Configure Windows Service to Run Under a User Account with a Runtime-Generated Password in Advanced Installer

[aniketsw]

Hi everyone,

We're currently working on an installer using Advanced Installer 22.9 and have run into a challenge configuring Windows service credentials.

Scenario

During installation, we create a dedicated local Windows user account (for example,Service_user) that will be used to run two Windows services.

The requirements are:

* The username is created during installation and is available at runtime.
* For security reasons, the password is randomly generated during installation.
* The password is never known in advance and should not be hardcoded or stored in the installer package.
* Both Windows services must be installed to run under this newly created user account.

Problem

We can successfully determine the username at runtime, but we're unsure how to provide the dynamically generated password to the Windows Service configuration.

Since the password only exists during installation, we need a secure way to configure the services without exposing or hardcoding the password.

Questions

1. What is the recommended approach in Advanced Installer for configuring a Windows service to run under a user account whose password is generated during installation?
2. Is there a supported way to pass the generated password to the Windows Service configuration?
3. Does Advanced Installer provide any built-in support (properties, custom actions, or service configuration options) for this scenario?



Our goal is to securely configure both services to run under the newly created account and have them start successfully immediately after installation.

Has anyone implemented a similar scenario using Advanced Installer? We'd appreciate any guidance or recommendations on the best and most secure approach.

Thank you!

[Catalin]

Hello and welcome to our forums,

What you have done seems to be correct.

First of all, we need to ensure that the custom action that dynamically generates the password at install time is ran early in the sequence.

Then, we need to make sure that we set SERVICE_PASSWORD property to the value of the dynamically generated password. If you do so via a PowerShell script, you can use the AI_SetMsiProperty.

How to set an installer property using a custom action

Did you try this approach and encountered a problem? If so, could you please share some details with me so I can better assist?

Best regards,
Catalin