Install UCRT from MSUs, not using nested VC Redist install

Using nested install is bad because (1) MS advises against it (though it
most possibly doesn't relate to our specific case, when we install the
vc redist exe package in UI part, so actually only a single MSI session
is active at any time); (2) because it adds some extra interactions
(user sees something "unrelated" being installed, which raises concerns;
additional admin authentication required); and (3) because it runs in
InstallUISequence, thus only installing the UCRT when doing interactive
installation (unattended installs, including GPO, need to install UCRT
separately).

This patch aims to incorporate the original UCRT MSU (Windows Update)
packages (https://support.microsoft.com/en-us/help/2999226) available as
a zip archive from
https://www.microsoft.com/en-us/download/details.aspx?id=48234
- the same as used in VC redists for VS 2015 and 2017. This obsoletes
the separate installation of the redist; since we also have the redist
as merge module in our MSI, that is enough (and removes redundancy).
The MSUs are installed using wusa.exe in a custom action (deferred,
non-impersonating).

As a small bonus, embedding MSUs instead of redist EXE allows us to
shrink the size of installer a little (~10 MB).

As deferred custom actions cannot access current installer database,
we workaround this by using initial immediate impersonating action to
extract the binaries into a temporary location. To ensure that the file
gets removed upon completion (both successful and failed), we use an
additional cleanup action.

Commit 61b1d631331551b43bc7d619be33bfbfeff7cad6 is effectively reverted.

This commit also includes changes from commits from master:
8faa1bc61fa8f09365d483364aea2b1c2751b587
1f8a3657216e44796cb94087450552aa977ebdae
378c1576d2890625ebbd18ec9ccff560eeb1619f

Change-Id: I1529356fdcc67ff24b232c01ddf8bb3a31bb00bd
Reviewed-on: https://gerrit.libreoffice.org/53332
Reviewed-by: Andras Timar <andras.timar@collabora.com>
Tested-by: Andras Timar <andras.timar@collabora.com>

26 files changed, 835 insertions, 42 deletions

diff --git a/Repository.mk b/Repository.mk
index 963d58695d50..008874852f26 100644
--- a/Repository.mk
+++ b/Repository.mk
@@ -666,6 +666,7 @@ endif
 $(eval $(call gb_Helper_register_libraries_for_install,PLAINLIBS_OOO,ooobinarytable, \
 	$(if $(WINDOWS_SDK_HOME),\
 		instooofiltmsi \
+		inst_msu_msi \
 		qslnkmsi \
 		reg4allmsdoc \
 		sdqsmsi \
@@ -834,7 +835,6 @@ $(eval $(call gb_Helper_register_packages_for_install,ure,\
 		jvmfwk_jreproperties \
 		$(if $(filter MACOSX,$(OS)),bridges_jnilib_java_uno) \
 	) \
-	$(if $(UCRT_REDISTDIR),ucrt) \
 ))
 
 $(eval $(call gb_Helper_register_packages_for_install,postgresqlsdbc,\
diff --git a/RepositoryExternal.mk b/RepositoryExternal.mk
index cb63070e09b9..a1acdbbc0cc8 100644
--- a/RepositoryExternal.mk
+++ b/RepositoryExternal.mk
@@ -4086,4 +4086,8 @@ $(eval $(call gb_Helper_register_libraries_for_install,OOOLIBS,ooo,\
 ))
 endif
 
