Failed to read IniData from custom action data.");
+
+        hr = WcaReadStringFromCaData(&pwz, &pwzConstantData);
+        ExitOnFailure(hr, "Failed to read ConstantData from custom action data.");
+
+        if (fInstall)
+        {
+            hr = PathCreateTempDirectory(NULL, L"WIXPF%03x", 999, &pwzTempFolder);
+            ExitOnFailure(hr, "Failed to create temp directory.");
+
+            hr = CreateDataFile(pwzTempFolder, pwzIniData, TRUE, &hIniData, &pwzIniFile);
+            ExitOnFailure(hr, "Failed to create .ini file for performance counter category: %ls", pwzName);
+
+            hr = CreateDataFile(pwzTempFolder, pwzConstantData, FALSE, &hConstantData, NULL);
+            ExitOnFailure(hr, "Failed to create .h file for performance counter category: %ls", pwzName);
+
+            hr = StrAllocFormatted(&pwzExecute, L"%s \"%s\"", wzPrefix, pwzIniFile);
+            ExitOnFailure(hr, "Failed to allocate string to execute.");
+
+            // Execute the install.
+            er = (*pfnPerfCounterTextString)(pwzExecute, TRUE);
+            hr = HRESULT_FROM_WIN32(er);
+            ExitOnFailure(hr, "Failed to execute install of performance counter category: %ls", pwzName);
+
+            if (INVALID_HANDLE_VALUE != hIniData)
+            {
+                ::CloseHandle(hIniData);
+                hIniData = INVALID_HANDLE_VALUE;
+            }
+    
+            if (INVALID_HANDLE_VALUE != hConstantData)
+            {
+                ::CloseHandle(hConstantData);
+                hConstantData = INVALID_HANDLE_VALUE;
+            }
+
+            DirEnsureDelete(pwzTempFolder, TRUE, TRUE);
+        }
+        else
+        {
+            hr = StrAllocFormatted(&pwzExecute, L"%s \"%s\"", wzPrefix, pwzName);
+            ExitOnFailure(hr, "Failed to allocate string to execute.");
+
+            // Execute the uninstall and if the counter isn't registered then ignore
+            // the error since it won't hurt anything.
+            er = (*pfnPerfCounterTextString)(pwzExecute, TRUE);
+            if (ERROR_FILE_NOT_FOUND == er || ERROR_BADKEY == er)
+            {
+                er = ERROR_SUCCESS;
+            }
+            hr = HRESULT_FROM_WIN32(er);
+            ExitOnFailure(hr, "Failed to execute uninstall of performance counter category: %ls", pwzName);
+        }
+    }
+
+    if (E_NOMOREITEMS == hr) // If there are no more items, all is well
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "Failed to execute all perf counter data.");
+
+    hr = S_OK;
+
+LExit:
+    if (INVALID_HANDLE_VALUE != hIniData)
+    {
+        ::CloseHandle(hIniData);
+    }
+
+    if (INVALID_HANDLE_VALUE != hConstantData)
+    {
+        ::CloseHandle(hConstantData);
+    }
+
+    ReleaseStr(pwzExecute);
+    ReleaseStr(pwzIniFile);
+    ReleaseStr(pwzTempFolder);
+    ReleaseStr(pwzConstantData);
+    ReleaseStr(pwzIniData);
+    ReleaseStr(pwzName);
+    ReleaseStr(pwzCustomActionData);
+
+    if (hModule)
+    {
+        ::FreeLibrary(hModule);
+    }
+
+    return hr;
+}
+
+
+static HRESULT CreateDataFile(
+    __in LPCWSTR wzTempFolder,
+    __in LPCWSTR wzData,
+    __in BOOL fIniData,
+    __out HANDLE *phFile,
+    __out_opt LPWSTR *ppwzFile
+    )
+{
+    HRESULT hr = S_OK;
+    HANDLE hFile = INVALID_HANDLE_VALUE;
+    LPWSTR pwzFile = NULL;
+    LPSTR pszData = NULL;
+    DWORD cbData = 0;
+    DWORD cbWritten = 0;
+
+    // Convert the data to UTF-8 because lodctr/unloctr
+    // doesn't like unicode.
+    hr = StrAnsiAllocString(&pszData, wzData, 0, CP_UTF8);
+    ExitOnFailure(hr, "Failed to covert data to ANSI.");
+
+    cbData = lstrlenA(pszData);
+
+    // Concatenate the paths together, open the file data file
+    // and dump the data in there.
+    hr = StrAllocString(&pwzFile, wzTempFolder, 0);
+    ExitOnFailure(hr, "Failed to copy temp directory name.");
+
+    hr = StrAllocConcat(&pwzFile, L"wixperf", 0);
+    ExitOnFailure(hr, "Failed to add name of file.");
+
+    hr = StrAllocConcat(&pwzFile, fIniData ? L".ini" : L".h", 0);
+    ExitOnFailure(hr, "Failed to add extension of file.");
+
+    hFile = ::CreateFileW(pwzFile, GENERIC_WRITE, FILE_SHARE_READ, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
+    if (INVALID_HANDLE_VALUE == hFile)
+    {
+        ExitWithLastError(hr, "Failed to open new temp file: %ls", pwzFile);
+    }
+
+    if (!::WriteFile(hFile, pszData, cbData, &cbWritten, NULL))
+    {
+        ExitWithLastError(hr, "Failed to write data to new temp file: %ls", pwzFile);
+    }
+
+    if (INVALID_HANDLE_VALUE != hFile)
+    {
+        ::CloseHandle(hFile);
+        hFile = INVALID_HANDLE_VALUE;
+    }
+
+    // Return the requested values.
+    *phFile = hFile;
+    hFile = INVALID_HANDLE_VALUE;
+
+    if (ppwzFile)
+    {
+        *ppwzFile = pwzFile;
+        pwzFile = NULL;
+    }
+
+LExit:
+    if (INVALID_HANDLE_VALUE != hFile)
+    {
+        ::CloseHandle(hFile);
+    }
+    ReleaseStr(pszData);
+    ReleaseStr(pwzFile);
+
+    return hr;
+}
diff --git a/src/ext/Util/ca/scasched.cpp b/src/ext/Util/ca/scasched.cpp
new file mode 100644
index 00000000..d81b1f14
--- /dev/null
+++ b/src/ext/Util/ca/scasched.cpp
@@ -0,0 +1,127 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+
+/********************************************************************
+ConfigureSmb - CUSTOM ACTION ENTRY POINT for installing fileshare settings
+
+********************************************************************/
+extern "C" UINT __stdcall ConfigureSmbInstall(
+    __in MSIHANDLE hInstall
+    )
+{
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    SCA_SMB* pssList = NULL;
+
+    // initialize
+    hr = WcaInitialize(hInstall, "ConfigureSmbInstall");
+    ExitOnFailure(hr, "Failed to initialize");
+
+    // check to see if necessary tables are specified
+    if (WcaTableExists(L"Wix4FileShare") != S_OK)
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping SMB CustomAction, no Wix4FileShare table");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    hr = ScaSmbRead(&pssList);
+    ExitOnFailure(hr, "failed to read Wix4FileShare table");
+
+    hr = ScaSmbInstall(pssList);
+    ExitOnFailure(hr, "failed to install FileShares");
+
+LExit:
+    if (pssList)
+        ScaSmbFreeList(pssList);
+
+    er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+
+/********************************************************************
+ConfigureSmb - CUSTOM ACTION ENTRY POINT for uninstalling fileshare settings
+
+********************************************************************/
+extern "C" UINT __stdcall ConfigureSmbUninstall(
+    __in MSIHANDLE hInstall
+    )
+{
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    SCA_SMB* pssList = NULL;
+
+    // initialize
+    hr = WcaInitialize(hInstall, "ConfigureSmbUninstall");
+    ExitOnFailure(hr, "Failed to initialize");
+
+    // check to see if necessary tables are specified
+    if (WcaTableExists(L"Wix4FileShare") != S_OK)
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping SMB CustomAction, no Wix4FileShare table");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    hr = ScaSmbRead(&pssList);
+    ExitOnFailure(hr, "failed to read Wix4FileShare table");
+
+    hr = ScaSmbUninstall(pssList);
+    ExitOnFailure(hr, "failed to uninstall FileShares");
+
+LExit:
+    if (pssList)
+        ScaSmbFreeList(pssList);
+
+    er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+
+/********************************************************************
+ConfigureUsers - CUSTOM ACTION ENTRY POINT for installing users
+
+********************************************************************/
+extern "C" UINT __stdcall ConfigureUsers(
+    __in MSIHANDLE hInstall
+    )
+{
+    //AssertSz(0, "Debug ConfigureUsers");
+
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    BOOL fInitializedCom = FALSE;
+    SCA_USER* psuList = NULL;
+
+    // initialize
+    hr = WcaInitialize(hInstall, "ConfigureUsers");
+    ExitOnFailure(hr, "Failed to initialize");
+
+    hr = ::CoInitialize(NULL);
+    ExitOnFailure(hr, "failed to initialize COM");
+    fInitializedCom = TRUE;
+
+    hr = ScaUserRead(&psuList);
+    ExitOnFailure(hr, "failed to read Wix4User table");
+
+    hr = ScaUserExecute(psuList);
+    ExitOnFailure(hr, "failed to add/remove User actions");
+
+LExit:
+    if (psuList)
+    {
+        ScaUserFreeList(psuList);
+    }
+
+    if (fInitializedCom)
+    {
+        ::CoUninitialize();
+    }
+
+    er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
\ No newline at end of file
diff --git a/src/ext/Util/ca/scasmb.h b/src/ext/Util/ca/scasmb.h
new file mode 100644
index 00000000..f2a4b53c
--- /dev/null
+++ b/src/ext/Util/ca/scasmb.h
@@ -0,0 +1,46 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+#include "scauser.h"
+
+// structs
+// Structure used to hold and extra user/permission pairs from the Wix4FileSharePermissions Table
+struct SCA_SMB_EX_USER_PERMS
+{
+        int nPermissions;
+        ACCESS_MODE accessMode;
+        SCA_USER scau;
+        SCA_SMB_EX_USER_PERMS* pExUserPermsNext;
+};
+
+struct SCA_SMB  // hungarian ss
+{
+        WCHAR wzId[MAX_DARWIN_KEY + 1];
+        WCHAR wzShareName[MAX_DARWIN_KEY + 1];
+        WCHAR wzDescription[MAX_DARWIN_COLUMN + 1];
+        WCHAR wzComponent[MAX_DARWIN_KEY + 1];
+        WCHAR wzDirectory[MAX_PATH + 1];
+
+        int nUserPermissionCount;
+        int nPermissions;
+        SCA_SMB_EX_USER_PERMS* pExUserPerms;
+
+        INSTALLSTATE isInstalled, isAction;
+
+        BOOL fUseIntegratedAuth;
+        BOOL fLegacyUserProvided;
+        struct SCA_USER scau;
+
+        struct SCA_SMB* pssNext;
+};
+
+
+#define RESERVED 0
+
+// schedule prototypes
+HRESULT ScaSmbRead(SCA_SMB** ppssList);
+HRESULT ScaSmbExPermsRead(SCA_SMB* pss);
+HRESULT ScaSmbUninstall(SCA_SMB* pssList);
+HRESULT ScaSmbInstall(SCA_SMB* pssList);
+void ScaSmbFreeList(SCA_SMB* pssList);
diff --git a/src/ext/Util/ca/scasmbexec.cpp b/src/ext/Util/ca/scasmbexec.cpp
new file mode 100644
index 00000000..ced3aa78
--- /dev/null
+++ b/src/ext/Util/ca/scasmbexec.cpp
@@ -0,0 +1,316 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+
+/********************************************************************
+ AllocateAcl - allocate an acl and populate it with this user and 
+                 permission information user could be user or domain\user
+
+********************************************************************/
+HRESULT AllocateAcl(SCA_SMBP* pssp, PACL* ppACL)
+{
+    HRESULT hr = S_OK;
+    EXPLICIT_ACCESSW* pEA = NULL;
+    DWORD cEA = 0;
+    DWORD dwCounter = 0;
+
+    PSID psid = NULL;
+    LPCWSTR wzUser = NULL;
+    DWORD nPermissions = 0;
+    DWORD nErrorReturn = 0;
+    ACCESS_MODE accessMode = NOT_USED_ACCESS; 
+    
+    cEA = pssp->dwUserPermissionCount + 1;
+    if (cEA >= MAXSIZE_T / sizeof(EXPLICIT_ACCESSW))
+    {
+        ExitOnFailure(hr = E_OUTOFMEMORY, "Too many user permissions to allocate: %u", cEA);
+    }
+
+    pEA = static_cast<EXPLICIT_ACCESSW*>(MemAlloc(cEA * sizeof(EXPLICIT_ACCESSW), TRUE));
+    ExitOnNull(pEA, hr, E_OUTOFMEMORY, "failed to allocate memory for explicit access structure");
+
+    // figure out how big the psid is
+    for (dwCounter = 0; dwCounter < pssp->dwUserPermissionCount; ++dwCounter)
+    {
+        wzUser = pssp->pUserPerms[dwCounter].wzUser;
+        nPermissions = pssp->pUserPerms[dwCounter].nPermissions;
+        accessMode = pssp->pUserPerms[dwCounter].accessMode;
+        //
+        // create the appropriate SID
+        //
+
+        // figure out the right user to put into the access block
+        if (0 == lstrcmpW(wzUser, L"Everyone"))
+        {
+            hr = AclGetWellKnownSid(WinWorldSid, &psid);
+        }
+        else if (0 == lstrcmpW(wzUser, L"Administrators"))
+        {
+            hr = AclGetWellKnownSid(WinBuiltinAdministratorsSid, &psid);
+        }
+        else if (0 == lstrcmpW(wzUser, L"LocalSystem"))
+        {
+            hr = AclGetWellKnownSid(WinLocalSystemSid, &psid);
+        }
+        else if (0 == lstrcmpW(wzUser, L"LocalService"))
+        {
+            hr = AclGetWellKnownSid(WinLocalServiceSid, &psid);
+        }
+        else if (0 == lstrcmpW(wzUser, L"NetworkService"))
+        {
+            hr = AclGetWellKnownSid(WinNetworkServiceSid, &psid);
+        }
+        else if (0 == lstrcmpW(wzUser, L"AuthenticatedUser"))
+        {
+            hr = AclGetWellKnownSid(WinAuthenticatedUserSid, &psid);
+        }
+        else if (0 == lstrcmpW(wzUser, L"Guests"))
+        {
+            hr = AclGetWellKnownSid(WinBuiltinGuestsSid, &psid);
+        }
+        else if(0 == lstrcmpW(wzUser, L"CREATOR OWNER"))
+        {
+            hr = AclGetWellKnownSid(WinCreatorOwnerSid, &psid);
+        }
+        else
+        {
+            hr = AclGetAccountSid(NULL, wzUser, &psid);
+        }
+        ExitOnFailure(hr, "failed to get sid for account: %ls", wzUser);
+
+        // we now have a valid pSid, fill in the EXPLICIT_ACCESS
+
+        /* Permissions options:   (see sca.sdh for defined sdl options)
+        #define GENERIC_READ      (0x80000000L)    2147483648
+        #define GENERIC_WRITE     (0x40000000L)    1073741824
+        #define GENERIC_EXECUTE   (0x20000000L)    536870912
+        #define GENERIC_ALL       (0x10000000L)    268435456
+        */
+        pEA[dwCounter].grfAccessPermissions = nPermissions;
+        pEA[dwCounter].grfAccessMode = accessMode;
+        pEA[dwCounter].grfInheritance = SUB_CONTAINERS_AND_OBJECTS_INHERIT;
+#pragma prefast(push)
+#pragma prefast(disable:25029)
+        ::BuildTrusteeWithSidW(&(pEA[dwCounter].Trustee), psid);
+#pragma prefast(pop)
+    }
+
+    // create a new ACL that contains the ACE
+    *ppACL = NULL;
+#pragma prefast(push)
+#pragma prefast(disable:25029)
+    nErrorReturn = ::SetEntriesInAclW(dwCounter, pEA, NULL, ppACL);
+#pragma prefast(pop)
+    ExitOnFailure(hr = HRESULT_FROM_WIN32(nErrorReturn), "failed to allocate ACL");
+
+LExit:
+    if (psid)
+    {
+        AclFreeSid(psid);
+    }
+
+    ReleaseMem(pEA);
+
+    return hr;
+}
+
+
+
+/********************************************************************
+ FillShareInfo - fill the NetShareAdd data structure
+
+********************************************************************/
+void FillShareInfo(SHARE_INFO_502* psi, SCA_SMBP* pssp, PSECURITY_DESCRIPTOR pSD)
+{
+    psi->shi502_netname      = pssp->wzKey;
+    psi->shi502_type         = STYPE_DISKTREE;
+    psi->shi502_remark       = pssp->wzDescription;
+    psi->shi502_permissions  = 0;  // not used
+    psi->shi502_max_uses     = 0xFFFFFFFF;
+    psi->shi502_current_uses = 0;
+    psi->shi502_path         = pssp->wzDirectory;
+    psi->shi502_passwd       = NULL;         // not file share perms
+    psi->shi502_reserved     = 0;
+    psi->shi502_security_descriptor = pSD;
+}
+
+
+
+/*  NET_API_STATUS return codes
+NERR_Success         =    0
+NERR_DuplicateShare  = 2118
+NERR_BufTooSmall     = 2123
+NERR_NetNameNotFound = 2310
+NERR_RedirectedPath  = 2117
+NERR_UnknownDevDir   = 2116
+*/
+
+/********************************************************************
+ DoesShareExists -  Does a share of this name exist on this computer?
+
+********************************************************************/
+HRESULT DoesShareExist(__in LPWSTR wzShareName)
+{
+    HRESULT hr = S_OK;
+    NET_API_STATUS s;
+    SHARE_INFO_502* psi = NULL;
+    s = ::NetShareGetInfo(NULL, wzShareName, 502, (BYTE**) &psi);
+
+    switch (s)
+    {
+        case NERR_Success:
+            hr = S_OK;
+            break;
+        case NERR_NetNameNotFound:
+            hr = E_FILENOTFOUND;
+            break;
+        default:
+            WcaLogError(s, "NetShareGetInfo returned an unexpected value.", NULL);
+            hr = HRESULT_FROM_WIN32(s);
+            break;
+    }
+                
+    ::NetApiBufferFree(psi);
+
+    return hr;
+}
+
+
+
+/********************************************************************
+ CreateShare - create the file share on this computer
+
+********************************************************************/
+HRESULT CreateShare(SCA_SMBP* pssp)
+{
+    if (!pssp  || !(pssp->wzKey))
+        return E_INVALIDARG;
+
+    HRESULT hr = S_OK;
+    PACL pACL = NULL;
+    SHARE_INFO_502 si;
+    NET_API_STATUS s;
+    DWORD dwParamErr = 0;
+
+    BOOL fShareExists = SUCCEEDED(DoesShareExist(pssp->wzKey));
+
+    PSECURITY_DESCRIPTOR pSD = static_cast<PSECURITY_DESCRIPTOR>(MemAlloc(SECURITY_DESCRIPTOR_MIN_LENGTH, TRUE));
+    ExitOnNull(pSD, hr, E_OUTOFMEMORY, "Failed to allocate memory for security descriptor");
+
+#pragma prefast(push)
+#pragma prefast(disable:25029)
+    if (!::InitializeSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION))
+#pragma prefast(pop)
+    {
+        ExitOnLastError(hr, "failed to initialize security descriptor");
+    }
+
+    hr = AllocateAcl(pssp, &pACL);
+    ExitOnFailure(hr, "Failed to allocate ACL for fileshare");
+
+    if (NULL == pACL)
+    {
+        WcaLog(LOGMSG_VERBOSE, "Ignoring NULL DACL.");
+    }
+#pragma prefast(push)
+#pragma prefast(disable:25028) // We only call this when pACL isn't NULL, so this call is safe according to the docs
+    // add the ACL to the security descriptor. 
+    else if (!::SetSecurityDescriptorDacl(pSD, TRUE, pACL, FALSE))
+    {
+        ExitOnLastError(hr, "Failed to set security descriptor");
+    }
+#pragma prefast(pop)
+
+    // all that is left is to create the share
+    FillShareInfo(&si, pssp, pSD);
+
+    // Fail if the directory doesn't exist
+    if (!DirExists(pssp->wzDirectory, NULL))
+        ExitOnFailure(hr = HRESULT_FROM_WIN32(ERROR_OBJECT_NOT_FOUND), "Can't create a file share on directory that doesn't exist: %ls.", pssp->wzDirectory);
+
+    WcaLog(LOGMSG_VERBOSE, "Creating file share on directory \'%ls\' named \'%ls\'.", pssp->wzDirectory, pssp->wzKey);
+
+    if (!fShareExists)
+    {
+        s = ::NetShareAdd(NULL, 502, (BYTE*) &si, &dwParamErr);
+        WcaLog(LOGMSG_VERBOSE, "Adding a new file share.");
+    }
+    else
+    {
+        // The share exists.   Write our new permissions over the top.
+        s = ::NetShareSetInfo(NULL, pssp->wzKey, 502, (BYTE*) &si, &dwParamErr);
+        WcaLog(LOGMSG_VERBOSE, "Setting permissions on existing share.");
+    }
+
+    if (NERR_Success != s)
+    {
+        hr = E_FAIL;
+        if (!fShareExists && NERR_DuplicateShare == s)
+            WcaLog(LOGMSG_VERBOSE, "Duplicate error when existence check failed.");
+
+        // error codes listed above.
