title: Automation. Impersonate Windows Installer from Windows Service
body: <p>I'm currently working on windows app which needs to deploy some modules under the current user's account. This application is composed of a client application (USER account) and a windows service (SYSTEM account). IPC is done via COM. Windows service is responsible for the deployment. Each module is bundled in the msi package.</p>
  
  <p>My intention is to install a requested package under the <strong>USER</strong> account.</p>
  
  <p>I use Windows Installer (msiexec.exe) to install packages as follows:</p>
  
  <pre><code>// Windows service's routine:
  ...
  // Being impersonated as client:
  token_t primary = PrimaryToken::FromCurrentThread();
  ...
  ::CreateProcessAsUserW(primary, pathMsiExec.c_str(), cmdLine.c_str(), ...)
  ...
  WaitForProcess(msi);
  ...
  </code></pre>
  
  <p>This approach works fairy well. But I want to engage the <a href="http://msdn.microsoft.com/en-us/library/windows/desktop/aa367809%28v=vs.85%29.aspx" rel="nofollow">Windows Installer Automation API</a> since it allows me to use transactions and may give me a control over the installation process.</p>
  
  <p>But I'm unable to make this API to work impersonated. The following code may clarify the problem:</p>
  
  <pre><code>// Windows service's routine:
  // Being impersonated
  ATL::CComQIPtr&lt;WindowsInstaller::Installer&gt; installerInstance;
  
  GUID clsid;
  check(::CLSIDFromProgID(L"WindowsInstaller.Installer", &amp;clsid));
  check(installerInstance.CoCreateInstance(clsid));
  // Allow delegation of impersonation token
  check(::CoSetProxyBlanket(
      installerInstance
      , RPC_C_AUTHN_DEFAULT
      , RPC_C_AUTHZ_DEFAULT
      , NULL
      , RPC_C_AUTHN_LEVEL_DEFAULT
      , RPC_C_IMP_LEVEL_DELEGATE
      , NULL
      , EOAC_DYNAMIC_CLOAKING))
  
  installerInstance-&gt;InstallProduct(path, props)
  //
  </code></pre>
  
  <p>Even though I delegate client's impersonation token, the Windows installer always installs packages under the system account.</p>
  
  <p>Can somebody give me an advice how to make it work properly?
  OS is Windows 7, MSI v5.0</p>