+$(eval $(call gb_Helper_register_packages_for_install,ucrt_binarytable,\
+	$(if $(UCRT_REDISTDIR),ucrt) \
+))
+
 # vim: set noet sw=4 ts=4:
diff --git a/config_host.mk.in b/config_host.mk.in
index c74a097b937b..2dc4e1ba7ed3 100644
--- a/config_host.mk.in
+++ b/config_host.mk.in
@@ -576,7 +576,6 @@ export TOUCH=@TOUCH@
 export UCRTSDKDIR=@UCRTSDKDIR@
 export UCRTVERSION=@UCRTVERSION@
 export UCRT_REDISTDIR=@UCRT_REDISTDIR@
-export UCRT_DLLS=@UCRT_DLLS@
 export UNOWINREG_DLL=@UNOWINREG_DLL@
 export USE_LIBRARY_BIN_TAR=@USE_LIBRARY_BIN_TAR@
 export USE_XINERAMA=@USE_XINERAMA@
diff --git a/configure.ac b/configure.ac
index 4c2f914de059..c37ca3ee975a 100644
--- a/configure.ac
+++ b/configure.ac
@@ -6704,9 +6704,17 @@ AC_SUBST([JITC_PROCESSOR_TYPE])
 # Misc Windows Stuff
 AC_ARG_WITH(ucrt-dir,
     AS_HELP_STRING([--with-ucrt-dir],
-        [path to the directory with the arch-specific subdirectories of the Windows Universtal CRT redistributables
-        from the Windows 10 SDK for packaging into the installsets (without those the target system needs to install
-        the Visual C++ Runtimes manually)]),
+        [path to the directory with the arch-specific MSU packages of the Windows Universal CRT redistributables
+        (MS KB 2999226) for packaging into the installsets (without those the target system needs to install
+        the UCRT or Visual C++ Runtimes manually). The directory must contain the following 6 files:
+            Windows6.1-KB2999226-x64.msu
+            Windows6.1-KB2999226-x86.msu
+            Windows8.1-KB2999226-x64.msu
+            Windows8.1-KB2999226-x86.msu
+            Windows8-RT-KB2999226-x64.msu
+            Windows8-RT-KB2999226-x86.msu
+        A zip archive including those files is available from Microsoft site:
+        https://www.microsoft.com/en-us/download/details.aspx?id=48234]),
 ,)
 UCRT_REDISTDIR="$with_ucrt_dir"
 if test $_os = "WINNT"; then
@@ -6715,30 +6723,38 @@ if test $_os = "WINNT"; then
     MSVC_DLL_PATH="$msvcdllpath"
     MSVC_DLLS="$msvcdlls"
     MSM_PATH="$msmdir"
-    SCPDEFS="$SCPDEFS -DWITH_VC${VCVER}_REDIST"
+    # MSVC 15.3 changed it to VC141
+    if echo "$MSVC_DLL_PATH" | grep -q "VC141.CRT$"; then
+        SCPDEFS="$SCPDEFS -DWITH_VC141_REDIST"
+    else
+        SCPDEFS="$SCPDEFS -DWITH_VC${VCVER}_REDIST"
+    fi
     if test "$UCRT_REDISTDIR" = "no"; then
         dnl explicitly disabled
         UCRT_REDISTDIR=""
     else
-        UCRT_REDISTDIR="$UCRT_REDISTDIR/$WINDOWS_SDK_ARCH"
-        # https://blogs.msdn.microsoft.com/vcblog/2015/03/03/introducing-the-universal-crt/
-        # "note that the set of DLLs are necessary is different on different
-        #  versions of Windows, so you must include all of the DLLs in order for
-        #  your program to run on all supported versions of Windows"
-        if test -f "$UCRT_REDISTDIR/ucrtbase.dll"; then
-            cd "$UCRT_REDISTDIR";
-            UCRT_DLLS=$(ls *.dll | paste -d " " -s)
-            cd -
-        else
+        if ! test -f "$UCRT_REDISTDIR/Windows6.1-KB2999226-x64.msu" -a \
+                  -f "$UCRT_REDISTDIR/Windows6.1-KB2999226-x86.msu" -a \
+                  -f "$UCRT_REDISTDIR/Windows8.1-KB2999226-x64.msu" -a \
+                  -f "$UCRT_REDISTDIR/Windows8.1-KB2999226-x86.msu" -a \
+                  -f "$UCRT_REDISTDIR/Windows8-RT-KB2999226-x64.msu" -a \
+                  -f "$UCRT_REDISTDIR/Windows8-RT-KB2999226-x86.msu"; then
             UCRT_REDISTDIR=""
-            AC_MSG_WARN([No --with-ucrt-dir not specified or dlls not found - installer will have runtime dependency])
-            add_warning "No --with-ucrt-dir not specified or dlls not found - installer will have runtime dependency"
+            if test -n "$PKGFORMAT"; then
+               for i in "$PKGFORMAT"; do
+                   case "$i" in
+                   msi)
+                       AC_MSG_WARN([--without-ucrt-dir not specified or MSUs not found - installer will have runtime dependency])
+                       add_warning "--without-ucrt-dir not specified or MSUs not found - installer will have runtime dependency"
+                       ;;
+                   esac
+               done
+            fi
         fi
     fi
 fi
 