+        ExitOnFailure(hr, "Failed to create/modify file share: Err: %d", s);
+    }
+
+LExit:
+    if (pACL)
+    {
+        ::LocalFree(pACL);
+    }
+
+    ReleaseMem(pSD);
+
+    return hr;
+}
+
+
+/********************************************************************
+ ScaEnsureSmbExists
+
+********************************************************************/
+HRESULT ScaEnsureSmbExists(SCA_SMBP* pssp)
+{
+    HRESULT hr = S_OK;
+
+    // create the share
+    hr = CreateShare(pssp);
+
+    return hr;
+}
+
+
+//
+//     Delete File Shares - real work
+//
+
+/********************************************************************
+ ScaDropSmb - delete this file share from this computer
+
+********************************************************************/
+HRESULT ScaDropSmb(SCA_SMBP* pssp)
+{
+    HRESULT hr = S_OK;
+    NET_API_STATUS s;
+
+    hr = DoesShareExist(pssp->wzKey);
+
+    if (E_FILENOTFOUND == hr)
+    {
+        WcaLog(LOGMSG_VERBOSE, "Share doesn't exist, share removal skipped. (%ls)", pssp->wzKey);
+        ExitFunction1(hr = S_OK);
+
+    }
+
+    ExitOnFailure(hr, "Unable to detect share. (%ls)", pssp->wzKey);
+
+    s = ::NetShareDel(NULL, pssp->wzKey, 0);
+    if (NERR_Success != s)
+    {
+        hr = E_FAIL;
+        ExitOnFailure(hr, "Failed to remove file share: Err: %d", s);
+    }
+
+LExit:
+    return hr;
+}
diff --git a/src/ext/Util/ca/scasmbexec.h b/src/ext/Util/ca/scasmbexec.h
new file mode 100644
index 00000000..e3c8f8bb
--- /dev/null
+++ b/src/ext/Util/ca/scasmbexec.h
@@ -0,0 +1,27 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+struct SCA_SMBP_USER_PERMS
+{
+        DWORD nPermissions;
+        ACCESS_MODE accessMode;
+        WCHAR* wzUser;
+        //Not adding Password because I can't find anywhere that it is used
+};
+
+struct SCA_SMBP  // hungarian ssp
+{
+        WCHAR* wzKey;
+        WCHAR* wzDescription;
+        WCHAR* wzComponent;
+        WCHAR* wzDirectory;  // full path of the dir to share to
+
+        DWORD dwUserPermissionCount;  //Count of SCA_SMBP_EX_USER_PERMS structures
+        SCA_SMBP_USER_PERMS* pUserPerms;
+        BOOL fUseIntegratedAuth;
+};
+
+
+HRESULT ScaEnsureSmbExists(SCA_SMBP* pssp);
+HRESULT ScaDropSmb(SCA_SMBP* pssp);
diff --git a/src/ext/Util/ca/scasmbsched.cpp b/src/ext/Util/ca/scasmbsched.cpp
new file mode 100644
index 00000000..e29f7f51
--- /dev/null
+++ b/src/ext/Util/ca/scasmbsched.cpp
@@ -0,0 +1,639 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+
+/********************************************************************
+ Helper functions to maintain a list of file shares to create / remove
+
+********************************************************************/
+SCA_SMB* NewSmb()
+{
+    SCA_SMB* pss = (SCA_SMB*)MemAlloc(sizeof(SCA_SMB), TRUE);
+    Assert(pss);
+    return pss;
+}
+
+
+SCA_SMB_EX_USER_PERMS* NewExUserPermsSmb()
+{
+    SCA_SMB_EX_USER_PERMS* pExUserPerms = (SCA_SMB_EX_USER_PERMS*)MemAlloc(sizeof(SCA_SMB_EX_USER_PERMS), TRUE);
+    Assert(pExUserPerms);
+    return pExUserPerms;
+}
+
+
+SCA_SMB* AddSmbToList(SCA_SMB* pssList, SCA_SMB* pss)
+{
+    if (pssList)
+    {
+        SCA_SMB* pssT = pssList;
+        while (pssT->pssNext)
+        {
+            pssT  = pssT->pssNext;
+        }
+
+        pssT->pssNext = pss;
+    }
+    else
+    {
+        pssList = pss;
+    }
+
+    return pssList;
+}
+
+
+SCA_SMB_EX_USER_PERMS* AddExUserPermsSmbToList(
+    SCA_SMB_EX_USER_PERMS* pExUserPermsList, 
+    SCA_SMB_EX_USER_PERMS* pExUserPerms
+    )
+{
+    SCA_SMB_EX_USER_PERMS* pExUserPermsTemp = pExUserPermsList;
+    if (pExUserPermsList)
+    {
+        while (pExUserPermsTemp->pExUserPermsNext)
+        {
+            pExUserPermsTemp = pExUserPermsTemp->pExUserPermsNext;
+        }
+
+        pExUserPermsTemp->pExUserPermsNext = pExUserPerms;
+    }
+    else
+    {
+        pExUserPermsList = pExUserPerms;
+    }
+
+    return pExUserPermsList;
+}
+
+void ScaSmbFreeList(SCA_SMB* pssList)
+{
+    SCA_SMB* pssDelete = pssList;
+    while (pssList)
+    {
+        pssDelete = pssList;
+        pssList = pssList->pssNext;
+
+        MemFree(pssDelete);
+    }
+}
+
+void ScaExUserPermsSmbFreeList(SCA_SMB_EX_USER_PERMS* pExUserPermsList)
+{
+    SCA_SMB_EX_USER_PERMS* pExUserPermsDelete = pExUserPermsList;
+    while (pExUserPermsList)
+    {
+        pExUserPermsDelete = pExUserPermsList;
+        pExUserPermsList = pExUserPermsList->pExUserPermsNext;
+
+        MemFree(pExUserPermsDelete);
+    }
+}
+
+// sql query constants
+LPCWSTR vcsSmbQuery = L"SELECT `Wix4FileShare`, `ShareName`, `Description`, `Directory_`, "
+    L"`Component_`, `User_`, `Permissions` FROM `Wix4FileShare`";
+
+enum eSmbQuery {
+    ssqFileShare = 1,
+    ssqShareName,
+    ssqDescription,
+    ssqDirectory,
+    ssqComponent,
+    ssqUser,
+    ssqPermissions
+    };
+
+
+/********************************************************************
+ ScaSmbRead - read all of the information from the msi tables and 
+              return a list of file share jobs to be done.
+
+********************************************************************/
+HRESULT ScaSmbRead(SCA_SMB** ppssList)
+{
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+    PMSIHANDLE hView, hRec;
+
+    LPWSTR pwzData = NULL;
+
+    SCA_SMB* pss = NULL;
+    BOOL bUserPermissionsTableExists = FALSE;
+
+    if (S_OK != WcaTableExists(L"Wix4FileShare"))
+    {
+        WcaLog(LOGMSG_VERBOSE, "Skipping ScaSmbCreateShare() - Wix4FileShare table not present");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    if (S_OK == WcaTableExists(L"Wix4FileSharePermissions"))
+    {
+        bUserPermissionsTableExists = TRUE;
+    }
+    else
+    {
+        WcaLog(LOGMSG_VERBOSE, "No Additional Permissions - Wix4FileSharePermissions table not present");
+    }
+
+    WcaLog(LOGMSG_VERBOSE, "Reading File Share Tables");
+
+    // loop through all the fileshares
+    hr = WcaOpenExecuteView(vcsSmbQuery, &hView);
+    ExitOnFailure(hr, "Failed to open view on Wix4FileShare table");
+    while (S_OK == (hr = WcaFetchRecord(hView, &hRec)))
+    {
+        pss = NewSmb();
+        if (!pss)
+        {
+            hr = E_OUTOFMEMORY;
+            break;
+        }
+        Assert(pss);
+        ::ZeroMemory(pss, sizeof(*pss));
+
+        hr = WcaGetRecordString(hRec, ssqFileShare, &pwzData);
+        ExitOnFailure(hr, "Failed to get Wix4FileShare.Wix4FileShare");
+        hr = ::StringCchCopyW(pss->wzId, countof(pss->wzId), pwzData);
+        ExitOnFailure(hr, "Failed to copy ID string to smb object");
+
+        hr = WcaGetRecordFormattedString(hRec, ssqShareName, &pwzData);
+        ExitOnFailure(hr, "Failed to get Wix4FileShare.ShareName");
+        hr = ::StringCchCopyW(pss->wzShareName, countof(pss->wzShareName), pwzData);
+        ExitOnFailure(hr, "Failed to copy share name string to smb object");
+
+        hr = WcaGetRecordString(hRec, ssqComponent, &pwzData);
+        ExitOnFailure(hr, "Failed to get Component for Wix4FileShare: '%ls'", pss->wzShareName);
+        hr = ::StringCchCopyW(pss->wzComponent, countof(pss->wzComponent), pwzData);
+        ExitOnFailure(hr, "Failed to copy component string to smb object");
+
+        hr = WcaGetRecordFormattedString(hRec, ssqDescription, &pwzData);
+        ExitOnFailure(hr, "Failed to get Share Description for Wix4FileShare: '%ls'", pss->wzShareName);
+        hr = ::StringCchCopyW(pss->wzDescription, countof(pss->wzDescription), pwzData);
+        ExitOnFailure(hr, "Failed to copy description string to smb object");
+
+        // get user info from the user table
+        hr = WcaGetRecordFormattedString(hRec, ssqUser, &pwzData);
+        ExitOnFailure(hr, "Failed to get Wix4User record for Wix4FileShare: '%ls'", pss->wzShareName);
+
+        // get component install state
+        er = ::MsiGetComponentStateW(WcaGetInstallHandle(), pss->wzComponent, &pss->isInstalled, &pss->isAction);
+        hr = HRESULT_FROM_WIN32(er);
+        ExitOnFailure(hr, "Failed to get Component state for Wix4FileShare");
+
+        // if a user was specified
+        if (*pwzData)
+        {
+            pss->fUseIntegratedAuth = FALSE;
+            pss->fLegacyUserProvided = TRUE;
+            hr = ScaGetUser(pwzData, &pss->scau);
+            ExitOnFailure(hr, "Failed to get user information for fileshare: '%ls'", pss->wzShareName);
+        }
+        else
+        {
+            pss->fLegacyUserProvided = FALSE;
+            // TODO: figure out whether this is useful still
+            //pss->fUseIntegratedAuth = TRUE;
+            // integrated authorization doesn't have a User record
+        }
+
+        // get the share's directory
+        hr = WcaGetRecordString(hRec, ssqDirectory, &pwzData);
+        ExitOnFailure(hr, "Failed to get directory for Wix4FileShare: '%ls'", pss->wzShareName);
+
+        WCHAR wzPath[MAX_PATH];
+        DWORD dwLen;
+        dwLen = countof(wzPath);
+        // review: relevant for file shares?
+        if (INSTALLSTATE_SOURCE == pss->isAction)
+        {
+            er = ::MsiGetSourcePathW(WcaGetInstallHandle(), pwzData, wzPath, &dwLen);
+        }
+        else
+        {
+            er = ::MsiGetTargetPathW(WcaGetInstallHandle(), pwzData, wzPath, &dwLen);
+        }
+        hr = HRESULT_FROM_WIN32(er);
+        ExitOnFailure(hr, "Failed to get Source/TargetPath for Directory");
+
+        // If the path is to the root of a drive, then it needs a trailing backslash.
+        // Otherwise, it can't have a trailing backslash.
+        if (3 < dwLen)
+        {
+            if (wzPath[dwLen - 1] == L'\\')
+            {
+                wzPath[dwLen - 1] = 0;
+            }
+        }
+        else if (2 == dwLen && wzPath[1] == L':')
+        {
+            wzPath[2] = L'\\';
+            wzPath[3] = 0;
+        }
+
+        hr = ::StringCchCopyW(pss->wzDirectory, countof(pss->wzDirectory), wzPath);
+        ExitOnFailure(hr, "Failed to copy directory string to smb object");
+
+        hr = WcaGetRecordInteger(hRec, ssqPermissions, &pss->nPermissions);
+        ExitOnFailure(hr, "Failed to get Wix4FileShare.Permissions");
+
+        // Check to see if additional user & permissions are specified for this share
+        if (bUserPermissionsTableExists)
+        {
+            hr = ScaSmbExPermsRead(pss);
+            ExitOnFailure(hr, "Failed to get Additional File Share Permissions");
+        }
+
+        *ppssList = AddSmbToList(*ppssList, pss);
+        pss = NULL; // set the smb NULL so it doesn't accidentally get freed below
+    }
+
+    if (E_NOMOREITEMS == hr)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "Failure occured while processing Wix4FileShare table");
+
+LExit:
+    // if anything was left over after an error clean it all up
+    if (pss)
+    {
+        ScaSmbFreeList(pss);
+    }
+
+    ReleaseStr(pwzData);
+
+    return hr;
+}
+
+
+/********************************************************************
+ RetrieveSMBShareUserPermList - retrieve SMB Share's user permission list
+
+********************************************************************/
+HRESULT RetrieveFileShareUserPerm(SCA_SMB* pss, SCA_SMB_EX_USER_PERMS** ppExUserPermsList, DWORD *pUserPermsCount)
+{
+    HRESULT hr = S_OK;
+    SHARE_INFO_502* psi = NULL;
+    NET_API_STATUS s;
+    BOOL bValid, bDaclDefaulted;
+    PACL acl = NULL;
+    PEXPLICIT_ACCESSW pEA = NULL;
+    ULONG nCount = 0;
+    DWORD er = ERROR_SUCCESS;
+    PSID pSID = NULL;
+    DWORD nUserNameSize = MAX_DARWIN_COLUMN;
+    DWORD nDomainNameSize = MAX_DARWIN_COLUMN;
+    SID_NAME_USE peUse;
+    DWORD dwCounter = 0;
+    SCA_SMB_EX_USER_PERMS* pExUserPermsList = NULL;
+    DWORD dwUserPermsCount = 0;
+
+    *pUserPermsCount = 0;
+    s = ::NetShareGetInfo(NULL, pss->wzShareName, 502, (LPBYTE*)&psi);
+    WcaLog(LOGMSG_VERBOSE, "retrieving permissions on existing file share.");
+    if (NERR_NetNameNotFound == s)
+    {
+        WcaLog(LOGMSG_VERBOSE, "File share has already been removed.");
+        ExitFunction1(hr = S_OK);
+    }
+    else if (NERR_Success != s || psi == NULL)
+    {
+        hr = E_FAIL;
+        ExitOnFailure(hr, "Failed to get share information with return code: %d", s);
+    }
+    if (!::GetSecurityDescriptorDacl(psi->shi502_security_descriptor, &bValid, &acl, &bDaclDefaulted) || !bValid)
+    {
+        ExitOnLastError(hr, "Failed to get acl from security descriptor");
+    }
+
+    er = ::GetExplicitEntriesFromAclW(acl, &nCount, &pEA);
+    hr = HRESULT_FROM_WIN32(er);
+    ExitOnFailure(hr, "Failed to get  access entries from acl for file share %ls", pss->wzShareName);
+    for (dwCounter = 0; dwCounter < nCount; ++dwCounter)
+    {
+        if (TRUSTEE_IS_SID == pEA[dwCounter].Trustee.TrusteeForm)
+        {
+            SCA_SMB_EX_USER_PERMS* pExUserPerms = NewExUserPermsSmb();
+            ::ZeroMemory(pExUserPerms, sizeof(*pExUserPerms));
+            pExUserPermsList = AddExUserPermsSmbToList(pExUserPermsList, pExUserPerms);
+            pSID = (PSID)(pEA[dwCounter].Trustee.ptstrName);
+            if (!::LookupAccountSidW(NULL, pSID, pExUserPerms->scau.wzName, &nUserNameSize, pExUserPerms->scau.wzDomain, &nDomainNameSize, &peUse))
+            {
+                hr = E_FAIL;
+                ExitOnFailure(hr, "Failed to get account name from SID");
+            }
+            pExUserPerms->nPermissions = pEA[dwCounter].grfAccessPermissions;
+            pExUserPerms->accessMode = pEA[dwCounter].grfAccessMode;
+            ++dwUserPermsCount;
+            nUserNameSize = MAX_DARWIN_COLUMN;
+            nDomainNameSize = MAX_DARWIN_COLUMN;
+        }
+    }
+    *ppExUserPermsList = pExUserPermsList;
+    *pUserPermsCount = dwUserPermsCount;
+
+LExit:
+    if (psi)
+    {
+        ::NetApiBufferFree(psi);
+    }
+
+    if (pEA)
+    {
+        ::LocalFree(pEA);
+    }
+
+    return hr;
+}
+
+
+/********************************************************************
+ SchedCreateSmb - schedule one instance of a file share creation
+
+********************************************************************/
+HRESULT SchedCreateSmb(SCA_SMB* pss)
+{
+    HRESULT hr = S_OK;
+
+    WCHAR wzDomainUser[255]; // "domain\user"
+    SCA_SMB_EX_USER_PERMS* pExUserPermsList = NULL;
+    int nCounter = 0;
+    WCHAR* pwzRollbackCustomActionData = NULL;
+    WCHAR* pwzCustomActionData = NULL;
+
+    hr = WcaWriteStringToCaData(pss->wzShareName, &pwzRollbackCustomActionData);
+    ExitOnFailure(hr, "failed to add ShareName to CustomActionData");
+
+    hr = WcaWriteStringToCaData(pss->wzShareName, &pwzCustomActionData);
+    ExitOnFailure(hr, "failed to add ShareName to CustomActionData");
+
+    hr = WcaWriteStringToCaData(pss->wzDescription, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to add server name to CustomActionData");
+
+    hr = WcaWriteStringToCaData(pss->wzDirectory, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to add full path instance to CustomActionData");
+
+    hr = WcaWriteStringToCaData(pss->fUseIntegratedAuth ? L"1" : L"0", &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to add server name to CustomActionData");
+
+    if (pss->fLegacyUserProvided)
+    {
+        hr = WcaWriteIntegerToCaData(pss->nUserPermissionCount + 1, &pwzCustomActionData);
+        ExitOnFailure(hr, "Failed to add additional user permission count to CustomActionData");
+
+        hr = UserBuildDomainUserName(wzDomainUser, countof(wzDomainUser), pss->scau.wzName, pss->scau.wzDomain);
+        ExitOnFailure(hr, "Failed to build user and domain name for CustomActionData");
+        hr = WcaWriteStringToCaData(wzDomainUser, &pwzCustomActionData);
+        ExitOnFailure(hr, "Failed to add server Domain\\UserName to CustomActionData");
+
+        hr = WcaWriteIntegerToCaData(pss->nPermissions, &pwzCustomActionData);
+        ExitOnFailure(hr, "Failed to add permissions to CustomActionData");
+    }
+    else
+    {
+        hr = WcaWriteIntegerToCaData(pss->nUserPermissionCount, &pwzCustomActionData);
+        ExitOnFailure(hr, "Failed to add additional user permission count to CustomActionData");
+    }
+
+    if (pss->nUserPermissionCount > 0)
+    {
+        nCounter = 0;
+        for (pExUserPermsList = pss->pExUserPerms; pExUserPermsList; pExUserPermsList = pExUserPermsList->pExUserPermsNext)
+        {
+            Assert(nCounter < pss->nUserPermissionCount);
+
+            hr = UserBuildDomainUserName(wzDomainUser, countof(wzDomainUser), pExUserPermsList->scau.wzName, pExUserPermsList->scau.wzDomain);
+            ExitOnFailure(hr, "Failed to build user and domain name for CustomActionData");
+            hr = WcaWriteStringToCaData(wzDomainUser, &pwzCustomActionData);
+            ExitOnFailure(hr, "Failed to add server Domain\\UserName to CustomActionData");
+
+            hr = WcaWriteIntegerToCaData((int)pExUserPermsList->accessMode, &pwzCustomActionData);
+            ExitOnFailure(hr, "Failed to add access mode to CustomActionData");
+            
+            hr = WcaWriteIntegerToCaData(pExUserPermsList->nPermissions, &pwzCustomActionData);
+            ExitOnFailure(hr, "Failed to add permissions to CustomActionData");
+            ++nCounter;
+        }
+        Assert(nCounter == pss->nUserPermissionCount);
+    }
+
+    // Schedule the rollback first
+    hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"CreateSmbRollback"), pwzRollbackCustomActionData, COST_SMB_DROPSMB);
+    ExitOnFailure(hr, "Failed to schedule DropSmb action");
+
+    hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"CreateSmb"), pwzCustomActionData, COST_SMB_CREATESMB);
+    ExitOnFailure(hr, "Failed to schedule CreateSmb action");
+
+LExit:
+    ReleaseStr(pwzRollbackCustomActionData);
+    ReleaseStr(pwzCustomActionData);
+
+    if (pExUserPermsList)
+    {
+        ScaExUserPermsSmbFreeList(pExUserPermsList);
+    }
+
+    return hr;
+}
+
+
+/********************************************************************
+ ScaSmbInstall - for every file share, schedule the create custom action
+
+********************************************************************/
+HRESULT ScaSmbInstall(SCA_SMB* pssList)
+{
+    HRESULT hr = S_FALSE; // assume nothing will be done
+    SCA_SMB* pss = NULL;
+
+    for (pss = pssList; pss; pss = pss->pssNext)
+    {
+        // if installing this component
+        if (WcaIsInstalling(pss->isInstalled, pss->isAction) )
+        {
+            hr = SchedCreateSmb(pss);
+            ExitOnFailure(hr, "Failed to schedule the creation of the fileshare: %ls", pss->wzShareName);
+        }
+    }
+
+LExit:
+    return hr;
+}
+
+
+/********************************************************************
+ SchedDropSmb - schedule one instance of a file share removal
+
+********************************************************************/
+HRESULT SchedDropSmb(SCA_SMB* pss)
+{
+    HRESULT hr = S_OK;
+
+    WCHAR* pwzCustomActionData = NULL;
+    WCHAR* pwzRollbackCustomActionData = NULL;
+    SCA_SMB_EX_USER_PERMS *pExUserPermsList = NULL;
+    SCA_SMB_EX_USER_PERMS *pExUserPerm = NULL;
+    WCHAR wzDomainUser[255]; // "domain\user"
+    DWORD dwUserPermsCount = 0;
+    
+    // roll back DropSmb
+    hr = WcaWriteStringToCaData(pss->wzShareName, &pwzRollbackCustomActionData);
+    ExitOnFailure(hr, "failed to add ShareName to CustomActionData");
+
+    hr = WcaWriteStringToCaData(pss->wzDescription, &pwzRollbackCustomActionData);
+    ExitOnFailure(hr, "Failed to add server name to CustomActionData");
+
+    hr = WcaWriteStringToCaData(pss->wzDirectory, &pwzRollbackCustomActionData);
+    ExitOnFailure(hr, "Failed to add full path instance to CustomActionData");
+
+    hr = WcaWriteStringToCaData(L"1", &pwzRollbackCustomActionData);
+    ExitOnFailure(hr, "Failed to add useintegrated flag  to CustomActionData");
+
+    hr = RetrieveFileShareUserPerm(pss, &pExUserPermsList, &dwUserPermsCount);
+    ExitOnFailure(hr, "Failed to retrieve SMBShare's user permissions");
+
+    hr = WcaWriteIntegerToCaData((int)dwUserPermsCount, &pwzRollbackCustomActionData);
+    ExitOnFailure(hr, "Failed to add additional user permission count to CustomActionData");
+
+    for (pExUserPerm = pExUserPermsList; pExUserPerm; pExUserPerm = pExUserPerm->pExUserPermsNext)
+    {
+        hr = UserBuildDomainUserName(wzDomainUser, countof(wzDomainUser), pExUserPerm->scau.wzName, pExUserPerm->scau.wzDomain);
+        ExitOnFailure(hr, "Failed to build user and domain name for CustomActionData");
+        hr = WcaWriteStringToCaData(wzDomainUser, &pwzRollbackCustomActionData);
+        ExitOnFailure(hr, "Failed to add server Domain\\UserName to CustomActionData");
+
+        hr = WcaWriteIntegerToCaData((int)pExUserPerm->accessMode, &pwzRollbackCustomActionData);
