How to set Burn EngineWorkingDirectory

[lumberjack4]

I'm creating a WiXv4 install bundle and running into a security policy issue where the installer executable can't be launched from the %TEMP% directory. I see in the release notes that I am supposed to be able to set a registry value at HKLM\Software\Policies\Wix\Burn to control this.

I have created a String Value of EngineWorkingDirectory in the above location set to C:\test and rebuilt the bundle but the Windows application log is still showing that the installer is executing out of C:\Windows\Temp\{guid}\.cr\installer.exe and is subsequently blocked. Since the documentation for v4 is still in progress I don't have anything to fall back on to understand if I'm using the capability correctly or missing something. Any help would be appreciated.

[rseanhall]

That appears to be the correct location in the registry with a valid path, but the directory that is specified must already exist. This is because it is only used when the bundle is running elevated, and you are expected to lock this folder down to only allow administrators to access it.

[lumberjack4]

Ok, didn't realize the folder already needed to exist. Doing that appears to make everything work. So if I was deploying this across an enterprise I really need to bootstrap the bootstrapper to ensure the registry key and folder are created before executing the installer itself correct?

[rseanhall]

The enterprise should be setting the registry key and setting up the folder. If they want to lock down their environment by preventing things from running from C:\Windows\Temp, then I would think they wouldn't be very happy if applications are setting security settings like this themselves.

[robmen]

The registry is under the Policies key so that it can be published via GPO. The selected folder does need to exist with secure ACLs and can't be guessed. The IT admin will need to pick that based on the configuration of the machines in their organization.

[lumberjack4]

Ok, I understand the approach you're using now, thanks.

[rseanhall]

There is no problem with the selected folder having a guessable name. It is used as the base folder instead of %TEMP%. Burn will create the standard temporary directory as usual with a name of a random guid inside of that folder.