 AC_SUBST(UCRT_REDISTDIR)
-AC_SUBST(UCRT_DLLS)
 AC_SUBST(MSVC_DLL_PATH)
 AC_SUBST(MSVC_DLLS)
 AC_SUBST(MSM_PATH)
diff --git a/external/msc-externals/Module_msc-externals.mk b/external/msc-externals/Module_msc-externals.mk
index 1e37d97a0475..07ea3878a106 100644
--- a/external/msc-externals/Module_msc-externals.mk
+++ b/external/msc-externals/Module_msc-externals.mk
@@ -9,13 +9,15 @@
 
 $(eval $(call gb_Module_Module,msc-externals))
 
+ifneq ($(BUILD_X64),)
+
 $(eval $(call gb_Module_add_targets,msc-externals,\
 	Package_msvc_dlls \
 ))
 
-# TODO: hackaround to install the universal crts locally (tdf#108580)
-# ideally we can create a chained installer or similar that installs them
-# systemwide using windows update
+endif
+
+# Install the universal crts (tdf#108580)
 ifneq ($(UCRT_REDISTDIR),)
 
 $(eval $(call gb_Module_add_targets,msc-externals,\
diff --git a/external/msc-externals/Package_ucrt.mk b/external/msc-externals/Package_ucrt.mk
index 05d51d369f47..52e6f0cbae97 100644
--- a/external/msc-externals/Package_ucrt.mk
+++ b/external/msc-externals/Package_ucrt.mk
@@ -9,8 +9,13 @@
 
 $(eval $(call gb_Package_Package,ucrt,$(UCRT_REDISTDIR)))
 
-$(eval $(call gb_Package_add_files,ucrt,program,\
-	   $(UCRT_DLLS) \
+$(eval $(call gb_Package_add_files,ucrt,$(LIBO_ETC_FOLDER),\
+    Windows6.1-KB2999226-x64.msu \
+    Windows6.1-KB2999226-x86.msu \
+    Windows8.1-KB2999226-x64.msu \
+    Windows8.1-KB2999226-x86.msu \
+    Windows8-RT-KB2999226-x64.msu \
+    Windows8-RT-KB2999226-x86.msu \
 ))
 
 # vim:set shiftwidth=4 tabstop=4 noexpandtab:
diff --git a/instsetoo_native/inc_ooohelppack/windows/msi_templates/Control.idt b/instsetoo_native/inc_ooohelppack/windows/msi_templates/Control.idt
index 55f1fcfe6b20..24c02f85f7b8 100644
--- a/instsetoo_native/inc_ooohelppack/windows/msi_templates/Control.idt
+++ b/instsetoo_native/inc_ooohelppack/windows/msi_templates/Control.idt
@@ -249,7 +249,7 @@ SetupError	I	PushButton	192	80	66	17	3		OOO_CONTROL_207
 SetupError	N	PushButton	192	80	66	17	3		OOO_CONTROL_208		
 SetupError	O	PushButton	192	80	66	17	3		OOO_CONTROL_209		
 SetupError	R	PushButton	192	80	66	17	3		OOO_CONTROL_210		
-SetupError	WarningIcon	Icon	15	15	24	24	5242881		CautionIco		
+SetupError	ErrorIcon	Icon	15	15	24	24	5242881		CautionIco		
 SetupError	Y	PushButton	192	80	66	17	3		OOO_CONTROL_211		
 SetupInitialization	ActionData	Text	135	125	228	12	65539				
 SetupInitialization	ActionText	Text	135	109	220	36	65539				
diff --git a/instsetoo_native/inc_openoffice/windows/msi_languages/CustomAc.ulf b/instsetoo_native/inc_openoffice/windows/msi_languages/CustomAc.ulf
index 742cb8cbfb84..1038d6ca5679 100644
--- a/instsetoo_native/inc_openoffice/windows/msi_languages/CustomAc.ulf
+++ b/instsetoo_native/inc_openoffice/windows/msi_languages/CustomAc.ulf
@@ -21,6 +21,3 @@ en-US  = "A newer version of [ProductName] was found. To install an older versio
 