+        ExitOnFailure(hr, "Failed to add access mode to CustomActionData");
+        
+        hr = WcaWriteIntegerToCaData(pExUserPerm->nPermissions, &pwzRollbackCustomActionData);
+        ExitOnFailure(hr, "Failed to add permissions to CustomActionData");
+    }
+
+    hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"DropSmbRollback"), pwzRollbackCustomActionData, COST_SMB_CREATESMB);
+    ExitOnFailure(hr, "Failed to schedule DropSmbRollback action");
+
+    // DropSMB
+    hr = WcaWriteStringToCaData(pss->wzShareName, &pwzCustomActionData);
+    ExitOnFailure(hr, "failed to add ShareName to CustomActionData");
+
+    hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"DropSmb"), pwzCustomActionData, COST_SMB_DROPSMB);
+    ExitOnFailure(hr, "Failed to schedule DropSmb action");
+
+LExit:
+    ReleaseStr(pwzCustomActionData);
+
+    if (pExUserPermsList)
+    {
+        ScaExUserPermsSmbFreeList(pExUserPermsList);
+    }
+    
+    return hr;
+
+}
+
+
+/********************************************************************
+ ScaSmbUninstall - for every file share, schedule the drop custom action
+
+********************************************************************/
+HRESULT ScaSmbUninstall(SCA_SMB* pssList)
+{
+    HRESULT hr = S_FALSE; // assume nothing will be done
+    SCA_SMB* pss = NULL;
+
+    for (pss = pssList; pss; pss = pss->pssNext)
+    {
+        // if uninstalling this component
+        if (WcaIsUninstalling(pss->isInstalled, pss->isAction) )
+        {
+            hr = SchedDropSmb(pss);
+            ExitOnFailure(hr, "Failed to remove file share %ls", pss->wzShareName);
+        }
+    }
+
+LExit:
+    return hr;
+}
+
+LPCWSTR vcsSmbExUserPermsQuery = L"SELECT `FileShare_`,`User_`,`Permissions` "
+    L"FROM `Wix4FileSharePermissions` WHERE `FileShare_`=?";
+
+enum  eSmbUserPermsQuery {
+    ssupqFileShare = 1,
+    ssupqUser,
+    ssupqPermissions
+
+};
+
+
+/********************************************************************
+ ScaSmbExPermsRead - for Every entry in File Permissions table add a 
+                     User Name & Permissions structure to the List
+
+********************************************************************/
+HRESULT ScaSmbExPermsRead(SCA_SMB* pss)
+{
+    HRESULT hr = S_OK;
+    PMSIHANDLE hView, hRec;
+
+    LPWSTR pwzData = NULL;
+    SCA_SMB_EX_USER_PERMS* pExUserPermsList = pss->pExUserPerms;
+    SCA_SMB_EX_USER_PERMS* pExUserPerms = NULL;
+    int nCounter = 0;
+
+    hRec = ::MsiCreateRecord(1);
+    hr = WcaSetRecordString(hRec, 1, pss->wzId);
+    ExitOnFailure(hr, "Failed to look up FileShare");
+
+    hr = WcaOpenView(vcsSmbExUserPermsQuery, &hView);
+    ExitOnFailure(hr, "Failed to open view on Wix4FileSharePermissions table");
+    hr = WcaExecuteView(hView, hRec);
+    ExitOnFailure(hr, "Failed to execute view on Wix4FileSharePermissions table");
+
+    // loop through all User/Permissions paris returned
+    while (S_OK == (hr = WcaFetchRecord(hView, &hRec)))
+    {
+        pExUserPerms = NewExUserPermsSmb();
+        if (!pExUserPerms)
+        {
+            hr = E_OUTOFMEMORY;
+            break;
+        }
+        Assert(pExUserPerms);
+        ::ZeroMemory(pExUserPerms, sizeof(*pExUserPerms));
+
+        hr = WcaGetRecordString(hRec, ssupqUser, &pwzData);
+        ExitOnFailure(hr, "Failed to get Wix4FileSharePermissions.User");
+        hr = ScaGetUser(pwzData, &pExUserPerms->scau);
+        ExitOnFailure(hr, "Failed to get user information for fileshare: '%ls'", pss->wzShareName);
+
+        hr = WcaGetRecordInteger(hRec, ssupqPermissions, &pExUserPerms->nPermissions);
+        ExitOnFailure(hr, "Failed to get Wix4FileSharePermissions.Permissions");
+        pExUserPerms->accessMode = SET_ACCESS;  // we only support SET_ACCESS here
+
+        pExUserPermsList = AddExUserPermsSmbToList(pExUserPermsList, pExUserPerms);
+        ++nCounter;
+        pExUserPerms = NULL; // set the smb NULL so it doesn't accidentally get freed below
+    }
+
+    if (E_NOMOREITEMS == hr)
+    {
+        hr = S_OK;
+        pss->pExUserPerms = pExUserPermsList;
+        pss->nUserPermissionCount = nCounter;
+    }
+    ExitOnFailure(hr, "Failure occured while processing FileShare table");
+
+LExit:
+    // if anything was left over after an error clean it all up
+    if (pExUserPerms)
+    {
+        ScaExUserPermsSmbFreeList(pExUserPerms);
+    }
+
+    ReleaseStr(pwzData);
+
+    return hr;
+}
diff --git a/src/ext/Util/ca/scauser.cpp b/src/ext/Util/ca/scauser.cpp
new file mode 100644
index 00000000..b25e9daf
--- /dev/null
+++ b/src/ext/Util/ca/scauser.cpp
@@ -0,0 +1,709 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+LPCWSTR vcsUserQuery = L"SELECT `Wix4User`, `Component_`, `Name`, `Domain`, `Password` FROM `Wix4User` WHERE `Wix4User`=?";
+enum eUserQuery { vuqUser = 1, vuqComponent, vuqName, vuqDomain, vuqPassword };
+
+LPCWSTR vcsGroupQuery = L"SELECT `Wix4Group`, `Component_`, `Name`, `Domain` FROM `Wix4Group` WHERE `Wix4Group`=?";
+enum eGroupQuery { vgqGroup = 1, vgqComponent, vgqName, vgqDomain };
+
+LPCWSTR vcsUserGroupQuery = L"SELECT `Wix4User_`, `Wix4Group_` FROM `Wix4UserGroup` WHERE `Wix4User_`=?";
+enum eUserGroupQuery { vugqUser = 1, vugqGroup };
+
+LPCWSTR vActionableQuery = L"SELECT `Wix4User`,`Component_`,`Name`,`Domain`,`Password`,`Attributes` FROM `Wix4User` WHERE `Component_` IS NOT NULL";
+enum eActionableQuery { vaqUser = 1, vaqComponent, vaqName, vaqDomain, vaqPassword, vaqAttributes };
+
+
+static HRESULT AddUserToList(
+    __inout SCA_USER** ppsuList
+    );
+
+static HRESULT AddGroupToList(
+    __inout SCA_GROUP** ppsgList
+    );
+
+
+HRESULT __stdcall ScaGetUser(
+    __in LPCWSTR wzUser,
+    __out SCA_USER* pscau
+    )
+{
+    if (!wzUser || !pscau)
+    {
+        return E_INVALIDARG;
+    }
+
+    HRESULT hr = S_OK;
+    PMSIHANDLE hView, hRec;
+
+    LPWSTR pwzData = NULL;
+
+    // clear struct and bail right away if no user key was passed to search for
+    ::ZeroMemory(pscau, sizeof(*pscau));
+    if (!*wzUser)
+    {
+        ExitFunction1(hr = S_OK);
+    }
+
+    hRec = ::MsiCreateRecord(1);
+    hr = WcaSetRecordString(hRec, 1, wzUser);
+    ExitOnFailure(hr, "Failed to look up User");
+
+    hr = WcaOpenView(vcsUserQuery, &hView);
+    ExitOnFailure(hr, "Failed to open view on Wix4User table");
+    hr = WcaExecuteView(hView, hRec);
+    ExitOnFailure(hr, "Failed to execute view on Wix4User table");
+
+    hr = WcaFetchSingleRecord(hView, &hRec);
+    if (S_OK == hr)
+    {
+        hr = WcaGetRecordString(hRec, vuqUser, &pwzData);
+        ExitOnFailure(hr, "Failed to get Wix4User.User");
+        hr = ::StringCchCopyW(pscau->wzKey, countof(pscau->wzKey), pwzData);
+        ExitOnFailure(hr, "Failed to copy key string to user object");
+
+        hr = WcaGetRecordString(hRec, vuqComponent, &pwzData);
+        ExitOnFailure(hr, "Failed to get Wix4User.Component_");
+        hr = ::StringCchCopyW(pscau->wzComponent, countof(pscau->wzComponent), pwzData);
+        ExitOnFailure(hr, "Failed to copy component string to user object");
+
+        hr = WcaGetRecordFormattedString(hRec, vuqName, &pwzData);
+        ExitOnFailure(hr, "Failed to get Wix4User.Name");
+        hr = ::StringCchCopyW(pscau->wzName, countof(pscau->wzName), pwzData);
+        ExitOnFailure(hr, "Failed to copy name string to user object");
+
+        hr = WcaGetRecordFormattedString(hRec, vuqDomain, &pwzData);
+        ExitOnFailure(hr, "Failed to get Wix4User.Domain");
+        hr = ::StringCchCopyW(pscau->wzDomain, countof(pscau->wzDomain), pwzData);
+        ExitOnFailure(hr, "Failed to copy domain string to user object");
+
+        hr = WcaGetRecordFormattedString(hRec, vuqPassword, &pwzData);
+        ExitOnFailure(hr, "Failed to get Wix4User.Password");
+        hr = ::StringCchCopyW(pscau->wzPassword, countof(pscau->wzPassword), pwzData);
+        ExitOnFailure(hr, "Failed to copy password string to user object");
+    }
+    else if (E_NOMOREITEMS == hr)
+    {
+        WcaLog(LOGMSG_STANDARD, "Error: Cannot locate Wix4User.User='%ls'", wzUser);
+        hr = E_FAIL;
+    }
+    else
+    {
+        ExitOnFailure(hr, "Error or found multiple matching Wix4User rows");
+    }
+
+LExit:
+    ReleaseStr(pwzData);
+
+    return hr;
+}
+
+HRESULT __stdcall ScaGetUserDeferred(
+    __in LPCWSTR wzUser,
+    __in WCA_WRAPQUERY_HANDLE hUserQuery,
+    __out SCA_USER* pscau
+    )
+{
+    if (!wzUser || !pscau)
+    {
+        return E_INVALIDARG;
+    }
+
+    HRESULT hr = S_OK;
+    MSIHANDLE hRec, hRecTest;
+
+    LPWSTR pwzData = NULL;
+
+    // clear struct and bail right away if no user key was passed to search for
+    ::ZeroMemory(pscau, sizeof(*pscau));
+    if (!*wzUser)
+    {
+        ExitFunction1(hr = S_OK);
+    }
+
+    // Reset back to the first record
+    WcaFetchWrappedReset(hUserQuery);
+
+    hr = WcaFetchWrappedRecordWhereString(hUserQuery, vuqUser, wzUser, &hRec);
+    if (S_OK == hr)
+    {
+        hr = WcaFetchWrappedRecordWhereString(hUserQuery, vuqUser, wzUser, &hRecTest);
+        if (S_OK == hr)
+        {
+            AssertSz(FALSE, "Found multiple matching Wix4User rows");
+        }
+
+        hr = WcaGetRecordString(hRec, vuqUser, &pwzData);
+        ExitOnFailure(hr, "Failed to get Wix4User.User");
+        hr = ::StringCchCopyW(pscau->wzKey, countof(pscau->wzKey), pwzData);
+        ExitOnFailure(hr, "Failed to copy key string to user object (in deferred CA)");
+
+        hr = WcaGetRecordString(hRec, vuqComponent, &pwzData);
+        ExitOnFailure(hr, "Failed to get Wix4User.Component_");
+        hr = ::StringCchCopyW(pscau->wzComponent, countof(pscau->wzComponent), pwzData);
+        ExitOnFailure(hr, "Failed to copy component string to user object (in deferred CA)");
+
+        hr = WcaGetRecordString(hRec, vuqName, &pwzData);
+        ExitOnFailure(hr, "Failed to get Wix4User.Name");
+        hr = ::StringCchCopyW(pscau->wzName, countof(pscau->wzName), pwzData);
+        ExitOnFailure(hr, "Failed to copy name string to user object (in deferred CA)");
+
+        hr = WcaGetRecordString(hRec, vuqDomain, &pwzData);
+        ExitOnFailure(hr, "Failed to get Wix4User.Domain");
+        hr = ::StringCchCopyW(pscau->wzDomain, countof(pscau->wzDomain), pwzData);
+        ExitOnFailure(hr, "Failed to copy domain string to user object (in deferred CA)");
+
+        hr = WcaGetRecordString(hRec, vuqPassword, &pwzData);
+        ExitOnFailure(hr, "Failed to get Wix4User.Password");
+        hr = ::StringCchCopyW(pscau->wzPassword, countof(pscau->wzPassword), pwzData);
+        ExitOnFailure(hr, "Failed to copy password string to user object (in deferred CA)");
+    }
+    else if (E_NOMOREITEMS == hr)
+    {
+        WcaLog(LOGMSG_STANDARD, "Error: Cannot locate Wix4User.User='%ls'", wzUser);
+        hr = E_FAIL;
+    }
+    else
+    {
+        ExitOnFailure(hr, "Error fetching single Wix4User row");
+    }
+
+LExit:
+    ReleaseStr(pwzData);
+
+    return hr;
+}
+
+
+HRESULT __stdcall ScaGetGroup(
+    __in LPCWSTR wzGroup,
+    __out SCA_GROUP* pscag
+    )
+{
+    if (!wzGroup || !pscag)
+    {
+        return E_INVALIDARG;
+    }
+
+    HRESULT hr = S_OK;
+    PMSIHANDLE hView, hRec;
+
+    LPWSTR pwzData = NULL;
+
+    hRec = ::MsiCreateRecord(1);
+    hr = WcaSetRecordString(hRec, 1, wzGroup);
+    ExitOnFailure(hr, "Failed to look up Group");
+
+    hr = WcaOpenView(vcsGroupQuery, &hView);
+    ExitOnFailure(hr, "Failed to open view on Wix4Group table");
+    hr = WcaExecuteView(hView, hRec);
+    ExitOnFailure(hr, "Failed to execute view on Wix4Group table");
+
+    hr = WcaFetchSingleRecord(hView, &hRec);
+    if (S_OK == hr)
+    {
+        hr = WcaGetRecordString(hRec, vgqGroup, &pwzData);
+        ExitOnFailure(hr, "Failed to get Wix4Group.Wix4Group.");
+        hr = ::StringCchCopyW(pscag->wzKey, countof(pscag->wzKey), pwzData);
+        ExitOnFailure(hr, "Failed to copy Wix4Group.Wix4Group.");
+
+        hr = WcaGetRecordString(hRec, vgqComponent, &pwzData);
+        ExitOnFailure(hr, "Failed to get Wix4Group.Component_");
+        hr = ::StringCchCopyW(pscag->wzComponent, countof(pscag->wzComponent), pwzData);
+        ExitOnFailure(hr, "Failed to copy Wix4Group.Component_.");
+
+        hr = WcaGetRecordFormattedString(hRec, vgqName, &pwzData);
+        ExitOnFailure(hr, "Failed to get Wix4Group.Name");
+        hr = ::StringCchCopyW(pscag->wzName, countof(pscag->wzName), pwzData);
+        ExitOnFailure(hr, "Failed to copy Wix4Group.Name.");
+
+        hr = WcaGetRecordFormattedString(hRec, vgqDomain, &pwzData);
+        ExitOnFailure(hr, "Failed to get Wix4Group.Domain");
+        hr = ::StringCchCopyW(pscag->wzDomain, countof(pscag->wzDomain), pwzData);
+        ExitOnFailure(hr, "Failed to copy Wix4Group.Domain.");
+    }
+    else if (E_NOMOREITEMS == hr)
+    {
+        WcaLog(LOGMSG_STANDARD, "Error: Cannot locate Wix4Group.Wix4Group='%ls'", wzGroup);
+        hr = E_FAIL;
+    }
+    else
+    {
+        ExitOnFailure(hr, "Error or found multiple matching Wix4Group rows");
+    }
+
+LExit:
+    ReleaseStr(pwzData);
+
+    return hr;
+}
+
+
+void ScaUserFreeList(
+    __in SCA_USER* psuList
+    )
+{
+    SCA_USER* psuDelete = psuList;
+    while (psuList)
+    {
+        psuDelete = psuList;
+        psuList = psuList->psuNext;
+
+        ScaGroupFreeList(psuDelete->psgGroups);
+        MemFree(psuDelete);
+    }
+}
+
+
+void ScaGroupFreeList(
+    __in SCA_GROUP* psgList
+    )
+{
+    SCA_GROUP* psgDelete = psgList;
+    while (psgList)
+    {
+        psgDelete = psgList;
+        psgList = psgList->psgNext;
+
+        MemFree(psgDelete);
+    }
+}
+
+
+HRESULT ScaUserRead(
+    __out SCA_USER** ppsuList
+    )
+{
+    //Assert(FALSE);
+    Assert(ppsuList);
+
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+    PMSIHANDLE hView, hRec, hUserRec, hUserGroupView;
+
+    LPWSTR pwzData = NULL;
+
+    BOOL fUserGroupExists = FALSE;
+
+    SCA_USER *psu = NULL;
+
+    INSTALLSTATE isInstalled, isAction;
+
+    if (S_OK != WcaTableExists(L"Wix4User"))
+    {
+        WcaLog(LOGMSG_VERBOSE, "Wix4User Table does not exist, exiting");
+        ExitFunction1(hr = S_FALSE);
+    }
+
+    if (S_OK == WcaTableExists(L"Wix4UserGroup"))
+    {
+        fUserGroupExists = TRUE;
+    }
+
+    //
+    // loop through all the users
+    //
+    hr = WcaOpenExecuteView(vActionableQuery, &hView);
+    ExitOnFailure(hr, "failed to open view on Wix4User table");
+    while (S_OK == (hr = WcaFetchRecord(hView, &hRec)))
+    {
+        hr = WcaGetRecordString(hRec, vaqComponent, &pwzData);
+        ExitOnFailure(hr, "failed to get Wix4User.Component");
+
+        er = ::MsiGetComponentStateW(WcaGetInstallHandle(), pwzData, &isInstalled, &isAction);
+        hr = HRESULT_FROM_WIN32(er);
+        ExitOnFailure(hr, "failed to get Component state for Wix4User");
+
+        // don't bother if we aren't installing or uninstalling this component
+        if (WcaIsInstalling(isInstalled,  isAction) || WcaIsUninstalling(isInstalled, isAction))
+        {
+            //
+            // Add the user to the list and populate it's values
+            //
+            hr = AddUserToList(ppsuList);
+            ExitOnFailure(hr, "failed to add user to list");
+
+            psu = *ppsuList;
+
+            psu->isInstalled = isInstalled;
+            psu->isAction = isAction;
+            hr = ::StringCchCopyW(psu->wzComponent, countof(psu->wzComponent), pwzData);
+            ExitOnFailure(hr, "failed to copy component name: %ls", pwzData);
+
+            hr = WcaGetRecordString(hRec, vaqUser, &pwzData);
+            ExitOnFailure(hr, "failed to get Wix4User.User");
+            hr = ::StringCchCopyW(psu->wzKey, countof(psu->wzKey), pwzData);
+            ExitOnFailure(hr, "failed to copy user key: %ls", pwzData);
+
+            hr = WcaGetRecordFormattedString(hRec, vaqName, &pwzData);
+            ExitOnFailure(hr, "failed to get Wix4User.Name");
+            hr = ::StringCchCopyW(psu->wzName, countof(psu->wzName), pwzData);
+            ExitOnFailure(hr, "failed to copy user name: %ls", pwzData);
+
+            hr = WcaGetRecordFormattedString(hRec, vaqDomain, &pwzData);
+            ExitOnFailure(hr, "failed to get Wix4User.Domain");
+            hr = ::StringCchCopyW(psu->wzDomain, countof(psu->wzDomain), pwzData);
+            ExitOnFailure(hr, "failed to copy user domain: %ls", pwzData);
+
+            hr = WcaGetRecordFormattedString(hRec, vaqPassword, &pwzData);
+            ExitOnFailure(hr, "failed to get Wix4User.Password");
+            hr = ::StringCchCopyW(psu->wzPassword, countof(psu->wzPassword), pwzData);
+            ExitOnFailure(hr, "failed to copy user password");
+
+            hr = WcaGetRecordInteger(hRec, vaqAttributes, &psu->iAttributes);
+            ExitOnFailure(hr, "failed to get Wix4User.Attributes");
+
+            // Check if this user is to be added to any groups
+            if (fUserGroupExists)
+            {
+                hUserRec = ::MsiCreateRecord(1);
+                hr = WcaSetRecordString(hUserRec, 1, psu->wzKey);
+                ExitOnFailure(hr, "Failed to create user record for querying Wix4UserGroup table");
+
+                hr = WcaOpenView(vcsUserGroupQuery, &hUserGroupView);
+                ExitOnFailure(hr, "Failed to open view on Wix4UserGroup table for user %ls", psu->wzKey);
+                hr = WcaExecuteView(hUserGroupView, hUserRec);
+                ExitOnFailure(hr, "Failed to execute view on Wix4UserGroup table for user: %ls", psu->wzKey);
+
+                while (S_OK == (hr = WcaFetchRecord(hUserGroupView, &hRec)))
+                {
+                    hr = WcaGetRecordString(hRec, vugqGroup, &pwzData);
+                    ExitOnFailure(hr, "failed to get Wix4UserGroup.Group");
+
+                    hr = AddGroupToList(&(psu->psgGroups));
+                    ExitOnFailure(hr, "failed to add group to list");
+
+                    hr = ScaGetGroup(pwzData, psu->psgGroups);
+                    ExitOnFailure(hr, "failed to get information for group: %ls", pwzData);
+                }
+
+                if (E_NOMOREITEMS == hr)
+                {
+                    hr = S_OK;
+                }
+                ExitOnFailure(hr, "failed to enumerate selected rows from Wix4UserGroup table");
+            }
+        }
+    }
+
+    if (E_NOMOREITEMS == hr)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "failed to enumerate selected rows from Wix4User table");
+
+LExit:
+    ReleaseStr(pwzData);
+
+    return hr;
+}
+
+
+static HRESULT WriteGroupInfo(
+    __in SCA_GROUP* psgList,
+    __in LPWSTR *ppwzActionData
+    )
+{
+    HRESULT hr = S_OK;
+
+    for (SCA_GROUP* psg = psgList; psg; psg = psg->psgNext)
+    {
+        hr = WcaWriteStringToCaData(psg->wzName, ppwzActionData);
+        ExitOnFailure(hr, "failed to add group name to custom action data: %ls", psg->wzName);
+
+        hr = WcaWriteStringToCaData(psg->wzDomain, ppwzActionData);
+        ExitOnFailure(hr, "failed to add group domain to custom action data: %ls", psg->wzDomain);
+    }
+
+LExit:
+    return hr;
+}
+
+
+// Behaves like WriteGroupInfo, but it filters out groups the user is currently a member of,
+// because we don't want to rollback those
+static HRESULT WriteGroupRollbackInfo(
+    __in LPCWSTR pwzName,
+    __in LPCWSTR pwzDomain,
+    __in SCA_GROUP* psgList,
+    __in LPWSTR *ppwzActionData
+    )
+{
+    HRESULT hr = S_OK;
+    BOOL fIsMember = FALSE;
+
+    for (SCA_GROUP* psg = psgList; psg; psg = psg->psgNext)
+    {
+        hr = UserCheckIsMember(pwzName, pwzDomain, psg->wzName, psg->wzDomain, &fIsMember);
+        if (FAILED(hr))
+        {
+            WcaLog(LOGMSG_VERBOSE, "Failed to check if user: %ls (domain: %ls) is member of a group while collecting rollback information (error code 0x%x) - continuing", pwzName, pwzDomain, hr);
+            hr = S_OK;
+            continue;
+        }
+
+        // If the user is currently a member, we don't want to undo that on rollback, so skip adding
+        // this group record to the list of groups to rollback
+        if (fIsMember)
+        {
+            continue;
+        }
+
+        hr = WcaWriteStringToCaData(psg->wzName, ppwzActionData);
+        ExitOnFailure(hr, "failed to add group name to custom action data: %ls", psg->wzName);
+
+        hr = WcaWriteStringToCaData(psg->wzDomain, ppwzActionData);
+        ExitOnFailure(hr, "failed to add group domain to custom action data: %ls", psg->wzDomain);
+    }
+
+LExit:
+    return hr;
+}
+
+
+/* ****************************************************************
+ScaUserExecute - Schedules user account creation or removal based on
+component state.
