[wix-users] Burn - elevated pipe closed

[Jacques Eloff]

Hi

I came across an issue yesterday where a bundle starts to install (it
installed about 3 or 4 MSI) and then everything stopped.


I looked at Bundle - pipe broke by AntiVirus software · Issue #5658 ·
wixtoolset/issues (github.com)
<https://github.com/wixtoolset/issues/issues/5658>, but it doesn't fit. A/V
usually blocks elevation completely. And the installer is signed and the
machine is running Defender, not the other A/V software identified in the
issue.

The last MSI that was executing was trying to launch a custom action (it's
not the CA). The last entry in the MSI log was that it was going to launch
it, and then it just hung. The MSI log itself is incomplete.

I scanned the machine with process explorer and the CA wasn't launched at
all. It was as if InstallExecute just got "stuck". After about 20 minutes
the install was cancelled and that's when the pipe errors were logged.

[5364:6DF4][2021-02-08T17:03:54]e000: Error 0x800700e8: Failed to write
message type to pipe.
[5364:6DF4][2021-02-08T17:03:54]e000: Error 0x800700e8: Failed to write
send message to pipe.
[5364:6DF4][2021-02-08T17:03:54]e000: Error 0x800700e8: Failed to send
BURN_ELEVATION_MESSAGE_TYPE_EXECUTE_MSI_PACKAGE message to per-machine
process.
[5364:6DF4][2021-02-08T17:03:54]e000: Error 0x800700e8: Failed to configure
per-machine MSI package.

I thought the MSI log would get flushed when the install was cancelled, but
it appears nothing else was written, which made me wonder if the installer
service itself was having a bad day. The Windows Event Viewer has been
cryptically empty except for a single event that said: "the program stopped
interacting with Windows and was closed" along with "Faulting
package-relative application ID:
Hang type: Top level window is idle"

Has anyone seen this sort of behavior?

Thanks,
Jacques