 [OOO_CUSTOMACTION_2]
 en-US  = "The same version of this product is already installed."
-
-[OOO_CUSTOMACTION_5]
-en-US = "[ProductName] cannot be installed on this Windows version. [WindowsMinVersionText] or newer is required."
diff --git a/instsetoo_native/inc_openoffice/windows/msi_languages/LaunchCo.ulf b/instsetoo_native/inc_openoffice/windows/msi_languages/LaunchCo.ulf
index e3f6f7fa8f53..5e57eb1c3c0e 100644
--- a/instsetoo_native/inc_openoffice/windows/msi_languages/LaunchCo.ulf
+++ b/instsetoo_native/inc_openoffice/windows/msi_languages/LaunchCo.ulf
@@ -1,2 +1,6 @@
 [OOO_LAUNCH_1]
 en-US = "The Installation Wizard cannot be run properly because you are logged in as a user without sufficient administrator rights for this system."
+[OOO_LAUNCH_2]
+en-US = "[ProductName] cannot be installed on this Windows version. [WindowsMinVersionText] or newer is required."
+[OOO_LAUNCH_3]
+en-US = "To install [ProductName] on Windows 8.1, at least April 2014 update rollup (MS KB 2919355) must be installed."
diff --git a/instsetoo_native/inc_openoffice/windows/msi_templates/AppSearc.idt b/instsetoo_native/inc_openoffice/windows/msi_templates/AppSearc.idt
index 3968375a8815..23c2a77c9f5d 100644
--- a/instsetoo_native/inc_openoffice/windows/msi_templates/AppSearc.idt
+++ b/instsetoo_native/inc_openoffice/windows/msi_templates/AppSearc.idt
@@ -5,3 +5,6 @@ INSTALLLOCATION	installuser
 INSTALLLOCATION	installuser_
 INSTALLLOCATION	installmachine
 INSTALLLOCATION	installmachine_
+WIN81S14	win81s14
+UCRT_DETECTED	ucrt_detected
+UCRT_DETECTED	ucrt_on_win10
diff --git a/instsetoo_native/inc_openoffice/windows/msi_templates/Control.idt b/instsetoo_native/inc_openoffice/windows/msi_templates/Control.idt
index f90d76f5717b..9871b7d3b8cd 100644
--- a/instsetoo_native/inc_openoffice/windows/msi_templates/Control.idt
+++ b/instsetoo_native/inc_openoffice/windows/msi_templates/Control.idt
@@ -253,7 +253,7 @@ SetupError	I	PushButton	192	80	66	17	3		OOO_CONTROL_207
 SetupError	N	PushButton	192	80	66	17	3		OOO_CONTROL_208		
 SetupError	O	PushButton	192	80	66	17	3		OOO_CONTROL_209		
 SetupError	R	PushButton	192	80	66	17	3		OOO_CONTROL_210		
-SetupError	WarningIcon	Icon	15	15	24	24	5242881		CautionIco		
+SetupError	ErrorIcon	Icon	15	15	24	24	5242881		CautionIco		
 SetupError	Y	PushButton	192	80	66	17	3		OOO_CONTROL_211		
 SetupInitialization	ActionData	Text	135	125	228	12	65539				
 SetupInitialization	ActionText	Text	135	109	220	36	65539				
diff --git a/instsetoo_native/inc_openoffice/windows/msi_templates/CustomAc.idt b/instsetoo_native/inc_openoffice/windows/msi_templates/CustomAc.idt
index 602c683b85d6..784041a5e672 100644