+
+******************************************************************/
+HRESULT ScaUserExecute(
+    __in SCA_USER *psuList
+    )
+{
+    HRESULT hr = S_OK;
+    DWORD er = 0;
+    PDOMAIN_CONTROLLER_INFOW pDomainControllerInfo = NULL;
+
+    LPWSTR pwzBaseScriptKey = NULL;
+    DWORD cScriptKey = 0;
+
+    USER_INFO_0 *pUserInfo = NULL;
+    LPWSTR pwzScriptKey = NULL;
+    LPWSTR pwzActionData = NULL;
+    LPWSTR pwzRollbackData = NULL;
+
+    // Get the base script key for this CustomAction.
+    hr = WcaCaScriptCreateKey(&pwzBaseScriptKey);
+    ExitOnFailure(hr, "Failed to get encoding key.");
+
+    // Loop through all the users to be configured.
+    for (SCA_USER *psu = psuList; psu; psu = psu->psuNext)
+    {
+        USER_EXISTS ueUserExists = USER_EXISTS_INDETERMINATE;
+
+        // Always put the User Name and Domain plus Attributes on the front of the CustomAction
+        // data.  Sometimes we'll add more data.
+        Assert(psu->wzName);
+        hr = WcaWriteStringToCaData(psu->wzName, &pwzActionData);
+        ExitOnFailure(hr, "Failed to add user name to custom action data: %ls", psu->wzName);
+        hr = WcaWriteStringToCaData(psu->wzDomain, &pwzActionData);
+        ExitOnFailure(hr, "Failed to add user domain to custom action data: %ls", psu->wzDomain);
+        hr = WcaWriteIntegerToCaData(psu->iAttributes, &pwzActionData);
+        ExitOnFailure(hr, "failed to add user attributes to custom action data for user: %ls", psu->wzKey);
+
+        // Check to see if the user already exists since we have to be very careful when adding
+        // and removing users.  Note: MSDN says that it is safe to call these APIs from any
+        // user, so we should be safe calling it during immediate mode.
+        er = ::NetApiBufferAllocate(sizeof(USER_INFO_0), reinterpret_cast<LPVOID*>(&pUserInfo));
+        hr = HRESULT_FROM_WIN32(er);
+        ExitOnFailure(hr, "Failed to allocate memory to check existence of user: %ls", psu->wzName);
+
+        LPCWSTR wzDomain = psu->wzDomain;
+        if (wzDomain && *wzDomain)
+        {
+            er = ::DsGetDcNameW(NULL, wzDomain, NULL, NULL, NULL, &pDomainControllerInfo);
+            if (RPC_S_SERVER_UNAVAILABLE == er)
+            {
+                // MSDN says, if we get the above error code, try again with the "DS_FORCE_REDISCOVERY" flag
+                er = ::DsGetDcNameW(NULL, wzDomain, NULL, NULL, DS_FORCE_REDISCOVERY, &pDomainControllerInfo);
+            }
+            if (ERROR_SUCCESS == er)
+            {
+                wzDomain = pDomainControllerInfo->DomainControllerName + 2;  //Add 2 so that we don't get the \\ prefix
+            }
+        }
+
+        er = ::NetUserGetInfo(wzDomain, psu->wzName, 0, reinterpret_cast<LPBYTE*>(pUserInfo));
+        if (NERR_Success == er)
+        {
+            ueUserExists = USER_EXISTS_YES;
+        }
+        else if (NERR_UserNotFound == er)
+        {
+            ueUserExists = USER_EXISTS_NO;
+        }
+        else
+        {
+            ueUserExists = USER_EXISTS_INDETERMINATE;
+            hr = HRESULT_FROM_WIN32(er);
+            WcaLog(LOGMSG_VERBOSE, "Failed to check existence of domain: %ls, user: %ls (error code 0x%x) - continuing", wzDomain, psu->wzName, hr);
+            hr = S_OK;
+            er = ERROR_SUCCESS;
+        }
+
+        if (WcaIsInstalling(psu->isInstalled, psu->isAction))
+        {
+            // If the user exists, check to see if we are supposed to fail if user the exists before
+            // the install.
+            if (USER_EXISTS_YES == ueUserExists)
+            {
+                // Reinstalls will always fail if we don't remove the check for "fail if exists".
+                if (WcaIsReInstalling(psu->isInstalled, psu->isAction))
+                {
+                    psu->iAttributes &= ~SCAU_FAIL_IF_EXISTS;
+                }
+
+                if ((SCAU_FAIL_IF_EXISTS & (psu->iAttributes)) && !(SCAU_UPDATE_IF_EXISTS & (psu->iAttributes)))
+                {
+                    hr = HRESULT_FROM_WIN32(NERR_UserExists);
+                    MessageExitOnFailure(hr, msierrUSRFailedUserCreateExists, "Failed to create user: %ls because user already exists.", psu->wzName);
+                }
+            }
+
+            // Rollback only if the user already exists, we couldn't determine if the user exists, or we are going to create the user
+            if ((USER_EXISTS_YES == ueUserExists) || (USER_EXISTS_INDETERMINATE == ueUserExists) || !(psu->iAttributes & SCAU_DONT_CREATE_USER))
+            {
+                ++cScriptKey;
+                hr = StrAllocFormatted(&pwzScriptKey, L"%ls%u", pwzBaseScriptKey, cScriptKey);
+                ExitOnFailure(hr, "Failed to create encoding key.");
+
+                // Write the script key to CustomActionData for install and rollback so information can be passed to rollback.
+                hr = WcaWriteStringToCaData(pwzScriptKey, &pwzActionData);
+                ExitOnFailure(hr, "Failed to add encoding key to custom action data.");
+
+                hr = WcaWriteStringToCaData(pwzScriptKey, &pwzRollbackData);
+                ExitOnFailure(hr, "Failed to add encoding key to rollback custom action data.");
+
+                INT iRollbackUserAttributes = psu->iAttributes;
+
+                // If the user already exists, ensure this is accounted for in rollback
+                if (USER_EXISTS_YES == ueUserExists)
+                {
+                    iRollbackUserAttributes |= SCAU_DONT_CREATE_USER;
+                }
+                else
+                {
+                    iRollbackUserAttributes &= ~SCAU_DONT_CREATE_USER;
+                }
+
+                // The deferred CA determines when to rollback User Rights Assignments so these should never be set.
+                iRollbackUserAttributes &= ~SCAU_ALLOW_LOGON_AS_SERVICE;
+                iRollbackUserAttributes &= ~SCAU_ALLOW_LOGON_AS_BATCH;
+
+                hr = WcaWriteStringToCaData(psu->wzName, &pwzRollbackData);
+                ExitOnFailure(hr, "Failed to add user name to rollback custom action data: %ls", psu->wzName);
+                hr = WcaWriteStringToCaData(psu->wzDomain, &pwzRollbackData);
+                ExitOnFailure(hr, "Failed to add user domain to rollback custom action data: %ls", psu->wzDomain);
+                hr = WcaWriteIntegerToCaData(iRollbackUserAttributes, &pwzRollbackData);
+                ExitOnFailure(hr, "failed to add user attributes to rollback custom action data for user: %ls", psu->wzKey);
+
+                // If the user already exists, add relevant group information to rollback data
+                if (USER_EXISTS_YES == ueUserExists || USER_EXISTS_INDETERMINATE == ueUserExists)
+                {
+                    hr = WriteGroupRollbackInfo(psu->wzName, psu->wzDomain, psu->psgGroups, &pwzRollbackData);
+                    ExitOnFailure(hr, "failed to add group information to rollback custom action data");
+                }
+
+                hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"CreateUserRollback"), pwzRollbackData, COST_USER_DELETE);
+                ExitOnFailure(hr, "failed to schedule CreateUserRollback");
+            }
+            else
+            {
+                // Write empty script key to CustomActionData since there is no rollback.
+                hr = WcaWriteStringToCaData(L"", &pwzActionData);
+                ExitOnFailure(hr, "Failed to add empty encoding key to custom action data.");
+            }
+
+            //
+            // Schedule the creation now.
+            //
+            hr = WcaWriteStringToCaData(psu->wzPassword, &pwzActionData);
+            ExitOnFailure(hr, "failed to add user password to custom action data for user: %ls", psu->wzKey);
+
+            // Add user's group information to custom action data
+            hr = WriteGroupInfo(psu->psgGroups, &pwzActionData);
+            ExitOnFailure(hr, "failed to add group information to custom action data");
+
+            hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"CreateUser"), pwzActionData, COST_USER_ADD);
+            ExitOnFailure(hr, "failed to schedule CreateUser");
+        }
+        else if (((USER_EXISTS_YES == ueUserExists) || (USER_EXISTS_INDETERMINATE == ueUserExists)) && WcaIsUninstalling(psu->isInstalled, psu->isAction) && !(psu->iAttributes & SCAU_DONT_REMOVE_ON_UNINSTALL))
+        {
+            // Add user's group information - this will ensure the user can be removed from any groups they were added to, if the user isn't be deleted
+            hr = WriteGroupInfo(psu->psgGroups, &pwzActionData);
+            ExitOnFailure(hr, "failed to add group information to custom action data");
+
+            //
+            // Schedule the removal because the user exists and we don't have any flags set
+            // that say, don't remove the user on uninstall.
+            //
+            // Note: We can't rollback the removal of a user which is why RemoveUser is a commit
+            // CustomAction.
+            hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"RemoveUser"), pwzActionData, COST_USER_DELETE);
+            ExitOnFailure(hr, "failed to schedule RemoveUser");
+        }
+
+        ReleaseNullStr(pwzScriptKey);
+        ReleaseNullStr(pwzActionData);
+        ReleaseNullStr(pwzRollbackData);
+        if (pUserInfo)
+        {
+            ::NetApiBufferFree(static_cast<LPVOID>(pUserInfo));
+            pUserInfo = NULL;
+        }
+        if (pDomainControllerInfo)
+        {
+            ::NetApiBufferFree(static_cast<LPVOID>(pDomainControllerInfo));
+            pDomainControllerInfo = NULL;
+        }
+    }
+
+LExit:
+    ReleaseStr(pwzBaseScriptKey);
+    ReleaseStr(pwzScriptKey);
+    ReleaseStr(pwzActionData);
+    ReleaseStr(pwzRollbackData);
+    if (pUserInfo)
+    {
+        ::NetApiBufferFree(static_cast<LPVOID>(pUserInfo));
+    }
+    if (pDomainControllerInfo)
+    {
+        ::NetApiBufferFree(static_cast<LPVOID>(pDomainControllerInfo));
+    }
+
+    return hr;
+}
+
+
+static HRESULT AddUserToList(
+    __inout SCA_USER** ppsuList
+    )
+{
+    HRESULT hr = S_OK;
+    SCA_USER* psu = static_cast<SCA_USER*>(MemAlloc(sizeof(SCA_USER), TRUE));
+    ExitOnNull(psu, hr, E_OUTOFMEMORY, "failed to allocate memory for new user list element");
+
+    psu->psuNext = *ppsuList;
+    *ppsuList = psu;
+
+LExit:
+    return hr;
+}
+
+
+static HRESULT AddGroupToList(
+    __inout SCA_GROUP** ppsgList
+    )
+{
+    HRESULT hr = S_OK;
+    SCA_GROUP* psg = static_cast<SCA_GROUP*>(MemAlloc(sizeof(SCA_GROUP), TRUE));
+    ExitOnNull(psg, hr, E_OUTOFMEMORY, "failed to allocate memory for new group list element");
+
+    psg->psgNext = *ppsgList;
+    *ppsgList = psg;
+
+LExit:
+    return hr;
+}
diff --git a/src/ext/Util/ca/scauser.h b/src/ext/Util/ca/scauser.h
new file mode 100644
index 00000000..a5fd5ea8
--- /dev/null
+++ b/src/ext/Util/ca/scauser.h
@@ -0,0 +1,67 @@
+#pragma once
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+enum USER_EXISTS
+{
+    USER_EXISTS_YES,
+    USER_EXISTS_NO,
+    USER_EXISTS_INDETERMINATE
+};
+
+// structs
+struct SCA_GROUP
+{
+    WCHAR wzKey[MAX_DARWIN_KEY + 1];
+    WCHAR wzComponent[MAX_DARWIN_KEY + 1];
+
+    WCHAR wzDomain[MAX_DARWIN_COLUMN + 1];
+    WCHAR wzName[MAX_DARWIN_COLUMN + 1];
+
+    SCA_GROUP *psgNext;
+};
+
+struct SCA_USER
+{
+    WCHAR wzKey[MAX_DARWIN_KEY + 1];
+    WCHAR wzComponent[MAX_DARWIN_KEY + 1];
+    INSTALLSTATE isInstalled;
+    INSTALLSTATE isAction;
+
+    WCHAR wzDomain[MAX_DARWIN_COLUMN + 1];
+    WCHAR wzName[MAX_DARWIN_COLUMN + 1];
+    WCHAR wzPassword[MAX_DARWIN_COLUMN + 1];
+    INT iAttributes;
+
+    SCA_GROUP *psgGroups;
+
+    SCA_USER *psuNext;
+};
+
+
+// prototypes
+HRESULT __stdcall ScaGetUser(
+    __in LPCWSTR wzUser, 
+    __out SCA_USER* pscau
+    );
+HRESULT __stdcall ScaGetUserDeferred(
+    __in LPCWSTR wzUser, 
+    __in WCA_WRAPQUERY_HANDLE hUserQuery,
+    __out SCA_USER* pscau
+    );
+HRESULT __stdcall ScaGetGroup(
+    __in LPCWSTR wzGroup, 
+    __out SCA_GROUP* pscag
+    );
+void ScaUserFreeList(
+    __in SCA_USER* psuList
+    );
+void ScaGroupFreeList(
+    __in SCA_GROUP* psgList
+    );
+HRESULT ScaUserRead(
+    __inout SCA_USER** ppsuList
+    );
+HRESULT ScaUserExecute(
+    __in SCA_USER *psuList
+    );
diff --git a/src/ext/Util/ca/secureobj.cpp b/src/ext/Util/ca/secureobj.cpp
new file mode 100644
index 00000000..72842eb5
--- /dev/null
+++ b/src/ext/Util/ca/secureobj.cpp
@@ -0,0 +1,915 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+// structs
+LPCWSTR wzQUERY_SECUREOBJECTS = L"SELECT `Wix4SecureObject`.`Wix4SecureObject`, `Wix4SecureObject`.`Table`, `Wix4SecureObject`.`Domain`, `Wix4SecureObject`.`User`, `Wix4SecureObject`.`Attributes`, "
+                                L"`Wix4SecureObject`.`Permission`, `Wix4SecureObject`.`Component_`, `Component`.`Attributes` FROM `Wix4SecureObject`,`Component` WHERE "
+                                L"`Wix4SecureObject`.`Component_`=`Component`.`Component`";
+enum eQUERY_SECUREOBJECTS { QSO_SECUREOBJECT = 1, QSO_TABLE, QSO_DOMAIN, QSO_USER, QSO_ATTRIBUTES, QSO_PERMISSION, QSO_COMPONENT, QSO_COMPATTRIBUTES };
+
+LPCWSTR wzQUERY_REGISTRY = L"SELECT `Registry`.`Registry`, `Registry`.`Root`, `Registry`.`Key` FROM `Registry` WHERE `Registry`.`Registry`=?";
+enum eQUERY_OBJECTCOMPONENT { QSOC_REGISTRY = 1, QSOC_REGROOT, QSOC_REGKEY };
+
+LPCWSTR wzQUERY_SERVICEINSTALL = L"SELECT `ServiceInstall`.`Name` FROM `ServiceInstall` WHERE `ServiceInstall`.`ServiceInstall`=?";
+enum eQUERY_SECURESERVICEINSTALL { QSSI_NAME = 1 };
+
+enum eOBJECTTYPE { OT_UNKNOWN, OT_SERVICE, OT_FOLDER, OT_FILE, OT_REGISTRY };
+
+enum eSECURE_OBJECT_ATTRIBUTE
+{
+    SECURE_OBJECT_ATTRIBUTE_INHERITABLE = 0x1,
+};
+
+static eOBJECTTYPE EObjectTypeFromString(
+    __in LPCWSTR pwzTable
+    )
+{
+    if (NULL == pwzTable)
+    {
+        return OT_UNKNOWN;
+    }
+
+    eOBJECTTYPE eType = OT_UNKNOWN;
+
+    // ensure we're looking at a known table
+    if (0 == lstrcmpW(L"ServiceInstall", pwzTable))
+    {
+        eType = OT_SERVICE;
+    }
+    else if (0 == lstrcmpW(L"CreateFolder", pwzTable))
+    {
+        eType = OT_FOLDER;
+    }
+    else if (0 == lstrcmpW(L"File", pwzTable))
+    {
+        eType = OT_FILE;
+    }
+    else if (0 == lstrcmpW(L"Registry", pwzTable))
+    {
+        eType = OT_REGISTRY;
+    }
+
+    return eType;
+}
+
+static SE_OBJECT_TYPE SEObjectTypeFromString(
+    __in LPCWSTR pwzTable
+    )
+{
+    if (NULL == pwzTable)
+    {
+        return SE_UNKNOWN_OBJECT_TYPE;
+    }
+
+    SE_OBJECT_TYPE objectType = SE_UNKNOWN_OBJECT_TYPE;
+
+    if (0 == lstrcmpW(L"ServiceInstall", pwzTable))
+    {
+        objectType = SE_SERVICE;
+    }
+    else if (0 == lstrcmpW(L"CreateFolder", pwzTable) || 0 == lstrcmpW(L"File", pwzTable))
+    {
+        objectType = SE_FILE_OBJECT;
+    }
+    else if (0 == lstrcmpW(L"Registry", pwzTable))
+    {
+        objectType = SE_REGISTRY_KEY;
+    }
+    else
+    {
+        // Do nothing; we'll return SE_UNKNOWN_OBJECT_TYPE, and the caller should handle the situation
+    }
+
+    return objectType;
+}
+
+static HRESULT StoreACLRollbackInfo(
+    __in LPWSTR pwzObject,
+    __in LPCWSTR pwzTable
+    )
+{
+    HRESULT hr = S_OK;
+    DWORD er = ERROR_SUCCESS;
+    PSECURITY_DESCRIPTOR psd = NULL;
+    SECURITY_DESCRIPTOR_CONTROL sdc = {0};
+    DWORD dwRevision = 0;
+    LPWSTR pwzCustomActionData = NULL;
+    LPWSTR pwzSecurityInfo = NULL;
+    
+    Assert(pwzObject && pwzTable);
+
+    SE_OBJECT_TYPE objectType = SEObjectTypeFromString(const_cast<LPCWSTR> (pwzTable));
+
+    if (SE_UNKNOWN_OBJECT_TYPE != objectType)
+    {
+        er = ::GetNamedSecurityInfoW(pwzObject, objectType, DACL_SECURITY_INFORMATION, NULL, NULL, NULL, NULL, &psd);
+        if (ERROR_FILE_NOT_FOUND == er || ERROR_PATH_NOT_FOUND == er || ERROR_SERVICE_DOES_NOT_EXIST == HRESULT_CODE(er))
+        {
+            // If the file, path or service doesn't exist yet, skip rollback without a message
+            hr = HRESULT_FROM_WIN32(er);
+            ExitFunction();
+        }
+
+        ExitOnFailure(hr = HRESULT_FROM_WIN32(er), "Unable to schedule rollback for object: %ls", pwzObject);
+
+        //Need to see if DACL is protected so getting Descriptor information
+        if (!::GetSecurityDescriptorControl(psd, &sdc, &dwRevision))
+        {
+            ExitOnLastError(hr, "Unable to schedule rollback for object (failed to get security descriptor control): %ls", pwzObject);
+        }
+
+        // Convert the security information to a string, and write this to the custom action data
+        if (!::ConvertSecurityDescriptorToStringSecurityDescriptorW(psd,SDDL_REVISION_1,DACL_SECURITY_INFORMATION,&pwzSecurityInfo,NULL))
+        {
+            hr = E_UNEXPECTED;
+            ExitOnFailure(hr, "Unable to schedule rollback for object (failed to convert security descriptor to a valid security descriptor string): %ls", pwzObject);
+        }
+
+        hr = WcaWriteStringToCaData(pwzObject, &pwzCustomActionData);
+        ExitOnFailure(hr, "failed to add object data to rollback CustomActionData");
+
+        hr = WcaWriteStringToCaData(pwzTable, &pwzCustomActionData);
+        ExitOnFailure(hr, "failed to add table name to rollback CustomActionData");
+
+        hr = WcaWriteStringToCaData(pwzSecurityInfo, &pwzCustomActionData);
+        ExitOnFailure(hr, "failed to add security info data to rollback CustomActionData");
+
+        // Write a 1 if DACL is protected, 0 otherwise
+        if (sdc & SE_DACL_PROTECTED)
+        {
+            hr = WcaWriteIntegerToCaData(1,&pwzCustomActionData);
+            ExitOnFailure(hr, "failed to add data to rollbackCustomActionData");
+        }
+        else
+        {
+            hr = WcaWriteIntegerToCaData(0,&pwzCustomActionData);
+            ExitOnFailure(hr, "failed to add data to rollback CustomActionData");
+        }
+
+        hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"ExecSecureObjectsRollback"), pwzCustomActionData, COST_SECUREOBJECT);
+        ExitOnFailure(hr, "failed to schedule ExecSecureObjectsRollback for item: %ls of type: %ls", pwzObject, pwzTable);
+
+        ReleaseStr(pwzCustomActionData);
+        pwzCustomActionData = NULL;
+
+    }
+    else
+    {
+        MessageExitOnFailure(hr = E_UNEXPECTED, msierrSecureObjectsUnknownType, "unknown object type: %ls", pwzTable);
+    }
+LExit:
+    ReleaseStr(pwzCustomActionData);
+
+    if (psd)
+    {
+        ::LocalFree(psd);
+    }
+
+    return hr;
+}
+
+static HRESULT GetTargetPath(
+    __in eOBJECTTYPE eType,
+    __in LPCWSTR pwzSecureObject,
+    __out LPWSTR* ppwzTargetPath
+    )
+{
+    HRESULT hr = S_OK;
+
+    PMSIHANDLE hView = NULL;
+    PMSIHANDLE hRecObject = NULL;
+    PMSIHANDLE hRec = NULL;
+
+    int iRoot = 0;
+    int iAllUsers = 0;
+    LPWSTR pwzKey = NULL;
+    LPWSTR pwzFormattedString = NULL;
+
+    if (OT_SERVICE == eType)
+    {
+        hr = WcaTableExists(L"ServiceInstall");
+        if (S_FALSE == hr)
+        {
+            hr = E_UNEXPECTED;
+        }
+        ExitOnFailure(hr, "failed to open ServiceInstall table to secure object");
+
+        hr = WcaOpenView(wzQUERY_SERVICEINSTALL, &hView);
+        ExitOnFailure(hr, "failed to open view on ServiceInstall table");
+
+        // create a record that stores the object to secure
+        hRec = MsiCreateRecord(1);
+        MsiRecordSetStringW(hRec, 1, pwzSecureObject);
+
+        // execute a view looking for the object's ServiceInstall.ServiceInstall row.
+        hr = WcaExecuteView(hView, hRec);
+        ExitOnFailure(hr, "failed to execute view on ServiceInstall table");
+        hr = WcaFetchSingleRecord(hView, &hRecObject);
+        ExitOnFailure(hr, "failed to fetch ServiceInstall row for secure object");
+
+        hr = WcaGetRecordFormattedString(hRecObject, QSSI_NAME, ppwzTargetPath);
+        ExitOnFailure(hr, "failed to get service name for secure object: %ls", pwzSecureObject);
+    }
+    else if (OT_FOLDER == eType)
+    {
+        hr = WcaGetTargetPath(pwzSecureObject, ppwzTargetPath);
+        ExitOnFailure(hr, "failed to get target path for directory id: %ls", pwzSecureObject);
+    }
+    else if (OT_FILE == eType)
+    {
+        hr = StrAllocFormatted(&pwzFormattedString, L"[#%s]", pwzSecureObject);
+        ExitOnFailure(hr, "failed to create formatted string for securing file object: %ls", pwzSecureObject);
+
+        hr = WcaGetFormattedString(pwzFormattedString, ppwzTargetPath);
+        ExitOnFailure(hr, "failed to get file path from formatted string: %ls for secure object: %ls", pwzFormattedString, pwzSecureObject);
+    }
+    else if (OT_REGISTRY == eType)
+    {
+        hr = WcaTableExists(L"Registry");
+        if (S_FALSE == hr)
+        {
+            hr = E_UNEXPECTED;
+        }
+        ExitOnFailure(hr, "failed to open Registry table to secure object");
+
+        hr = WcaOpenView(wzQUERY_REGISTRY, &hView);
+        ExitOnFailure(hr, "failed to open view on Registry table");
+
+        // create a record that stores the object to secure
+        hRec = MsiCreateRecord(1);
+        MsiRecordSetStringW(hRec, 1, pwzSecureObject);
+
+        // execute a view looking for the object's Registry row
+        hr = WcaExecuteView(hView, hRec);
+        ExitOnFailure(hr, "failed to execute view on Registry table");
+        hr = WcaFetchSingleRecord(hView, &hRecObject);
+        ExitOnFailure(hr, "failed to fetch Registry row for secure object");
+
+        hr = WcaGetRecordInteger(hRecObject, QSOC_REGROOT, &iRoot);
+        ExitOnFailure(hr, "Failed to get reg key root for secure object: %ls", pwzSecureObject);
+
+        hr = WcaGetRecordFormattedString(hRecObject, QSOC_REGKEY, &pwzKey);
+        ExitOnFailure(hr, "Failed to get reg key for secure object: %ls", pwzSecureObject);
+
+        // Decode the root value
+        if (-1 == iRoot)
+        {
+            // They didn't specify a root so that means it's either HKCU or HKLM depending on ALLUSERS property
+            hr = WcaGetIntProperty(L"ALLUSERS", &iAllUsers);
+            ExitOnFailure(hr, "failed to get value of ALLUSERS property");
+
+            if (1 == iAllUsers)
+            {
+                hr = StrAllocString(ppwzTargetPath, L"MACHINE\\", 0);
+                ExitOnFailure(hr, "failed to allocate target registry string with HKLM root");
+            }
+            else
+            {
+                hr = StrAllocString(ppwzTargetPath, L"CURRENT_USER\\", 0);
+                ExitOnFailure(hr, "failed to allocate target registry string with HKCU root");
+            }
+        }
+        else if (msidbRegistryRootClassesRoot == iRoot)
+        {
+            hr = StrAllocString(ppwzTargetPath, L"CLASSES_ROOT\\", 0);
+            ExitOnFailure(hr, "failed to allocate target registry string with HKCR root");
+        }
+        else if (msidbRegistryRootCurrentUser == iRoot)
+        {
+            hr = StrAllocString(ppwzTargetPath, L"CURRENT_USER\\", 0);
+            ExitOnFailure(hr, "failed to allocate target registry string with HKCU root");
+        }
+        else if (msidbRegistryRootLocalMachine == iRoot)
+        {
+            hr = StrAllocString(ppwzTargetPath, L"MACHINE\\", 0);
+            ExitOnFailure(hr, "failed to allocate target registry string with HKLM root");
+        }
+        else if (msidbRegistryRootUsers == iRoot)
+        {
+            hr = StrAllocString(ppwzTargetPath, L"USERS\\", 0);
+            ExitOnFailure(hr, "failed to allocate target registry string with HKU root");
+        }
+        else
+        {
+            ExitOnFailure(hr = E_UNEXPECTED, "Unknown registry key root specified for secure object: '%ls' root: %d", pwzSecureObject, iRoot);
+        }
+        
+        hr = StrAllocConcat(ppwzTargetPath, pwzKey, 0);
+        ExitOnFailure(hr, "Failed to concat key: %ls for secure object: %ls", pwzKey, pwzSecureObject);
+    }
+    else
+    {
+        AssertSz(FALSE, "How did you get here?");
+        ExitOnFailure(hr = E_UNEXPECTED, "Unknown secure object type: %d", eType);
+    }
+
+LExit:
+    ReleaseStr(pwzFormattedString);
+    ReleaseStr(pwzKey);
+
+    return hr;
+}
+
+/******************************************************************
+ SchedSecureObjects - entry point for SchedSecureObjects Custom Action
+
+ called as Type 1 CustomAction (binary DLL) from Windows Installer 
+ in InstallExecuteSequence, to schedule ExecSecureObjects
+******************************************************************/
+extern "C" UINT __stdcall SchedSecureObjects(
+    __in MSIHANDLE hInstall
+    )
+{
+//    AssertSz(FALSE, "debug SchedSecureObjects");
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    LPWSTR pwzSecureObject = NULL;
+    LPWSTR pwzData = NULL;
+    LPWSTR pwzTable = NULL;
+    LPWSTR pwzTargetPath = NULL;
+
+    PMSIHANDLE hView = NULL;
+    PMSIHANDLE hRec = NULL;
+
+    INSTALLSTATE isInstalled;
+    INSTALLSTATE isAction;
+
+    LPWSTR pwzCustomActionData = NULL;
+
+    DWORD cObjects = 0;
+    eOBJECTTYPE eType = OT_UNKNOWN;
+    DWORD dwAttributes = 0;
+
+    //
+    // initialize
+    //
+    hr = WcaInitialize(hInstall, "SchedSecureObjects");
+    ExitOnFailure(hr, "failed to initialize");
+
+    // anything to do?
+    if (S_OK != WcaTableExists(L"Wix4SecureObject"))
+    {
+        WcaLog(LOGMSG_STANDARD, "Wix4SecureObject table doesn't exist, so there are no objects to secure.");
+        ExitFunction();
+    }
+
+    //
+    // loop through all the objects to be secured
+    //
+    hr = WcaOpenExecuteView(wzQUERY_SECUREOBJECTS, &hView);
+    ExitOnFailure(hr, "failed to open view on Wix4SecureObject table");
+    while (S_OK == (hr = WcaFetchRecord(hView, &hRec)))
+    {
+        hr = WcaGetRecordString(hRec, QSO_TABLE, &pwzTable);
+        ExitOnFailure(hr, "failed to get object table");
+
+        eType = EObjectTypeFromString(pwzTable);
+
+        if (OT_UNKNOWN == eType)
+        {
+            ExitOnFailure(hr = E_INVALIDARG, "unknown SecureObject.Table: %ls", pwzTable);
+        }
+
+        int iCompAttributes = 0;
+        hr = WcaGetRecordInteger(hRec, QSO_COMPATTRIBUTES, &iCompAttributes);
+        ExitOnFailure(hr, "failed to get Component attributes for secure object");
+
+        BOOL fIs64Bit = iCompAttributes & msidbComponentAttributes64bit;
+
+        // Only process entries in the Wix4SecureObject table whose components match the bitness of this CA
+#ifdef _WIN64
+        if (!fIs64Bit)
+        {
+            continue;
+        }
+#else
+        if (fIs64Bit)
+        {
+            continue;
+        }
+#endif
+
+        // Get the object to secure
+        hr = WcaGetRecordString(hRec, QSO_SECUREOBJECT, &pwzSecureObject);
+        ExitOnFailure(hr, "failed to get name of object");
+
+        hr = GetTargetPath(eType, pwzSecureObject, &pwzTargetPath);
+        ExitOnFailure(hr, "failed to get target path of object '%ls'", pwzSecureObject);
+
+        hr = WcaGetRecordString(hRec, QSO_COMPONENT, &pwzData);
+        ExitOnFailure(hr, "failed to get Component name for secure object");
+
+        //
+        // if we are installing this Component
+        //
+        er = ::MsiGetComponentStateW(hInstall, pwzData, &isInstalled, &isAction);
+        ExitOnFailure(hr = HRESULT_FROM_WIN32(er), "failed to get install state for Component: %ls", pwzData);
+
+        if (WcaIsInstalling(isInstalled, isAction))
+        {
+            hr = WcaWriteStringToCaData(pwzTargetPath, &pwzCustomActionData);
+            ExitOnFailure(hr, "failed to add data to CustomActionData");
+
+            // add the data to the CustomActionData
+            hr = WcaGetRecordString(hRec, QSO_SECUREOBJECT, &pwzData);
+            ExitOnFailure(hr, "failed to get name of object");
+            hr = WcaWriteStringToCaData(pwzTable, &pwzCustomActionData);
+            ExitOnFailure(hr, "failed to add data to CustomActionData");
+
+            hr = WcaGetRecordFormattedString(hRec, QSO_DOMAIN, &pwzData);
+            ExitOnFailure(hr, "failed to get domain for user to configure object");
+            hr = WcaWriteStringToCaData(pwzData, &pwzCustomActionData);
+            ExitOnFailure(hr, "failed to add data to CustomActionData");
+
+            hr = WcaGetRecordFormattedString(hRec, QSO_USER, &pwzData);
+            ExitOnFailure(hr, "failed to get user to configure object");
+            hr = WcaWriteStringToCaData(pwzData, &pwzCustomActionData);
+            ExitOnFailure(hr, "failed to add data to CustomActionData");
+
+            hr = WcaGetRecordInteger(hRec, QSO_ATTRIBUTES, reinterpret_cast<int*>(&dwAttributes));
+            ExitOnFailure(hr, "failed to get attributes to configure object");
+            hr = WcaWriteIntegerToCaData(dwAttributes, &pwzCustomActionData);
+            ExitOnFailure(hr, "failed to add data to CustomActionData");
+
+            hr = WcaGetRecordString(hRec, QSO_PERMISSION, &pwzData);
+            ExitOnFailure(hr, "failed to get permission to configure object");
+            hr = WcaWriteStringToCaData(pwzData, &pwzCustomActionData);
+            ExitOnFailure(hr, "failed to add data to CustomActionData");
+
+            ++cObjects;
+        }
+    }
+
+    // if we looped through all records all is well
+    if (E_NOMOREITEMS == hr)
+        hr = S_OK;
+    ExitOnFailure(hr, "failed while looping through all objects to secure");
+
+    //
+    // schedule the custom action and add to progress bar
+    //
+    if (pwzCustomActionData && *pwzCustomActionData)
+    {
+        Assert(0 < cObjects);
+
+        hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"ExecSecureObjects"), pwzCustomActionData, cObjects * COST_SECUREOBJECT);
+        ExitOnFailure(hr, "failed to schedule ExecSecureObjects action");
+    }
+
+LExit:
+    ReleaseStr(pwzSecureObject);
+    ReleaseStr(pwzCustomActionData);
+    ReleaseStr(pwzData);
+    ReleaseStr(pwzTable);
+    ReleaseStr(pwzTargetPath);
+
+    if (FAILED(hr))
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+    return WcaFinalize(er);
+}
+
+/******************************************************************
+ SchedSecureObjectsRollback - entry point for SchedSecureObjectsRollback Custom Action
+
+ called as Type 1 CustomAction (binary DLL) from Windows Installer 
+ in InstallExecuteSequence before SchedSecureObjects
+******************************************************************/
+extern "C" UINT __stdcall SchedSecureObjectsRollback(
+    __in MSIHANDLE hInstall
+    )
+{
+//    AssertSz(FALSE, "debug SchedSecureObjectsRollback");
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    LPWSTR pwzSecureObject = NULL;
+    LPWSTR pwzTable = NULL;
+    LPWSTR pwzTargetPath = NULL;
+
+    PMSIHANDLE hView = NULL;
+    PMSIHANDLE hRec = NULL;
+
+    LPWSTR pwzCustomActionData = NULL;
+
+    eOBJECTTYPE eType = OT_UNKNOWN;
+
+    //
+    // initialize
+    //
+    hr = WcaInitialize(hInstall, "SchedSecureObjectsRollback");
+    ExitOnFailure(hr, "failed to initialize");
+
+    //
+    // loop through all the objects to be secured
+    //
+    hr = WcaOpenExecuteView(wzQUERY_SECUREOBJECTS, &hView);
+    ExitOnFailure(hr, "failed to open view on Wix4SecureObject table");
+    while (S_OK == (hr = WcaFetchRecord(hView, &hRec)))
+    {
+        hr = WcaGetRecordString(hRec, QSO_TABLE, &pwzTable);
+        ExitOnFailure(hr, "failed to get object table");
+
+        eType = EObjectTypeFromString(pwzTable);
+
+        if (OT_UNKNOWN == eType)
+        {
+            ExitOnFailure(hr = E_INVALIDARG, "unknown SecureObject.Table: %ls", pwzTable);
+        }
+
+        int iCompAttributes = 0;
+        hr = WcaGetRecordInteger(hRec, QSO_COMPATTRIBUTES, &iCompAttributes);
+        ExitOnFailure(hr, "failed to get Component attributes for secure object");
+
+        BOOL fIs64Bit = iCompAttributes & msidbComponentAttributes64bit;
+
+        // Only process entries in the Wix4SecureObject table whose components match the bitness of this CA
+#ifdef _WIN64
+        if (!fIs64Bit)
+        {
+            continue;
+        }
+#else
+        if (fIs64Bit)
+        {
+            continue;
+        }
+#endif
+
+        // get the object being secured that we are planning to schedule rollback for
+        hr = WcaGetRecordString(hRec, QSO_SECUREOBJECT, &pwzSecureObject);
+        ExitOnFailure(hr, "failed to get name of object");
+
+        hr = GetTargetPath(eType, pwzSecureObject, &pwzTargetPath);
+        ExitOnFailure(hr, "failed to get target path of object '%ls' in order to schedule rollback", pwzSecureObject);
+
+        hr = StoreACLRollbackInfo(pwzTargetPath, pwzTable);
+        if (FAILED(hr))
+        {
+            WcaLog(LOGMSG_STANDARD, "Failed to store ACL rollback information with error 0x%x - continuing", hr);
+        }
+    }
+
+    // if we looped through all records all is well
+    if (E_NOMOREITEMS == hr)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "failed while looping through all objects to schedule rollback for");
+
+LExit:
+    ReleaseStr(pwzCustomActionData);
+    ReleaseStr(pwzSecureObject);
+    ReleaseStr(pwzTable);
+    ReleaseStr(pwzTargetPath);
+
+    if (FAILED(hr))
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+    return WcaFinalize(er);
+}
+
+/******************************************************************
+ CaExecSecureObjects - entry point for SecureObjects Custom Action
+                   called as Type 1025 CustomAction (deferred binary DLL)
+
+ NOTE: deferred CustomAction since it modifies the machine
+ NOTE: CustomActionData == wzObject\twzTable\twzDomain\twzUser\tdwAttributes\tdwPermissions\t...
+******************************************************************/
+extern "C" UINT __stdcall ExecSecureObjects(
+    __in MSIHANDLE hInstall
+    )
+{
+//    AssertSz(FALSE, "debug ExecSecureObjects");
+    HRESULT hr = S_OK;
+    DWORD er = ERROR_SUCCESS;
+
+    LPWSTR pwz = NULL;
+    LPWSTR pwzData = NULL;
+    LPWSTR pwzObject = NULL;
+    LPWSTR pwzTable = NULL;
+    LPWSTR pwzDomain = NULL;
+    DWORD dwRevision = 0;
+    LPWSTR pwzUser = NULL;
+    DWORD dwPermissions = 0;
+    DWORD dwAttributes = 0;
+    LPWSTR pwzAccount = NULL;
+    PSID psid = NULL;
+
+    EXPLICIT_ACCESSW ea = {0};
+    SE_OBJECT_TYPE objectType = SE_UNKNOWN_OBJECT_TYPE;
+    PSECURITY_DESCRIPTOR psd = NULL;
+    SECURITY_DESCRIPTOR_CONTROL sdc = {0};
+    SECURITY_INFORMATION si = {0};
+    PACL pAclExisting = NULL;   // doesn't get freed
+    PACL pAclNew = NULL;
+
+    PMSIHANDLE hActionRec = ::MsiCreateRecord(1);
+
+    //
+    // initialize
+    //
+    hr = WcaInitialize(hInstall, "ExecSecureObjects");
+    ExitOnFailure(hr, "failed to initialize");
+
+    hr = WcaGetProperty(L"CustomActionData", &pwzData);
+    ExitOnFailure(hr, "failed to get CustomActionData");
+
+    WcaLog(LOGMSG_TRACEONLY, "CustomActionData: %ls", pwzData);
+
+    pwz = pwzData;
+
+    //
+    // loop through all the passed in data
+    //
+    while (pwz && *pwz)
+    {
+        hr = WcaReadStringFromCaData(&pwz, &pwzObject);
+        ExitOnFailure(hr, "failed to process CustomActionData");
+
+        hr = WcaReadStringFromCaData(&pwz, &pwzTable);
+        ExitOnFailure(hr, "failed to process CustomActionData");
+        hr = WcaReadStringFromCaData(&pwz, &pwzDomain);
+        ExitOnFailure(hr, "failed to process CustomActionData");
+        hr = WcaReadStringFromCaData(&pwz, &pwzUser);
+        ExitOnFailure(hr, "failed to process CustomActionData");
+        hr = WcaReadIntegerFromCaData(&pwz, reinterpret_cast<int*>(&dwAttributes));
+        ExitOnFailure(hr, "failed to process CustomActionData");
+        hr = WcaReadIntegerFromCaData(&pwz, reinterpret_cast<int*>(&dwPermissions));
+        ExitOnFailure(hr, "failed to process CustomActionData");
+
+        WcaLog(LOGMSG_VERBOSE, "Securing Object: %ls Type: %ls User: %ls", pwzObject, pwzTable, pwzUser);
+
+        //
+        // create the appropriate SID
+        //
+
+        // figure out the right user to put into the access block
+        if (!*pwzDomain && 0 == lstrcmpW(pwzUser, L"Everyone"))
+        {
+            hr = AclGetWellKnownSid(WinWorldSid, &psid);
+        }
+        else if (!*pwzDomain && 0 == lstrcmpW(pwzUser, L"Administrators"))
+        {
+            hr = AclGetWellKnownSid(WinBuiltinAdministratorsSid, &psid);
+        }
+        else if (!*pwzDomain && 0 == lstrcmpW(pwzUser, L"LocalSystem"))
+        {
+            hr = AclGetWellKnownSid(WinLocalSystemSid, &psid);
+        }
+        else if (!*pwzDomain && 0 == lstrcmpW(pwzUser, L"LocalService"))
+        {
+            hr = AclGetWellKnownSid(WinLocalServiceSid, &psid);
+        }
+        else if (!*pwzDomain && 0 == lstrcmpW(pwzUser, L"NetworkService"))
+        {
+            hr = AclGetWellKnownSid(WinNetworkServiceSid, &psid);
+        }
+        else if (!*pwzDomain && 0 == lstrcmpW(pwzUser, L"AuthenticatedUser"))
+        {
+            hr = AclGetWellKnownSid(WinAuthenticatedUserSid, &psid);
+        }
+        else if (!*pwzDomain && 0 == lstrcmpW(pwzUser, L"Guests"))
+        {
+            hr = AclGetWellKnownSid(WinBuiltinGuestsSid, &psid);
+        }
+        else if (!*pwzDomain && 0 == lstrcmpW(pwzUser, L"CREATOR OWNER"))
+        {
+            hr = AclGetWellKnownSid(WinCreatorOwnerSid, &psid);
+        }
+        else if (!*pwzDomain && 0 == lstrcmpW(pwzUser, L"INTERACTIVE"))
+        {
+            hr = AclGetWellKnownSid(WinInteractiveSid, &psid);
+        }
+        else if (!*pwzDomain && 0 == lstrcmpW(pwzUser, L"Users"))
+        {
+            hr = AclGetWellKnownSid(WinBuiltinUsersSid, &psid);
+        }
+        else
+        {
+            hr = StrAllocFormatted(&pwzAccount, L"%s%s%s", pwzDomain, *pwzDomain ? L"\\" : L"", pwzUser);
+            ExitOnFailure(hr, "failed to build domain user name");
+
+            hr = AclGetAccountSid(NULL, pwzAccount, &psid);
+        }
+        ExitOnFailure(hr, "failed to get sid for account: %ls%ls%ls", pwzDomain, *pwzDomain ? L"\\" : L"", pwzUser);
+
+        //
+        // build up the explicit access
+        //
+        ea.grfAccessMode = SET_ACCESS;
+
+        if (dwAttributes & SECURE_OBJECT_ATTRIBUTE_INHERITABLE)
+        {
+            ea.grfInheritance = SUB_CONTAINERS_AND_OBJECTS_INHERIT;
+        }
+        else
+        {
+            ea.grfInheritance = NO_INHERITANCE;
+        }
+
+#pragma prefast(push)
+#pragma prefast(disable:25029)
+        ::BuildTrusteeWithSidW(&ea.Trustee, psid);
+#pragma prefast(pop)
+
+        objectType = SEObjectTypeFromString(const_cast<LPCWSTR> (pwzTable));
+
+        // always add these permissions for services
+        // these are basic permissions that are often forgotten
+        if (0 == lstrcmpW(L"ServiceInstall", pwzTable))
+        {
+            dwPermissions |= SERVICE_QUERY_CONFIG | SERVICE_QUERY_STATUS | SERVICE_ENUMERATE_DEPENDENTS | SERVICE_INTERROGATE;
+        }
+
+        ea.grfAccessPermissions = dwPermissions;
+
+        if (SE_UNKNOWN_OBJECT_TYPE != objectType)
+        {
+            er = ::GetNamedSecurityInfoW(pwzObject, objectType, DACL_SECURITY_INFORMATION, NULL, NULL, &pAclExisting, NULL, &psd);
+            ExitOnFailure(hr = HRESULT_FROM_WIN32(er), "failed to get security info for object: %ls", pwzObject);
+
+            //Need to see if DACL is protected so getting Descriptor information
+            if (!::GetSecurityDescriptorControl(psd, &sdc, &dwRevision))
+            {
+                ExitOnLastError(hr, "failed to get security descriptor control for object: %ls", pwzObject);
+            }
+
+#pragma prefast(push)
+#pragma prefast(disable:25029)
+            er = ::SetEntriesInAclW(1, &ea, pAclExisting, &pAclNew);
+#pragma prefast(pop)
+            ExitOnFailure(hr = HRESULT_FROM_WIN32(er), "failed to add ACLs for object: %ls", pwzObject);
+
+            if (sdc & SE_DACL_PROTECTED)
+            {
+                si = DACL_SECURITY_INFORMATION | PROTECTED_DACL_SECURITY_INFORMATION;
+            }
+            else
+            {
+                si = DACL_SECURITY_INFORMATION;
+            }
+            er = ::SetNamedSecurityInfoW(pwzObject, objectType, si, NULL, NULL, pAclNew, NULL);
+            MessageExitOnFailure(hr = HRESULT_FROM_WIN32(er), msierrSecureObjectsFailedSet, "failed to set security info for object: %ls", pwzObject);
+        }
+        else
+        {
+            MessageExitOnFailure(hr = E_UNEXPECTED, msierrSecureObjectsUnknownType, "unknown object type: %ls", pwzTable);
+        }
+
+        hr = WcaProgressMessage(COST_SECUREOBJECT, FALSE);
+        ExitOnFailure(hr, "failed to send progress message");
+
+        objectType = SE_UNKNOWN_OBJECT_TYPE;
+    }
+
+LExit:
+    ReleaseStr(pwzUser);
+    ReleaseStr(pwzDomain);
+    ReleaseStr(pwzTable);
+    ReleaseStr(pwzObject);
+    ReleaseStr(pwzData);
+    ReleaseStr(pwzAccount);
+
+    if (pAclNew)
+    {
+        ::LocalFree(pAclNew);
+    }
+    if (psd)
+    {
+        ::LocalFree(psd);
+    }
+    if (psid)
+    {
+        AclFreeSid(psid);
+    }
+
+    if (FAILED(hr))
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+    return WcaFinalize(er);
+}
+
+extern "C" UINT __stdcall ExecSecureObjectsRollback(
+    __in MSIHANDLE hInstall
+    )
+{
+//    AssertSz(FALSE, "debug ExecSecureObjectsRollback");
+    HRESULT hr = S_OK;
+    DWORD er = ERROR_SUCCESS;
+
+    LPWSTR pwz = NULL;
+    LPWSTR pwzData = NULL;
+    LPWSTR pwzObject = NULL;
+    LPWSTR pwzTable = NULL;
+    LPWSTR pwzSecurityInfo = NULL;
+
+    SE_OBJECT_TYPE objectType = SE_UNKNOWN_OBJECT_TYPE;
+    PSECURITY_DESCRIPTOR psd = NULL;
+    ULONG psdSize;
+    SECURITY_DESCRIPTOR_CONTROL sdc = {0};
+    SECURITY_INFORMATION si = DACL_SECURITY_INFORMATION;
+    PACL pDacl = NULL;
+    BOOL bDaclPresent = false;
+    BOOL bDaclDefaulted = false;
+    DWORD dwRevision = 0;
+    int iProtected;
+
+    // initialize
+    hr = WcaInitialize(hInstall, "ExecSecureObjectsRollback");
+    ExitOnFailure(hr, "failed to initialize");
+
+    hr = WcaGetProperty(L"CustomActionData", &pwzData);
+    ExitOnFailure(hr, "failed to get CustomActionData");
+
+    WcaLog(LOGMSG_TRACEONLY, "CustomActionData: %ls", pwzData);
+
+    pwz = pwzData;
+
+    hr = WcaReadStringFromCaData(&pwz, &pwzObject);
+    ExitOnFailure(hr, "failed to process CustomActionData");
+
+    hr = WcaReadStringFromCaData(&pwz, &pwzTable);
+    ExitOnFailure(hr, "failed to process CustomActionData");
+
+    objectType = SEObjectTypeFromString(const_cast<LPCWSTR> (pwzTable));
+
+    if (SE_UNKNOWN_OBJECT_TYPE != objectType)
+    {
+        hr = WcaReadStringFromCaData(&pwz, &pwzSecurityInfo);
+        ExitOnFailure(hr, "failed to process CustomActionData");
+
+        hr = WcaReadIntegerFromCaData(&pwz, &iProtected);
+        ExitOnFailure(hr, "failed to process CustomActionData");
+
+        if (!::ConvertStringSecurityDescriptorToSecurityDescriptorW(pwzSecurityInfo,SDDL_REVISION_1,&psd,&psdSize))
+        {
+            ExitOnLastError(hr, "failed to convert security descriptor string to a valid security descriptor");
+        }
+
+        if (!::GetSecurityDescriptorDacl(psd,&bDaclPresent,&pDacl,&bDaclDefaulted))
+        {
+            hr = E_UNEXPECTED;
+            ExitOnFailure(hr, "failed to get security descriptor's DACL - error code: %d",pwzSecurityInfo,GetLastError());
+        }
+
+        // The below situation may always be caught by the above if block - the documentation isn't very clear. To be safe, we're going to test for it.