--- a/instsetoo_native/inc_openoffice/windows/msi_templates/CustomAc.idt
+++ b/instsetoo_native/inc_openoffice/windows/msi_templates/CustomAc.idt
@@ -8,7 +8,6 @@ SetARPInstallLocation	51	ARPINSTALLLOCATION	[INSTALLLOCATION]
 SetARPNoRemove	51	ARPNOREMOVE	1
 NewProductFound	19		OOO_CUSTOMACTION_1
 SameProductFound	19		OOO_CUSTOMACTION_2
-WrongWindowsVersion	19		OOO_CUSTOMACTION_5
 SetLanguageSelected	51	LANG_SELECTED	1
 ResetLanguageSelected	51	LANG_SELECTED	0
 SetApplicationSelected	51	APP_SELECTED	1
diff --git a/instsetoo_native/inc_openoffice/windows/msi_templates/DrLocato.idt b/instsetoo_native/inc_openoffice/windows/msi_templates/DrLocato.idt
new file mode 100644
index 000000000000..399011e166ca
--- /dev/null
+++ b/instsetoo_native/inc_openoffice/windows/msi_templates/DrLocato.idt
@@ -0,0 +1,6 @@
+Signature_	Parent	Path	Depth
+s72	S72	S255	I2
+DrLocator	Signature_	Parent	Path
+win81s14		[SystemFolder]	
+ucrt_detected		[SystemFolder]	
+ucrt_on_win10		[SystemFolder]	
diff --git a/instsetoo_native/inc_openoffice/windows/msi_templates/LaunchCo.idt b/instsetoo_native/inc_openoffice/windows/msi_templates/LaunchCo.idt
index e4d3f330b006..629c3c5582e1 100644
--- a/instsetoo_native/inc_openoffice/windows/msi_templates/LaunchCo.idt
+++ b/instsetoo_native/inc_openoffice/windows/msi_templates/LaunchCo.idt
@@ -2,3 +2,5 @@ Condition	Description
 s255	l255
 65001	LaunchCondition	Condition
 Privileged	OOO_LAUNCH_1
+Installed Or VersionNT > WindowsMinVersionNumber Or (VersionNT = WindowsMinVersionNumber And ServicePackLevel >= WindowsMinSPNumber)	OOO_LAUNCH_2
+Installed Or VersionNT <> 603 Or WIN81S14	OOO_LAUNCH_3
diff --git a/instsetoo_native/inc_openoffice/windows/msi_templates/Signatur.idt b/instsetoo_native/inc_openoffice/windows/msi_templates/Signatur.idt
index 5004a55863ba..53615298dc6d 100644
--- a/instsetoo_native/inc_openoffice/windows/msi_templates/Signatur.idt
+++ b/instsetoo_native/inc_openoffice/windows/msi_templates/Signatur.idt
@@ -1,3 +1,16 @@
 Signature	FileName	MinVersion	MaxVersion	MinSize	MaxSize	MinDate	MaxDate	Languages
 s72	s255	S20	S20	I4	I4	I4	I4	S255
 Signature	Signature
+# Since it's impossible to match minimal version in Signature table independent of
+# language, and we need language-independent comparison, we use a value that is at
+# least 1 less (see note at https://msdn.microsoft.com/en-us/library/aa371853).
+win81s14	kernel32.dll	6.3.9600.17030						
+ucrt_detected	ucrtbase.dll	10.0.10240.0						
+# The great feature of all recent Windows is that they make it incredibly hard to find their
+# actual versions. Win 10 makes the next step in that direction: not only it tells you that