+        if (!bDaclPresent)
+        {
+            hr = E_UNEXPECTED;
+            ExitOnFailure(hr, "security descriptor does not contain a DACL");
+        }
+
+        //Need to see if DACL is protected so getting Descriptor information
+        if (!::GetSecurityDescriptorControl(psd, &sdc, &dwRevision))
+        {
+            ExitOnLastError(hr, "failed to get security descriptor control for object: %ls", pwzObject);
+        }
+
+        // Write a 1 if DACL is protected, 0 otherwise
+        switch (iProtected)
+        {
+        case 0:
+            // Unnecessary to do anything - leave si to the default flags
+            break;
+
+        case 1:
+            si = si | PROTECTED_DACL_SECURITY_INFORMATION;
+            break;
+
+        default:
+            hr = E_UNEXPECTED;
+            ExitOnFailure(hr, "unrecognized value in CustomActionData");
+            break;
+        }
+
+        er = ::SetNamedSecurityInfoW(pwzObject, objectType, si, NULL, NULL, pDacl, NULL);
+        ExitOnFailure(hr = HRESULT_FROM_WIN32(er), "failed to set security info for object: %ls error code: %d", pwzObject, GetLastError());
+    }
+    else
+    {
+        MessageExitOnFailure(hr = E_UNEXPECTED, msierrSecureObjectsUnknownType, "unknown object type: %ls", pwzTable);
+    }
+
+LExit:
+    ReleaseStr(pwzData);
+    ReleaseStr(pwzObject);
+    ReleaseStr(pwzTable);
+    ReleaseStr(pwzSecurityInfo);
+
+    if (psd)
+    {
+        ::LocalFree(psd);
+    }
+
+    if (FAILED(hr))
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+    return WcaFinalize(er);
+}
diff --git a/src/ext/Util/ca/serviceconfig.cpp b/src/ext/Util/ca/serviceconfig.cpp
new file mode 100644
index 00000000..04b25ffa
--- /dev/null
+++ b/src/ext/Util/ca/serviceconfig.cpp
@@ -0,0 +1,821 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+// structs
+LPCWSTR wzQUERY_SERVICECONFIG = L"SELECT `ServiceName`, `Component_`, `NewService`, `FirstFailureActionType`, `SecondFailureActionType`, `ThirdFailureActionType`, `ResetPeriodInDays`, `RestartServiceDelayInSeconds`, `ProgramCommandLine`, `RebootMessage` FROM `Wix4ServiceConfig`";
+enum eQUERY_SERVICECONFIG { QSC_SERVICENAME = 1, QSC_COMPONENT, QSC_NEWSERVICE, QSC_FIRSTFAILUREACTIONTYPE, QSC_SECONDFAILUREACTIONTYPE, QSC_THIRDFAILUREACTIONTYPE, QSC_RESETPERIODINDAYS, QSC_RESTARTSERVICEDELAYINSECONDS, QSC_PROGRAMCOMMANDLINE, QSC_REBOOTMESSAGE };
+
+// consts
+LPCWSTR c_wzActionTypeNone = L"none";
+LPCWSTR c_wzActionTypeReboot = L"reboot";
+LPCWSTR c_wzActionTypeRestart = L"restart";
+LPCWSTR c_wzActionTypeRunCommand = L"runCommand";
+
+// prototypes
+static SC_ACTION_TYPE GetSCActionType(
+    __in LPCWSTR pwzActionTypeName
+    );
+
+static HRESULT GetSCActionTypeString(
+    __in SC_ACTION_TYPE type,
+    __out_ecount(cchActionTypeString) LPWSTR wzActionTypeString,
+    __in DWORD cchActionTypeString
+    );
+
+static HRESULT GetService(
+    __in SC_HANDLE hSCM,
+    __in LPCWSTR wzService,
+    __in DWORD dwOpenServiceAccess,
+    __out SC_HANDLE* phService
+    );
+
+static HRESULT ConfigureService(
+    __in SC_HANDLE hSCM,
+    __in SC_HANDLE hService,
+    __in LPCWSTR wzServiceName,
+    __in DWORD dwRestartServiceDelayInSeconds,
+    __in LPCWSTR wzFirstFailureActionType,
+    __in LPCWSTR wzSecondFailureActionType,
+    __in LPCWSTR wzThirdFailureActionType,
+    __in DWORD dwResetPeriodInDays,
+    __in LPWSTR wzRebootMessage,
+    __in LPWSTR wzProgramCommandLine
+    );
+
+
+/******************************************************************
+SchedServiceConfig - entry point for SchedServiceConfig Custom Action
+
+called as Type 1 CustomAction (binary DLL) from Windows Installer 
+in InstallExecuteSequence before CaExecServiceConfig
+********************************************************************/
+extern "C" UINT __stdcall SchedServiceConfig(
+    __in MSIHANDLE hInstall
+    )
+{
+    //AssertSz(FALSE, "debug SchedServiceConfig");
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+
+    LPWSTR pwzScriptKey = NULL;
+    LPWSTR pwzCustomActionData = NULL;
+
+    PMSIHANDLE hView = NULL;
+    PMSIHANDLE hRec = NULL;
+    LPWSTR pwzData = NULL;
+    int iData = 0;
+    DWORD cServices = 0;
+
+    // initialize
+    hr = WcaInitialize(hInstall, "SchedServiceConfig");
+    ExitOnFailure(hr, "Failed to initialize.");
+
+    // Get the script key for this CustomAction and put it on the front of the
+    // CustomActionData of the install action.
+    hr = WcaCaScriptCreateKey(&pwzScriptKey);
+    ExitOnFailure(hr, "Failed to get encoding key.");
+
+    hr = WcaWriteStringToCaData(pwzScriptKey, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to add encoding key to CustomActionData.");
+
+    // Loop through all the services to be configured.
+    hr = WcaOpenExecuteView(wzQUERY_SERVICECONFIG, &hView);
+    ExitOnFailure(hr, "Failed to open view on Wix4ServiceConfig table.");
+
+    while (S_OK == (hr = WcaFetchRecord(hView, &hRec)))
+    {
+        INSTALLSTATE isInstalled = INSTALLSTATE_UNKNOWN;
+        INSTALLSTATE isAction = INSTALLSTATE_UNKNOWN;
+
+        // Get component name to check if we are installing it. If so
+        // then add the table data to the CustomActionData, otherwise
+        // skip it.
+        hr = WcaGetRecordString(hRec, QSC_COMPONENT, &pwzData);
+        ExitOnFailure(hr, "Failed to get component name");
+
+        hr = ::MsiGetComponentStateW(hInstall, pwzData, &isInstalled, &isAction);
+        ExitOnFailure(hr = HRESULT_FROM_WIN32(hr), "Failed to get install state for Component: %ls", pwzData);
+
+        if (WcaIsInstalling(isInstalled, isAction))
+        {
+            // Add the data to the CustomActionData (for install).
+            hr = WcaGetRecordFormattedString(hRec, QSC_SERVICENAME, &pwzData);
+            ExitOnFailure(hr, "Failed to get name of service.");
+            hr = WcaWriteStringToCaData(pwzData, &pwzCustomActionData);
+            ExitOnFailure(hr, "Failed to add name to CustomActionData.");
+
+            hr = WcaGetRecordInteger(hRec, QSC_NEWSERVICE, &iData);
+            ExitOnFailure(hr, "Failed to get Wix4ServiceConfig.NewService.");
+            hr = WcaWriteIntegerToCaData(0 != iData, &pwzCustomActionData);
+            ExitOnFailure(hr, "Failed to add NewService data to CustomActionData");
+
+            hr = WcaGetRecordString(hRec, QSC_FIRSTFAILUREACTIONTYPE, &pwzData);
+            ExitOnFailure(hr, "failed to get first failure action type");
+            hr = WcaWriteStringToCaData(pwzData, &pwzCustomActionData);
+            ExitOnFailure(hr, "failed to add data to CustomActionData");
+
+            hr = WcaGetRecordString(hRec, QSC_SECONDFAILUREACTIONTYPE, &pwzData);
+            ExitOnFailure(hr, "failed to get second failure action type");
+            hr = WcaWriteStringToCaData(pwzData, &pwzCustomActionData);
+            ExitOnFailure(hr, "failed to add data to CustomActionData");
+
+            hr = WcaGetRecordString(hRec, QSC_THIRDFAILUREACTIONTYPE, &pwzData);
+            ExitOnFailure(hr, "failed to get third failure action type");
+            hr = WcaWriteStringToCaData(pwzData, &pwzCustomActionData);
+            ExitOnFailure(hr, "failed to add data to CustomActionData");
+
+            hr = WcaGetRecordInteger(hRec, QSC_RESETPERIODINDAYS, &iData);
+            if (S_FALSE == hr) // deal w/ possible null value
+            {
+                iData = 0;
+            }
+            ExitOnFailure(hr, "failed to get reset period in days between service restart attempts.");
+            hr = WcaWriteIntegerToCaData(iData, &pwzCustomActionData);
+            ExitOnFailure(hr, "failed to add data to CustomActionData");
+
+            hr = WcaGetRecordInteger(hRec, QSC_RESTARTSERVICEDELAYINSECONDS, &iData);
+            if (S_FALSE == hr) // deal w/ possible null value
+            {
+                iData = 0;
+            }
+            ExitOnFailure(hr, "failed to get server restart delay value.");
+            hr = WcaWriteIntegerToCaData(iData, &pwzCustomActionData);
+            ExitOnFailure(hr, "failed to add data to CustomActionData");
+
+            hr = WcaGetRecordFormattedString(hRec, QSC_PROGRAMCOMMANDLINE, &pwzData); // null value already dealt w/ properly
+            ExitOnFailure(hr, "failed to get command line to run on service failure.");
+            hr = WcaWriteStringToCaData(pwzData, &pwzCustomActionData);
+            ExitOnFailure(hr, "failed to add data to CustomActionData");
+
+            hr = WcaGetRecordString(hRec, QSC_REBOOTMESSAGE, &pwzData); // null value already dealt w/ properly
+            ExitOnFailure(hr, "failed to get message to send to users when server reboots due to service failure.");
+            hr = WcaWriteStringToCaData(pwzData, &pwzCustomActionData);
+            ExitOnFailure(hr, "failed to add data to CustomActionData");
+
+            ++cServices;
+        }
+    }
+
+    // if we looped through all records all is well
+    if (E_NOMOREITEMS == hr)
+    {
+        hr = S_OK;
+    }
+    ExitOnFailure(hr, "failed while looping through all objects to secure");
+
+    // setup CustomActionData and add to progress bar for download
+    if (0 < cServices)
+    {
+        hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"RollbackServiceConfig"), pwzScriptKey, cServices * COST_SERVICECONFIG);
+        ExitOnFailure(hr, "failed to schedule RollbackServiceConfig action");
+
+        hr = WcaDoDeferredAction(CUSTOM_ACTION_DECORATION(L"ExecServiceConfig"), pwzCustomActionData, cServices * COST_SERVICECONFIG);
+        ExitOnFailure(hr, "failed to schedule ExecServiceConfig action");
+    }
+
+LExit:
+    ReleaseStr(pwzData);
+    ReleaseStr(pwzCustomActionData);
+    ReleaseStr(pwzScriptKey);
+
+    er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+
+/******************************************************************
+CaExecServiceConfig - entry point for ServiceConfig Custom Action.
+
+NOTE: deferred CustomAction since it modifies the machine
+NOTE: CustomActionData == wzServiceName\tfNewService\twzFirstFailureActionType\twzSecondFailureActionType\twzThirdFailureActionType\tdwResetPeriodInDays\tdwRestartServiceDelayInSeconds\twzProgramCommandLine\twzRebootMessage\twzServiceName\tfNewService\t...
+*******************************************************************/
+extern "C" UINT __stdcall ExecServiceConfig(
+    __in MSIHANDLE hInstall
+    )
+{
+    //AssertSz(FALSE, "debug ExecServiceConfig");
+    HRESULT hr = S_OK;
+    DWORD er = 0;
+
+    LPWSTR pwzCustomActionData = NULL;
+    LPWSTR pwz = NULL;
+
+    LPWSTR pwzScriptKey = NULL;
+    WCA_CASCRIPT_HANDLE hRollbackScript = NULL;
+
+    LPWSTR pwzServiceName = NULL;
+    BOOL fNewService = FALSE;
+    LPWSTR pwzFirstFailureActionType = NULL;
+    LPWSTR pwzSecondFailureActionType = NULL;
+    LPWSTR pwzThirdFailureActionType = NULL;
+    LPWSTR pwzProgramCommandLine = NULL;
+    LPWSTR pwzRebootMessage = NULL;
+    DWORD dwResetPeriodInDays = 0;
+    DWORD dwRestartServiceDelayInSeconds = 0;
+
+    LPVOID lpMsgBuf = NULL;
+    SC_HANDLE hSCM = NULL;
+    SC_HANDLE hService = NULL;
+
+    DWORD dwRestartDelay = 0;
+    WCHAR wzActionName[32] = { 0 };
+
+    DWORD cbExistingServiceConfig = 0;
+
+    SERVICE_FAILURE_ACTIONSW* psfa = NULL;
+
+    // initialize
+    hr = WcaInitialize(hInstall, "ExecServiceConfig");
+    ExitOnFailure(hr, "failed to initialize");
+
+    // Open the Services Control Manager up front.
+    hSCM = ::OpenSCManagerW(NULL, NULL, SC_MANAGER_CONNECT);
+    if (NULL == hSCM)
+    {
+        er = ::GetLastError();
+        hr = HRESULT_FROM_WIN32(er);
+
+#pragma prefast(push)
+#pragma prefast(disable:25028)
+        ::FormatMessageW(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS, NULL, er, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), (LPWSTR)&lpMsgBuf, 0, NULL);
+#pragma prefast(pop)
+
+        ExitOnFailure(hr, "Failed to get handle to SCM. Error: %ls", (LPWSTR)lpMsgBuf);
+    }
+
+    // First, get the script key out of the CustomActionData and
+    // use that to create the rollback script for this action.
+    hr = WcaGetProperty( L"CustomActionData", &pwzCustomActionData);
+    ExitOnFailure(hr, "failed to get CustomActionData");
+
+    WcaLog(LOGMSG_TRACEONLY, "CustomActionData: %ls", pwzCustomActionData);
+
+    pwz = pwzCustomActionData;
+
+    hr = WcaReadStringFromCaData(&pwz, &pwzScriptKey);
+    if (!pwzScriptKey)
+    {
+        hr = E_UNEXPECTED;
+        ExitOnFailure(hr, "Failed due to unexpected CustomActionData passed.");
+    }
+    ExitOnFailure(hr, "Failed to read encoding key from CustomActionData.");
+
+    hr = WcaCaScriptCreate(WCA_ACTION_INSTALL, WCA_CASCRIPT_ROLLBACK, FALSE, pwzScriptKey, FALSE, &hRollbackScript);
+    ExitOnFailure(hr, "Failed to open rollback CustomAction script.");
+
+    // Next, loop through the rest of the CustomActionData, processing
+    // each service config row in turn.
+    while (pwz && *pwz)
+    {
+        hr = WcaReadStringFromCaData(&pwz, &pwzServiceName);
+        ExitOnFailure(hr, "failed to process CustomActionData");
+        hr = WcaReadIntegerFromCaData(&pwz, reinterpret_cast<int*>(&fNewService));
+        ExitOnFailure(hr, "failed to process CustomActionData");
+        hr = WcaReadStringFromCaData(&pwz, &pwzFirstFailureActionType);
+        ExitOnFailure(hr, "failed to process CustomActionData");
+        hr = WcaReadStringFromCaData(&pwz, &pwzSecondFailureActionType);
+        ExitOnFailure(hr, "failed to process CustomActionData");
+        hr = WcaReadStringFromCaData(&pwz, &pwzThirdFailureActionType);
+        ExitOnFailure(hr, "failed to process CustomActionData");
+        hr = WcaReadIntegerFromCaData(&pwz, reinterpret_cast<int*>(&dwResetPeriodInDays));
+        ExitOnFailure(hr, "failed to process CustomActionData");
+        hr = WcaReadIntegerFromCaData(&pwz, reinterpret_cast<int*>(&dwRestartServiceDelayInSeconds));
+        ExitOnFailure(hr, "failed to process CustomActionData");
+        hr = WcaReadStringFromCaData(&pwz, &pwzProgramCommandLine);
+        ExitOnFailure(hr, "failed to process CustomActionData");
+        hr = WcaReadStringFromCaData(&pwz, &pwzRebootMessage);
+        ExitOnFailure(hr, "failed to process CustomActionData");
+
+        WcaLog(LOGMSG_VERBOSE, "Configuring Service: %ls", pwzServiceName);
+
+        // Open the handle with all the permissions we might need:
+        //  SERVICE_QUERY_CONFIG is needed for QueryServiceConfig2().
+        //  SERVICE_CHANGE_CONFIG is needed for ChangeServiceConfig2().
+        //  SERVICE_START is required in order to handle SC_ACTION_RESTART action.
+        hr = GetService(hSCM, pwzServiceName, SERVICE_QUERY_CONFIG | SERVICE_CHANGE_CONFIG | SERVICE_START, &hService);
+        ExitOnFailure(hr, "Failed to get service: %ls", pwzServiceName);
+
+        // If we are configuring a service that existed on the machine, we need to
+        // read the existing service configuration and write it out to the rollback
+        // log so rollback can put it back if anything goes wrong.
+        if (!fNewService)
+        {
+            // First, read the existing service config.
+            if (!::QueryServiceConfig2W(hService, SERVICE_CONFIG_FAILURE_ACTIONS, NULL, 0, &cbExistingServiceConfig) && ERROR_INSUFFICIENT_BUFFER != ::GetLastError())
+            {
+                ExitWithLastError(hr, "Failed to get current service config info.");
+            }
+
+            psfa = static_cast<LPSERVICE_FAILURE_ACTIONSW>(MemAlloc(cbExistingServiceConfig, TRUE));
+            ExitOnNull(psfa, hr, E_OUTOFMEMORY, "failed to allocate memory for service failure actions.");
+
+            if (!::QueryServiceConfig2W(hService, SERVICE_CONFIG_FAILURE_ACTIONS, (LPBYTE)psfa, cbExistingServiceConfig, &cbExistingServiceConfig))
+            {
+                ExitOnLastError(hr, "failed to Query Service.");
+            }
+
+            // Build up rollback log so we can restore service state if necessary
+            hr = WcaCaScriptWriteString(hRollbackScript, pwzServiceName);
+            ExitOnFailure(hr, "Failed to add service name to Rollback Log");
+
+            // If this service struct is empty, fill in default values
+            if (3 > psfa->cActions)
+            {
+                hr = WcaCaScriptWriteString(hRollbackScript, c_wzActionTypeNone);
+                ExitOnFailure(hr, "failed to add data to Rollback CustomActionData");
+
+                hr = WcaCaScriptWriteString(hRollbackScript, c_wzActionTypeNone);
+                ExitOnFailure(hr, "failed to add data to Rollback CustomActionData");
+
+                hr = WcaCaScriptWriteString(hRollbackScript, c_wzActionTypeNone);
+                ExitOnFailure(hr, "failed to add data to Rollback CustomActionData");
+            }
+            else
+            {
+                // psfa actually had actions defined, so use the first three.
+                for (int i = 0; i < 3; ++i)
+                {
+                    hr = GetSCActionTypeString(psfa->lpsaActions[i].Type, wzActionName, countof(wzActionName));
+                    ExitOnFailure(hr, "failed to query SFA object");
+
+                    if (SC_ACTION_RESTART == psfa->lpsaActions[i].Type)
+                    {
+                        dwRestartDelay = psfa->lpsaActions[i].Delay / 1000;
+                    }
+
+                    hr = WcaCaScriptWriteString(hRollbackScript, wzActionName);
+                    ExitOnFailure(hr, "failed to add data to Rollback CustomActionData");
+                }
+            }
+
+            hr = WcaCaScriptWriteNumber(hRollbackScript, psfa->dwResetPeriod / (24 * 60 * 60));
+            ExitOnFailure(hr, "failed to add data to CustomActionData");
+
+            hr = WcaCaScriptWriteNumber(hRollbackScript, dwRestartDelay);
+            ExitOnFailure(hr, "failed to add data to CustomActionData");
+
+            // Handle the null cases.
+            if (!psfa->lpCommand)
+            {
+                psfa->lpCommand = L"";
+            }
+            hr = WcaCaScriptWriteString(hRollbackScript, psfa->lpCommand);
+            ExitOnFailure(hr, "failed to add data to Rollback CustomActionData");
+
+            // Handle the null cases.
+            if (!psfa->lpRebootMsg)
+            {
+                psfa->lpRebootMsg = L"";
+            }
+            hr = WcaCaScriptWriteString(hRollbackScript, psfa->lpRebootMsg);
+            ExitOnFailure(hr, "failed to add data to Rollback CustomActionData");
+
+            // Nudge the system to get all our rollback data written to disk.
+            WcaCaScriptFlush(hRollbackScript);
+
+            ReleaseNullMem(psfa);
+        }
+
+        hr = ConfigureService(hSCM, hService, pwzServiceName, dwRestartServiceDelayInSeconds, pwzFirstFailureActionType,
+                              pwzSecondFailureActionType, pwzThirdFailureActionType, dwResetPeriodInDays, pwzRebootMessage, pwzProgramCommandLine);
+        ExitOnFailure(hr, "Failed to configure service: %ls", pwzServiceName);
+
+        hr = WcaProgressMessage(COST_SERVICECONFIG, FALSE);
+        ExitOnFailure(hr, "failed to send progress message");
+
+        // Per-service cleanup
+        ::CloseServiceHandle(hService);
+        hService = NULL;
+        dwResetPeriodInDays = 0;
+        dwRestartServiceDelayInSeconds = 0;
+    }
+
+LExit:
+    WcaCaScriptClose(hRollbackScript, WCA_CASCRIPT_CLOSE_PRESERVE);
+
+    if (lpMsgBuf)
+    {
+        ::LocalFree(lpMsgBuf);
+    }
+
+    if (hService)
+    {
+        ::CloseServiceHandle(hService);
+    }
+
+    if (hSCM)
+    {
+        ::CloseServiceHandle(hSCM);
+    }
+
+    ReleaseMem(psfa);
+
+    ReleaseStr(pwzRebootMessage);
+    ReleaseStr(pwzProgramCommandLine);
+    ReleaseStr(pwzThirdFailureActionType);
+    ReleaseStr(pwzSecondFailureActionType);
+    ReleaseStr(pwzFirstFailureActionType);
+    ReleaseStr(pwzServiceName);
+    ReleaseStr(pwzScriptKey);
+    ReleaseStr(pwzCustomActionData);
+
+    er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+
+/******************************************************************
+RollbackServiceConfig - entry point for ServiceConfig rollback
+                        Custom Action.
+
+NOTE: CustomActionScript Data == wzServiceName\twzFirstFailureActionType\twzSecondFailureActionType\twzThirdFailureActionType\tdwResetPeriodInDays\tdwRestartServiceDelayInSeconds\twzProgramCommandLine\twzRebootMessage\twzServiceName\t...
+*******************************************************************/
+extern "C" UINT __stdcall RollbackServiceConfig(
+    __in MSIHANDLE hInstall
+    )
+{
+    //AssertSz(FALSE, "debug RollbackServiceConfig");
+    HRESULT hr = S_OK;
+    DWORD er = 0;
+
+    LPWSTR pwzCustomActionData = NULL;
+    LPWSTR pwz = NULL;
+
+    LPWSTR pwzScriptKey = NULL;
+    WCA_CASCRIPT_HANDLE hRollbackScript = NULL;
+
+    LPWSTR pwzServiceName = NULL;
+    LPWSTR pwzFirstFailureActionType = NULL;
+    LPWSTR pwzSecondFailureActionType = NULL;
+    LPWSTR pwzThirdFailureActionType = NULL;
+    LPWSTR pwzProgramCommandLine = NULL;
+    LPWSTR pwzRebootMessage = NULL;
+    DWORD dwResetPeriodInDays = 0;
+    DWORD dwRestartServiceDelayInSeconds = 0;
+
+    LPVOID lpMsgBuf = NULL;
+    SC_HANDLE hSCM = NULL;
+    SC_HANDLE hService = NULL;
+
+    // initialize
+    hr = WcaInitialize(hInstall, "RollbackServiceConfig");
+    ExitOnFailure(hr, "Failed to initialize 'RollbackServiceConfig'.");
+
+    // Open the Services Control Manager up front.
+    hSCM = ::OpenSCManagerW(NULL, NULL, SC_MANAGER_CONNECT);
+    if (NULL == hSCM)
+    {
+        er = ::GetLastError();
+        hr = HRESULT_FROM_WIN32(er);
+
+#pragma prefast(push)
+#pragma prefast(disable:25028)
+        ::FormatMessageW(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS, NULL, er, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), (LPWSTR)&lpMsgBuf, 0, NULL);
+#pragma prefast(pop)
+
+        ExitOnFailure(hr, "Failed to get handle to SCM. Error: %ls", (LPWSTR)lpMsgBuf);
+
+        // Make sure we still abort, in case hSCM was NULL but no error was returned from GetLastError
+        ExitOnNull(hSCM, hr, E_POINTER, "Getting handle to SCM reported success, but no handle was returned.");
+    }
+
+    // Get the script key from the CustomAction data and use it to open
+    // the rollback log and read the data over the CustomActionData
+    // because all of the information is in the script data not the
+    // CustomActionData.
+    hr = WcaGetProperty( L"CustomActionData", &pwzCustomActionData);
+    ExitOnFailure(hr, "failed to get CustomActionData");
+
+    WcaLog(LOGMSG_TRACEONLY, "CustomActionData: %ls", pwzCustomActionData);
+
+    pwz = pwzCustomActionData;
+
+    hr = WcaReadStringFromCaData(&pwz, &pwzScriptKey);
+    if (!pwzScriptKey)
+    {
+        hr = E_UNEXPECTED;
+        ExitOnFailure(hr, "Failed due to unexpected CustomActionData passed.");
+    }
+    ExitOnFailure(hr, "Failed to read encoding key from CustomActionData.");
+
+    hr = WcaCaScriptOpen(WCA_ACTION_INSTALL, WCA_CASCRIPT_ROLLBACK, FALSE, pwzScriptKey, &hRollbackScript);
+    ExitOnFailure(hr, "Failed to open rollback CustomAction script.");
+
+    hr = WcaCaScriptReadAsCustomActionData(hRollbackScript, &pwzCustomActionData);
+    ExitOnFailure(hr, "Failed to read rollback script into CustomAction data.");
+
+    // Loop through the script's CustomActionData, processing each
+    // service config in turn.
+    pwz = pwzCustomActionData;
+    while (pwz && *pwz)
+    {
+        hr = WcaReadStringFromCaData(&pwz, &pwzServiceName);
+        ExitOnFailure(hr, "failed to process CustomActionData");
+        hr = WcaReadStringFromCaData(&pwz, &pwzFirstFailureActionType);
+        ExitOnFailure(hr, "failed to process CustomActionData");
+        hr = WcaReadStringFromCaData(&pwz, &pwzSecondFailureActionType);
+        ExitOnFailure(hr, "failed to process CustomActionData");
+        hr = WcaReadStringFromCaData(&pwz, &pwzThirdFailureActionType);
+        ExitOnFailure(hr, "failed to process CustomActionData");
+        hr = WcaReadIntegerFromCaData(&pwz, reinterpret_cast<int*>(&dwResetPeriodInDays));
+        ExitOnFailure(hr, "failed to process CustomActionData");
+        hr = WcaReadIntegerFromCaData(&pwz, reinterpret_cast<int*>(&dwRestartServiceDelayInSeconds));
+        ExitOnFailure(hr, "failed to process CustomActionData");
+        hr = WcaReadStringFromCaData(&pwz, &pwzProgramCommandLine);
+        ExitOnFailure(hr, "failed to process CustomActionData");
+        hr = WcaReadStringFromCaData(&pwz, &pwzRebootMessage);
+        ExitOnFailure(hr, "failed to process CustomActionData");
+
+        WcaLog(LOGMSG_VERBOSE, "Reconfiguring Service: %ls", pwzServiceName);
+
+        // Open the handle with all the permissions we might need.
+        //  SERVICE_CHANGE_CONFIG is needed for ChangeServiceConfig2().
+        //  SERVICE_START is required in order to handle SC_ACTION_RESTART action.
+        hr = GetService(hSCM, pwzServiceName, SERVICE_CHANGE_CONFIG | SERVICE_START, &hService);
+        ExitOnFailure(hr, "Failed to get service: %ls", pwzServiceName);
+
+        hr = ConfigureService(hSCM, hService, pwzServiceName, dwRestartServiceDelayInSeconds, pwzFirstFailureActionType,
+                              pwzSecondFailureActionType, pwzThirdFailureActionType, dwResetPeriodInDays, pwzRebootMessage, pwzProgramCommandLine);
+        ExitOnFailure(hr, "Failed to configure service: %ls", pwzServiceName);
+
+        hr = WcaProgressMessage(COST_SERVICECONFIG, FALSE);
+        ExitOnFailure(hr, "failed to send progress message");
+
+        // Per-service cleanup
+        ::CloseServiceHandle(hService);
+        hService = NULL;
+        dwResetPeriodInDays = 0;
+        dwRestartServiceDelayInSeconds = 0;
+    }
+
+LExit:
+    if (lpMsgBuf) // Allocated with FormatString.
+    {
+        ::LocalFree(lpMsgBuf);
+    }
+
+    if (hService)
+    {
+        ::CloseServiceHandle(hService);
+    }
+
+    if (hSCM)
+    {
+        ::CloseServiceHandle(hSCM);
+    }
+
+    WcaCaScriptClose(hRollbackScript, WCA_CASCRIPT_CLOSE_DELETE);
+
+    ReleaseStr(pwzRebootMessage);
+    ReleaseStr(pwzProgramCommandLine);
+    ReleaseStr(pwzThirdFailureActionType);
+    ReleaseStr(pwzSecondFailureActionType);
+    ReleaseStr(pwzFirstFailureActionType);
+    ReleaseStr(pwzServiceName);
+    ReleaseStr(pwzScriptKey);
+    ReleaseStr(pwzCustomActionData);
+
+    er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
+
+/**********************************************************
+GetSCActionType - helper function to return the SC_ACTION_TYPE
+for a given string matching the allowed set.
+REBOOT, RESTART, RUN_COMMAND and NONE
+**********************************************************/
+static SC_ACTION_TYPE GetSCActionType(
+    __in LPCWSTR pwzActionTypeName
+    )
+{
+    SC_ACTION_TYPE actionType;
+
+    // verify that action types are valid. if not, just default to NONE
+    if (0 == lstrcmpiW(c_wzActionTypeReboot, pwzActionTypeName))
+    {
+        actionType = SC_ACTION_REBOOT;
+    }
+    else if (0 == lstrcmpiW(c_wzActionTypeRestart, pwzActionTypeName))
+    {
+        actionType = SC_ACTION_RESTART;
+    }
+    else if (0 == lstrcmpiW(c_wzActionTypeRunCommand, pwzActionTypeName))
+    {
+        actionType = SC_ACTION_RUN_COMMAND;
+    }
+    else
+    {
+        // default to none
+        actionType = SC_ACTION_NONE;
+    }
+
+    return actionType;
+}
+
+
+static HRESULT GetSCActionTypeString(
+    __in SC_ACTION_TYPE type,
+    __out_ecount(cchActionTypeString) LPWSTR wzActionTypeString,
+    __in DWORD cchActionTypeString
+    )
+{
+    HRESULT hr = S_OK;
+
+    switch (type)
+    {
+    case SC_ACTION_REBOOT:
+        hr = StringCchCopyW(wzActionTypeString, cchActionTypeString, c_wzActionTypeReboot);
+        ExitOnFailure(hr, "Failed to copy 'reboot' into action type.");
+        break;
+    case SC_ACTION_RESTART:
+        hr = StringCchCopyW(wzActionTypeString, cchActionTypeString, c_wzActionTypeRestart);
+        ExitOnFailure(hr, "Failed to copy 'restart' into action type.");
+        break;
+    case SC_ACTION_RUN_COMMAND:
+        hr = StringCchCopyW(wzActionTypeString, cchActionTypeString, c_wzActionTypeRunCommand);
+        ExitOnFailure(hr, "Failed to copy 'runCommand' into action type.");
+        break;
+    case SC_ACTION_NONE:
+        hr = StringCchCopyW(wzActionTypeString, cchActionTypeString, c_wzActionTypeNone);
+        ExitOnFailure(hr, "Failed to copy 'none' into action type.");
+        break;
+    default:
+        break;
+    }
+
+LExit:
+    return hr;
+}
+
+
+static HRESULT GetService(
+    __in SC_HANDLE hSCM,
+    __in LPCWSTR wzService,
+    __in DWORD dwOpenServiceAccess,
+    __out SC_HANDLE* phService
+    )
+{
+    HRESULT hr = S_OK;
+    DWORD er = ERROR_SUCCESS;
+    LPVOID lpMsgBuf = NULL;
+
+    *phService = ::OpenServiceW(hSCM, wzService, dwOpenServiceAccess);
+    if (NULL == *phService)
+    {
+        er = ::GetLastError();
+        hr = HRESULT_FROM_WIN32(er);
+        if (ERROR_SERVICE_DOES_NOT_EXIST == er)
+        {
+            ExitOnFailure(hr, "Service '%ls' does not exist on this system.", wzService);
+        }
+        else
+        {
+#pragma prefast(push)
+#pragma prefast(disable:25028)
+            ::FormatMessageW(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS, NULL, er, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), (LPWSTR)&lpMsgBuf, 0, NULL);
+#pragma prefast(pop)
+
+            ExitOnFailure(hr, "Failed to get handle to the service '%ls'. Error: %ls", wzService, (LPWSTR)lpMsgBuf);
+        }
+    }
+
+LExit:
+    if (lpMsgBuf) // Allocated with FormatString.
+    {
+        ::LocalFree(lpMsgBuf);
+    }
+
+    return hr;
+}
+
+
+static HRESULT ConfigureService(
+    __in SC_HANDLE /*hSCM*/,
+    __in SC_HANDLE hService,
+    __in LPCWSTR wzServiceName,
+    __in DWORD dwRestartServiceDelayInSeconds,
+    __in LPCWSTR wzFirstFailureActionType,
+    __in LPCWSTR wzSecondFailureActionType,
+    __in LPCWSTR wzThirdFailureActionType,
+    __in DWORD dwResetPeriodInDays,
+    __in LPWSTR wzRebootMessage,
+    __in LPWSTR wzProgramCommandLine
+    )
+{
+    HRESULT hr = S_OK;
+    DWORD er = ERROR_SUCCESS;
+
+    HANDLE hToken = NULL;
+    TOKEN_PRIVILEGES priv = { 0 };
+    TOKEN_PRIVILEGES* pPrevPriv = NULL;
+    DWORD cbPrevPriv = 0;
+    BOOL fAdjustedPrivileges = FALSE;
+
+    SC_ACTION actions[3]; // the UI always shows 3 actions, so we'll always do 3
+    SERVICE_FAILURE_ACTIONSW sfa;
+    LPVOID lpMsgBuf = NULL;
+
+    // Always get the shutdown privilege in case we need to configure service to reboot.
+    if (!::OpenProcessToken(::GetCurrentProcess(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &hToken))
+    {
+        ExitWithLastError(hr, "Failed to get process token.");
+    }
+
+    priv.PrivilegeCount = 1;
+    priv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
+    if (!::LookupPrivilegeValueW(NULL, L"SeShutdownPrivilege", &priv.Privileges[0].Luid))
+    {
+        ExitWithLastError(hr, "Failed to get shutdown privilege LUID.");
+    }
+
+    cbPrevPriv = sizeof(TOKEN_PRIVILEGES);
+    pPrevPriv = static_cast<TOKEN_PRIVILEGES*>(MemAlloc(cbPrevPriv, TRUE));
+    ExitOnNull(pPrevPriv, hr, E_OUTOFMEMORY, "Failed to allocate memory for empty previous privileges.");
+
+    if (!::AdjustTokenPrivileges(hToken, FALSE, &priv, cbPrevPriv, pPrevPriv, &cbPrevPriv))
+    {
+        LPVOID pv = MemReAlloc(pPrevPriv, cbPrevPriv, TRUE);
+        ExitOnNull(pv, hr, E_OUTOFMEMORY, "Failed to allocate memory for previous privileges.");
+        pPrevPriv = static_cast<TOKEN_PRIVILEGES*>(pv);
+
+        if (!::AdjustTokenPrivileges(hToken, FALSE, &priv, cbPrevPriv, pPrevPriv, &cbPrevPriv))
+        {
+            ExitWithLastError(hr, "Failed to get shutdown privilege LUID.");
+        }
+    }
+
+    fAdjustedPrivileges = TRUE;
+
+    // build up SC_ACTION array
+    // TODO: why is delay only respected when SC_ACTION_RESTART is requested?
+    actions[0].Type = GetSCActionType(wzFirstFailureActionType);
+    actions[0].Delay = 0;
+    if (SC_ACTION_RESTART == actions[0].Type)
+    {
+        actions[0].Delay = dwRestartServiceDelayInSeconds * 1000; // seconds to milliseconds
+    }
+
+    actions[1].Type = GetSCActionType(wzSecondFailureActionType);
+    actions[1].Delay = 0;
+    if (SC_ACTION_RESTART == actions[1].Type)
+    {
+        actions[1].Delay = dwRestartServiceDelayInSeconds * 1000; // seconds to milliseconds
+    }
+
+    actions[2].Type = GetSCActionType(wzThirdFailureActionType);
+    actions[2].Delay = 0;
+    if (SC_ACTION_RESTART == actions[2].Type)
+    {
+        actions[2].Delay = dwRestartServiceDelayInSeconds * 1000; // seconds to milliseconds
+    }
+
+    // build up the SERVICE_FAILURE_ACTIONSW struct
+    sfa.dwResetPeriod = dwResetPeriodInDays * (24 * 60 * 60); // days to seconds
+    sfa.lpRebootMsg = wzRebootMessage;
+    sfa.lpCommand = wzProgramCommandLine;
+    sfa.cActions = countof(actions);
+    sfa.lpsaActions = actions;
+
+    // Call ChangeServiceConfig2 to actually set up the failure actions
+    if (!::ChangeServiceConfig2W(hService, SERVICE_CONFIG_FAILURE_ACTIONS, (LPVOID)&sfa))
+    {
+        er = ::GetLastError();
+        hr = HRESULT_FROM_WIN32(er);
+
+#pragma prefast(push)
+#pragma prefast(disable:25028)
+        ::FormatMessageW(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS, NULL, er, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), (LPWSTR)&lpMsgBuf, 0, NULL);
+#pragma prefast(pop)
+
+        // Check if this is a service that can't be modified.
+        if (ERROR_CANNOT_DETECT_PROCESS_ABORT == er)
+        {
+            WcaLog(LOGMSG_STANDARD, "WARNING: Service \"%ls\" is not configurable on this server and will not be set.", wzServiceName);
+        }
+        ExitOnFailure(hr, "Cannot change service configuration. Error: %ls", (LPWSTR)lpMsgBuf);
+
+        if (lpMsgBuf)
+        {
+            ::LocalFree(lpMsgBuf);
+            lpMsgBuf = NULL;
+        }
+    }
+
+LExit:
+    if (lpMsgBuf)
+    {
+        ::LocalFree(lpMsgBuf);
+    }
+
+    if (fAdjustedPrivileges)
+    {
+        ::AdjustTokenPrivileges(hToken, FALSE, pPrevPriv, 0, NULL, NULL);
+    }
+
+    ReleaseMem(pPrevPriv);
+    ReleaseHandle(hToken);
+
+    return hr;
+}
diff --git a/src/ext/Util/ca/shellexecca.cpp b/src/ext/Util/ca/shellexecca.cpp
new file mode 100644
index 00000000..ea21d3bd
--- /dev/null
+++ b/src/ext/Util/ca/shellexecca.cpp
@@ -0,0 +1,271 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+HRESULT ShellExec(
+    __in LPCWSTR wzTarget,
+    __in BOOL fUnelevated
+    )
+{
+    HRESULT hr = S_OK;
+    LPWSTR sczWorkingDirectory = NULL;
+
+    // a reasonable working directory (not the system32 default from MSI) is the directory where the target lives
+    hr = PathGetDirectory(wzTarget, &sczWorkingDirectory);
+    ExitOnFailure(hr, "failed to get directory for target: %ls", wzTarget);
+    
+    if (!DirExists(sczWorkingDirectory, NULL))
+    {
+        ReleaseNullStr(sczWorkingDirectory);
+    }
+
+    if (fUnelevated)
+    {
+        hr = ShelExecUnelevated(wzTarget, NULL, NULL, sczWorkingDirectory, SW_SHOWDEFAULT);
+        ExitOnFailure(hr, "ShelExecUnelevated failed with target %ls", wzTarget);
+    }
+    else
+    {
+        HINSTANCE hinst = ::ShellExecuteW(NULL, NULL, wzTarget, NULL, sczWorkingDirectory, SW_SHOWDEFAULT);
+        if (hinst <= HINSTANCE(32))
+        {
+            LONG64 code = reinterpret_cast<LONG64>(hinst);
+            switch (code)
+            {
+            case ERROR_FILE_NOT_FOUND:
+                hr = HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND);
+                break;
+            case ERROR_PATH_NOT_FOUND:
+                hr = HRESULT_FROM_WIN32(ERROR_PATH_NOT_FOUND);
+                break;
+            case ERROR_BAD_FORMAT:
+                hr = HRESULT_FROM_WIN32(ERROR_BAD_FORMAT);
+                break;
+            case SE_ERR_ASSOCINCOMPLETE:
+            case SE_ERR_NOASSOC:
+                hr = HRESULT_FROM_WIN32(ERROR_NO_ASSOCIATION);
+                break;
+            case SE_ERR_DDEBUSY:
+            case SE_ERR_DDEFAIL:
+            case SE_ERR_DDETIMEOUT:
+                hr = HRESULT_FROM_WIN32(ERROR_DDE_FAIL);
+                break;
+            case SE_ERR_DLLNOTFOUND:
+                hr = HRESULT_FROM_WIN32(ERROR_DLL_NOT_FOUND);
+                break;
+            case SE_ERR_OOM:
+                hr = E_OUTOFMEMORY;
+                break;
+            case SE_ERR_ACCESSDENIED:
+                hr = E_ACCESSDENIED;
+                break;
+            default:
+                hr = E_FAIL;
+            }
+
+            ExitOnFailure(hr, "ShellExec failed with return code %llu.", code);
+        }
+    }
+
+
+LExit:
+    ReleaseStr(sczWorkingDirectory);
+    return hr;
+}
+
+extern "C" UINT __stdcall WixShellExec(
+    __in MSIHANDLE hInstall
+    )
+{
+    Assert(hInstall);
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+    LPWSTR pwzTarget = NULL;
+
+    hr = WcaInitialize(hInstall, "WixShellExec");
+    ExitOnFailure(hr, "failed to initialize");
+
+    hr = WcaGetFormattedProperty(L"WixShellExecTarget", &pwzTarget);
+    ExitOnFailure(hr, "failed to get WixShellExecTarget");
+
+    WcaLog(LOGMSG_VERBOSE, "WixShellExecTarget is %ls", pwzTarget);
+
+    if (!pwzTarget || !*pwzTarget)
+    {
+        hr = E_INVALIDARG;
+        ExitOnFailure(hr, "failed to get WixShellExecTarget");
+    }
+
+    hr = ShellExec(pwzTarget, FALSE);
+    ExitOnFailure(hr, "failed to launch target");
+
+LExit:
+    ReleaseStr(pwzTarget);
+
+    if (FAILED(hr)) 
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+    return WcaFinalize(er); 
+}
+
+extern "C" UINT __stdcall WixUnelevatedShellExec(
+    __in MSIHANDLE hInstall
+    )
+{
+    Assert(hInstall);
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+    LPWSTR pwzTarget = NULL;
+
+    hr = WcaInitialize(hInstall, "WixUnelevatedShellExec");
+    ExitOnFailure(hr, "failed to initialize");
+
+    hr = WcaGetFormattedProperty(L"WixUnelevatedShellExecTarget", &pwzTarget);
+    ExitOnFailure(hr, "failed to get WixUnelevatedShellExecTarget");
+
+    WcaLog(LOGMSG_VERBOSE, "WixUnelevatedShellExecTarget is %ls", pwzTarget);
+
+    if (!pwzTarget || !*pwzTarget)
+    {
+        hr = E_INVALIDARG;
+        ExitOnFailure(hr, "failed to get WixShellExecTarget");
+    }
+
+    hr = ShellExec(pwzTarget, TRUE);
+    ExitOnFailure(hr, "failed to launch target");
+
+LExit:
+    ReleaseStr(pwzTarget);
+
+    if (FAILED(hr)) 
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+    return WcaFinalize(er); 
+}
+
+//
+// ExtractBinary extracts the data from the Binary table row with the given ID into a file. 
+//
+HRESULT ExtractBinary(
+    __in LPCWSTR wzBinaryId,
+    __out BYTE** pbData,
+    __out DWORD* pcbData
+    )
+{
+    HRESULT hr = S_OK;
+    LPWSTR pwzSql = NULL;
+    PMSIHANDLE hView;
+    PMSIHANDLE hRec;
+
+    // make sure we're not horked from the get-go
+    hr = WcaTableExists(L"Binary");
+    if (S_OK != hr)
+    {
+        if (SUCCEEDED(hr))
+        {
+            hr = E_UNEXPECTED;
+        }
+        ExitOnFailure(hr, "There is no Binary table.");
+    }
+
+    ExitOnNull(wzBinaryId, hr, E_INVALIDARG, "Binary ID cannot be null");
+    ExitOnNull(*wzBinaryId, hr, E_INVALIDARG, "Binary ID cannot be empty string");
+
+    hr = StrAllocFormatted(&pwzSql, L"SELECT `Data` FROM `Binary` WHERE `Name`=\'%s\'", wzBinaryId);
+    ExitOnFailure(hr, "Failed to allocate Binary table query.");
+
+    hr = WcaOpenExecuteView(pwzSql, &hView);
+    ExitOnFailure(hr, "Failed to open view on Binary table");
+
+    hr = WcaFetchSingleRecord(hView, &hRec);
+    ExitOnFailure(hr, "Failed to retrieve request from Binary table");
+
+    hr = WcaGetRecordStream(hRec, 1, pbData, pcbData);
+    ExitOnFailure(hr, "Failed to read Binary.Data.");
+
+LExit:
+    ReleaseStr(pwzSql);
+
+    return hr;
+}
+
+extern "C" UINT __stdcall WixShellExecBinary(
+    __in MSIHANDLE hInstall
+    )
+{
+    Assert(hInstall);
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+    LPWSTR pwzBinary = NULL;
+    LPWSTR pwzFilename = NULL;
+    BYTE* pbData = NULL;
+    DWORD cbData = 0;
+    HANDLE hFile = INVALID_HANDLE_VALUE;
+
+#if 0
+    ::MessageBoxA(0, "WixShellExecBinary", "-->> ATTACH HERE", MB_OK);
+#endif
+
+    hr = WcaInitialize(hInstall, "WixShellExecBinary");
+    ExitOnFailure(hr, "failed to initialize");
+
+    hr = WcaGetFormattedProperty(L"WixShellExecBinaryId", &pwzBinary);
+    ExitOnFailure(hr, "failed to get WixShellExecBinaryId");
+
+    WcaLog(LOGMSG_VERBOSE, "WixShellExecBinaryId is %ls", pwzBinary);
+
+    if (!pwzBinary || !*pwzBinary)
+    {
+        hr = E_INVALIDARG;
+        ExitOnFailure(hr, "failed to get WixShellExecBinaryId");
+    }
+
+    // get temporary path for extracted file
+    StrAlloc(&pwzFilename, MAX_PATH);
+    ExitOnFailure(hr, "Failed to allocate temporary path");
+    ::GetTempPathW(MAX_PATH, pwzFilename);
+    hr = ::StringCchCatW(pwzFilename, MAX_PATH, pwzBinary);
+    ExitOnFailure(hr, "Failed to append filename.");
+
+    // grab the bits
+    hr = ExtractBinary(pwzBinary, &pbData, &cbData);
+    ExitOnFailure(hr, "failed to extract binary data");
+
+    // write 'em to the temp file
+    hFile = ::CreateFileW(pwzFilename, GENERIC_WRITE, FILE_SHARE_READ, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
+    if (INVALID_HANDLE_VALUE == hFile)
+    {
+        ExitWithLastError(hr, "Failed to open new temp file: %ls", pwzFilename);
+    }
+
+    DWORD cbWritten = 0;
+    if (!::WriteFile(hFile, pbData, cbData, &cbWritten, NULL))
+    {
+        ExitWithLastError(hr, "Failed to write data to new temp file: %ls", pwzFilename);
+    }
+
+    // close it
+    ::CloseHandle(hFile);
+    hFile = INVALID_HANDLE_VALUE;
+
+    // and run it
+    hr = ShellExec(pwzFilename, FALSE);
+    ExitOnFailure(hr, "failed to launch target: %ls", pwzFilename);
+
+LExit:
+    ReleaseStr(pwzBinary);
+    ReleaseStr(pwzFilename);
+    ReleaseMem(pbData);
+    if (INVALID_HANDLE_VALUE != hFile)
+    {
+        ::CloseHandle(hFile);
+    }
+
+    if (FAILED(hr)) 
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+    return WcaFinalize(er); 
+}
diff --git a/src/ext/Util/ca/test.cpp b/src/ext/Util/ca/test.cpp
new file mode 100644
index 00000000..c4d215f0
--- /dev/null
+++ b/src/ext/Util/ca/test.cpp
@@ -0,0 +1,269 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
+
+#define WIXCA_UITHREAD_CLASS_WINDOW L"WixCaMessageWindow"
+
+extern HMODULE g_hInstCADLL;
+
+
+// structs
+
+struct UITHREAD_CONTEXT
+{
+    HANDLE hInitializedEvent;
+    HINSTANCE hInstance;
+    HWND hWnd;
+};
+
+
+// internal function declarations
+
+static HRESULT CreateMessageWindow(
+    __out HWND* phWnd
+    );
+
+static void CloseMessageWindow(
+    __in HWND hWnd
+    );
+
+static DWORD WINAPI ThreadProc(
+    __in LPVOID pvContext
+    );
+
+static LRESULT CALLBACK WndProc(
+    __in HWND hWnd,
+    __in UINT uMsg,
+    __in WPARAM wParam,
+    __in LPARAM lParam
+    );
+
+
+/******************************************************************
+WixFailWhenDeferred - entry point for WixFailWhenDeferred
+    custom action which always fails when running as a deferred
+    custom action (otherwise it blindly succeeds). It's useful when
+    testing the rollback of deferred custom actions: Schedule it
+    immediately after the rollback/deferred CA pair you're testing
+    and it will fail, causing your rollback CA to get invoked.
+********************************************************************/
+extern "C" UINT __stdcall WixFailWhenDeferred(
+    __in MSIHANDLE hInstall
+    )
+{
+    return ::MsiGetMode(hInstall, MSIRUNMODE_SCHEDULED) ? ERROR_INSTALL_FAILURE : ERROR_SUCCESS;
+}
+
+/******************************************************************
+WixWaitForEvent - entry point for WixWaitForEvent custom action
+    which waits for either the WixWaitForEventFail or
+    WixWaitForEventSucceed named auto reset events. Signaling the
+    WixWaitForEventFail event will return ERROR_INSTALL_FAILURE or
+    signaling the WixWaitForEventSucceed event will return
+    ERROR_SUCCESS. Both events are declared in the Global\ namespace.
+********************************************************************/
+extern "C" UINT __stdcall WixWaitForEvent(
+    __in MSIHANDLE hInstall
+    )
+{
+    HRESULT hr = S_OK;
+    UINT er = ERROR_SUCCESS;
+    HWND hMessageWindow = NULL;
+    LPCWSTR wzSDDL = L"D:(A;;GA;;;WD)";
+    OS_VERSION version = OS_VERSION_UNKNOWN;
+    DWORD dwServicePack = 0;
+    PSECURITY_DESCRIPTOR pSD = NULL;
+    SECURITY_ATTRIBUTES sa = { };
+    HANDLE rghEvents[2];
+
+    hr = WcaInitialize(hInstall, "WixWaitForEvent");
+    ExitOnFailure(hr, "Failed to initialize.");
+
+    // Create a window to prevent shutdown requests.
+    hr = CreateMessageWindow(&hMessageWindow);
+    ExitOnFailure(hr, "Failed to create message window.");
+
+    // If running on Vista/2008 or newer use integrity enhancements.
+    OsGetVersion(&version, &dwServicePack);
+    if (OS_VERSION_VISTA <= version)
+    {
+        // Add SACL to allow Everyone to signal from a medium integrity level.
+        wzSDDL = L"D:(A;;GA;;;WD)S:(ML;;NW;;;ME)";
+    }
+
+    // Create the security descriptor and attributes for the events.
+    if (!::ConvertStringSecurityDescriptorToSecurityDescriptorW(wzSDDL, SDDL_REVISION_1, &pSD, NULL))
+    {
+        ExitWithLastError(hr, "Failed to create the security descriptor for the events.");
+    }
+
+    sa.nLength = sizeof(sa);
+    sa.lpSecurityDescriptor = pSD;
+    sa.bInheritHandle = FALSE;
+
+    rghEvents[0] = ::CreateEventW(&sa, FALSE, FALSE, L"Global\\WixWaitForEventFail");
+    ExitOnNullWithLastError(rghEvents[0], hr, "Failed to create the Global\\WixWaitForEventFail event.");
+
+    rghEvents[1] = ::CreateEventW(&sa, FALSE, FALSE, L"Global\\WixWaitForEventSucceed");
+    ExitOnNullWithLastError(rghEvents[1], hr, "Failed to create the Global\\WixWaitForEventSucceed event.");
+
+    // Wait for either of the events to be signaled and handle accordingly.
+    er = ::WaitForMultipleObjects(countof(rghEvents), rghEvents, FALSE, INFINITE);
+    switch (er)
+    {
+    case WAIT_OBJECT_0 + 0:
+        er = ERROR_INSTALL_FAILURE;
+        break;
+    case WAIT_OBJECT_0 + 1:
+        er = ERROR_SUCCESS;
+        break;
+    default:
+        ExitOnWin32Error(er, hr, "Unexpected failure.");
+    }
+
+LExit:
+    ReleaseHandle(rghEvents[1]);
+    ReleaseHandle(rghEvents[0]);
+
+    if (pSD)
+    {
+        ::LocalFree(pSD);
+    }
+
+    if (hMessageWindow)
+    {
+        CloseMessageWindow(hMessageWindow);
+    }
+
+    if (FAILED(hr))
+    {
+        er = ERROR_INSTALL_FAILURE;
+    }
+
+    return WcaFinalize(er);
+}
+
+
+// internal function definitions
+
+static HRESULT CreateMessageWindow(
+    __out HWND* phWnd
+    )
+{
+    HRESULT hr = S_OK;
+    HANDLE rgWaitHandles[2] = { };
+    UITHREAD_CONTEXT context = { };
+
+    // Create event to signal after the UI thread / window is initialized.
+    rgWaitHandles[0] = ::CreateEventW(NULL, TRUE, FALSE, NULL);
+    ExitOnNullWithLastError(rgWaitHandles[0], hr, "Failed to create initialization event.");
+
+    // Pass necessary information to create the window.
+    context.hInitializedEvent = rgWaitHandles[0];
+    context.hInstance = (HINSTANCE)g_hInstCADLL;
+
+    // Create our separate UI thread.
+    rgWaitHandles[1] = ::CreateThread(NULL, 0, ThreadProc, &context, 0, NULL);
+    ExitOnNullWithLastError(rgWaitHandles[1], hr, "Failed to create the UI thread.");
+
+    // Wait for either the thread to be initialized or the window to exit / fail prematurely.
+    ::WaitForMultipleObjects(countof(rgWaitHandles), rgWaitHandles, FALSE, INFINITE);
+
+    // Pass the window back to the caller.
+    *phWnd = context.hWnd;
+
+LExit:
+    ReleaseHandle(rgWaitHandles[1]);
+    ReleaseHandle(rgWaitHandles[0]);
+
+    return hr;
+}
+
+static void CloseMessageWindow(
+    __in HWND hWnd
+    )
+{
+    if (::IsWindow(hWnd))
+    {
+        ::PostMessageW(hWnd, WM_CLOSE, 0, 0);
+    }
+}
+
+static DWORD WINAPI ThreadProc(
+    __in LPVOID pvContext
+    )
+{
+    HRESULT hr = S_OK;
+    UITHREAD_CONTEXT* pContext = static_cast<UITHREAD_CONTEXT*>(pvContext);
+
+    WNDCLASSW wc = { };
+    BOOL fRegistered = TRUE;
+    HWND hWnd = NULL;
+
+    BOOL fRet = FALSE;
+    MSG msg = { };
+
+    wc.lpfnWndProc = WndProc;
+    wc.hInstance = pContext->hInstance;
+    wc.lpszClassName = WIXCA_UITHREAD_CLASS_WINDOW;
+
+    if (!::RegisterClassW(&wc))
+    {
+        ExitWithLastError(hr, "Failed to register window.");
+    }
+
+    fRegistered = TRUE;
+
+    // Create the window to handle reboots without activating it.
+    hWnd = ::CreateWindowExW(WS_EX_TOOLWINDOW, wc.lpszClassName, NULL, WS_POPUP | WS_VISIBLE, CW_USEDEFAULT, SW_SHOWNA, 0, 0, HWND_DESKTOP, NULL, pContext->hInstance, NULL);
+    ExitOnNullWithLastError(hWnd, hr, "Failed to create window.");
+
+    // Persist the window handle and let the caller know we've initialized.
+    pContext->hWnd = hWnd;
+    ::SetEvent(pContext->hInitializedEvent);
+
+    // Pump messages until the window is closed.
+    while (0 != (fRet = ::GetMessageW(&msg, NULL, 0, 0)))
+    {
+        if (-1 == fRet)
+        {
+            hr = E_UNEXPECTED;
+            ExitOnFailure(hr, "Unexpected return value from message pump.");
+        }
+        else if (!::IsDialogMessageW(msg.hwnd, &msg))
+        {
+            ::TranslateMessage(&msg);
+            ::DispatchMessageW(&msg);
+        }
+    }
+
+LExit:
+    if (fRegistered)
+    {
+        ::UnregisterClassW(WIXCA_UITHREAD_CLASS_WINDOW, pContext->hInstance);
+    }
+
+    return hr;
+}
+
+static LRESULT CALLBACK WndProc(
+    __in HWND hWnd,
+    __in UINT uMsg,
+    __in WPARAM wParam,
+    __in LPARAM lParam
+    )
+{
+    switch (uMsg)
+    {
+    case WM_QUERYENDSESSION:
+        // Prevent the process from being shut down.
+        WcaLog(LOGMSG_VERBOSE, "Disallowed system request to shut down the custom action server.");
+        return FALSE;
+
+    case WM_DESTROY:
+        ::PostQuitMessage(0);
+        return 0;
+    }
+
+    return ::DefWindowProcW(hWnd, uMsg, wParam, lParam);
+}
diff --git a/src/ext/Util/ca/utilca.cpp b/src/ext/Util/ca/utilca.cpp
new file mode 100644
index 00000000..37664a1c
--- /dev/null
+++ b/src/ext/Util/ca/utilca.cpp
@@ -0,0 +1,3 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+#include "precomp.h"
diff --git a/src/ext/Util/ca/utilca.def b/src/ext/Util/ca/utilca.def
new file mode 100644
index 00000000..412d86a3
--- /dev/null
+++ b/src/ext/Util/ca/utilca.def
@@ -0,0 +1,91 @@
+; Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+
+LIBRARY      "utilca"
+
+EXPORTS
+; BroadcastSettingChange.cpp
+    WixBroadcastSettingChange
+    WixBroadcastEnvironmentChange
+; checkreboot.cpp
+    WixCheckRebootRequired
+; closeapps.cpp
+    WixCloseApplications
+    WixCloseApplicationsDeferred
+; exitearlywithsuccess.cpp
+    WixExitEarlyWithSuccess
+; FormatFiles.cpp
+    WixSchedFormatFiles
+    WixExecFormatFiles
+; osinfo.cpp
+    WixQueryOsInfo
+    WixQueryOsDirs
+    WixQueryOsWellKnownSID
+    WixQueryOsDriverInfo
+; netshortcuts.cpp
+    WixSchedInternetShortcuts
+    WixCreateInternetShortcuts
+    WixRollbackInternetShortcuts
+; qtexecca.cpp
+    CAQuietExec
+    CAQuietExec64
+    WixQuietExec
+    WixQuietExec64
+    WixSilentExec
+    WixSilentExec64
+; RemoveFoldersEx.cpp
+    WixRemoveFoldersEx
+; RemoveRegistryKeysEx.cpp
+    WixRemoveRegistryKeysEx
+;scaexec.cpp
+    RegisterPerfCounterData
+    UnregisterPerfCounterData
+    RegisterPerfmon
+    UnregisterPerfmon
+    CreateSmb
+    DropSmb
+    CreateUser
+    CreateUserRollback
+    RemoveUser
+;scasched.cpp
+    ConfigurePerfmonInstall
+    ConfigurePerfmonUninstall
+    ConfigureSmbInstall
+    ConfigureSmbUninstall
+    ConfigureUsers
+    InstallPerfCounterData
+    UninstallPerfCounterData
+    ConfigurePerfmonManifestRegister
+    ConfigurePerfmonManifestUnregister
+    ConfigureEventManifestRegister
+    ConfigureEventManifestUnregister
+; RestartManager.cpp
+    WixRegisterRestartResources
+; secureobj.cpp
+    SchedSecureObjects
+    SchedSecureObjectsRollback
+    ExecSecureObjects
+    ExecSecureObjectsRollback
+; serviceconfig.cpp
+    SchedServiceConfig
+    ExecServiceConfig
+    RollbackServiceConfig
+; shellexecca.cpp
+    WixShellExec
+    WixShellExecBinary
+    WixUnelevatedShellExec
+; test.cpp
+    WixFailWhenDeferred
+    WixWaitForEvent
+; TouchFile.cpp
+    WixTouchFileDuringInstall
+    WixTouchFileDuringUninstall
+    WixExecuteTouchFile
+; xmlfile.cpp
+    SchedXmlFile
+    ExecXmlFile
+    ExecXmlFileRollback
+; xmlconfig.cpp
+    SchedXmlConfig
+    ExecXmlConfig
+    ExecXmlConfigRollback
diff --git a/src/ext/Util/ca/utilca.vcxproj b/src/ext/Util/ca/utilca.vcxproj
new file mode 100644
index 00000000..7b64db95
--- /dev/null
+++ b/src/ext/Util/ca/utilca.vcxproj
@@ -0,0 +1,106 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->
+
+<Project DefaultTargets="Build" ToolsVersion="16.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|ARM64">
+      <Configuration>Debug</Configuration>
+      <Platform>ARM64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|ARM64">
+      <Configuration>Release</Configuration>
+      <Platform>ARM64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|X64">
+      <Configuration>Debug</Configuration>
+      <Platform>X64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|X64">
+      <Configuration>Release</Configuration>
+      <Platform>X64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>{076018F7-19BD-423A-ABBF-229273DA08D8}</ProjectGuid>
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <TargetName>utilca</TargetName>
+    <PlatformToolset>v142</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+    <ProjectModuleDefinitionFile>utilca.def</ProjectModuleDefinitionFile>
+    <Description>WiX Toolset Util CustomAction</Description>
+  </PropertyGroup>
+
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+
+  <PropertyGroup>
+    <ProjectAdditionalLinkLibraries>activeds.lib;adsiid.lib;msi.lib;netapi32.lib;shlwapi.lib</ProjectAdditionalLinkLibraries>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ClCompile Include="BroadcastSettingChange.cpp" />
+    <ClCompile Include="CheckReboot.cpp" />
+    <ClCompile Include="CloseApps.cpp" />
+    <ClCompile Include="dllmain.cpp">
+      <PrecompiledHeader>Create</PrecompiledHeader>
+    </ClCompile>
+    <ClCompile Include="exitearlywithsuccess.cpp" />
+    <ClCompile Include="FormatFiles.cpp" />
+    <ClCompile Include="netshortcuts.cpp" />
+    <ClCompile Include="OsInfo.cpp" />
+    <ClCompile Include="qtexecca.cpp" />
+    <ClCompile Include="RemoveFoldersEx.cpp" />
+    <ClCompile Include="RemoveRegistryKeysEx.cpp" />
+    <ClCompile Include="RestartManager.cpp" />
+    <ClCompile Include="scaexec.cpp" />
+    <ClCompile Include="scamanifest.cpp" />
+    <ClCompile Include="scaperf.cpp" />
+    <ClCompile Include="scaperfexec.cpp" />
+    <ClCompile Include="scasched.cpp" />
+    <ClCompile Include="scasmbexec.cpp" />
+    <ClCompile Include="scasmbsched.cpp" />
+    <ClCompile Include="scauser.cpp" />
+    <ClCompile Include="secureobj.cpp" />
+    <ClCompile Include="serviceconfig.cpp" />
+    <ClCompile Include="shellexecca.cpp" />
+    <ClCompile Include="test.cpp" />
+    <ClCompile Include="TouchFile.cpp" />
+    <ClCompile Include="utilca.cpp" />
+    <ClCompile Include="XmlConfig.cpp" />
+    <ClCompile Include="XmlFile.cpp" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ClInclude Include="caDecor.h" />
+    <ClInclude Include="cost.h" />
+    <ClInclude Include="CustomMsiErrors.h" />
+    <ClInclude Include="precomp.h" />
+    <ClInclude Include="sca.h" />
+    <ClInclude Include="scacost.h" />
+    <ClInclude Include="scasmb.h" />
+    <ClInclude Include="scasmbexec.h" />
+    <ClInclude Include="scauser.h" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <None Include="utilca.def" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <PackageReference Include="WixToolset.Dutil" Version="4.0.72" />
+    <PackageReference Include="WixToolset.WcaUtil" Version="4.0.19" />
+    <PackageReference Include="Microsoft.SourceLink.GitHub" Version="1.0.0" />
+    <PackageReference Include="Nerdbank.GitVersioning" Version="3.3.37" />
+  </ItemGroup>
+
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+</Project>