+# its version is 6.3 (VersionNT is 603), but also it disallows you to get real version of a
+# file during installation, if the version is greater than 6.3. So, for ucrt DLLs versioned
+# by MS as 10.0.x.y, it returns 6.3.x.y, pretending to have a lower version than on Win8.1.
+# Here we check for this, knowing that we get a version below 7.0 for UCRT that never had a
+# version below 10.0, then it's Win10+ that is lying to us.
+ucrt_on_win10	ucrtbase.dll		7.0.0.0					
diff --git a/instsetoo_native/inc_sdkoo/windows/msi_templates/Control.idt b/instsetoo_native/inc_sdkoo/windows/msi_templates/Control.idt
index 9bc37a8ed840..d9ac9d1a550a 100644
--- a/instsetoo_native/inc_sdkoo/windows/msi_templates/Control.idt
+++ b/instsetoo_native/inc_sdkoo/windows/msi_templates/Control.idt
@@ -236,7 +236,7 @@ SetupError	I	PushButton	192	80	66	17	3		OOO_CONTROL_207
 SetupError	N	PushButton	192	80	66	17	3		OOO_CONTROL_208		
 SetupError	O	PushButton	192	80	66	17	3		OOO_CONTROL_209		
 SetupError	R	PushButton	192	80	66	17	3		OOO_CONTROL_210		
-SetupError	WarningIcon	Icon	15	15	24	24	5242881		CautionIco		
+SetupError	ErrorIcon	Icon	15	15	24	24	5242881		CautionIco		
 SetupError	Y	PushButton	192	80	66	17	3		OOO_CONTROL_211		
 SetupInitialization	ActionData	Text	135	125	228	12	65539				
 SetupInitialization	ActionText	Text	135	109	220	36	65539				
diff --git a/postprocess/CustomTarget_signing.mk b/postprocess/CustomTarget_signing.mk
index 535404d505fc..0d9cfaaf6771 100644
--- a/postprocess/CustomTarget_signing.mk
+++ b/postprocess/CustomTarget_signing.mk
@@ -32,8 +32,7 @@ ifneq ($(ENABLE_DBGUTIL),TRUE)
 	EXCLUDELIST=$(shell $(gb_MKTEMP)) && \
 	cat $(SRCDIR)/postprocess/signing/no_signing.txt > $$EXCLUDELIST && \
 	echo "$(foreach lib,$(gb_MERGEDLIBS),$(call gb_Library_get_filename,$(lib)))" | tr ' ' '\n' >> $$EXCLUDELIST && \
-	$(if $(UCRT_REDISTDIR),chmod u+w $(foreach lib,$(UCRT_DLLS),$(INSTDIR)/$(LIBO_URE_LIB_FOLDER)/$(lib)) &&) \
-	chmod u+w $(foreach lib,$(MSVC_DLLS),$(INSTDIR)/program/shlxthdl/$(lib)) && \
+	$(if $(BUILD_X64),chmod u+w $(foreach lib,$(MSVC_DLLS),$(INSTDIR)/program/shlxthdl/$(lib)) &&) \
 	$(PERL) $(SRCDIR)/postprocess/signing/signing.pl \
 			-e $$EXCLUDELIST \
 			-l $(subst .done,_log.txt,$@) \
diff --git a/postprocess/signing/no_signing.txt b/postprocess/signing/no_signing.txt
index 53aaac652c2b..6de68e2e8cc2 100644
--- a/postprocess/signing/no_signing.txt
+++ b/postprocess/signing/no_signing.txt
@@ -8,3 +8,9 @@ policy.1.0.cli_oootypes.dll
 policy.1.0.cli_ure.dll
 policy.1.0.cli_cppuhelper.dll
 policy.1.0.cli_basetypes.dll
+Windows6.1-KB2999226-x64.msu
+Windows6.1-KB2999226-x86.msu
+Windows8.1-KB2999226-x64.msu
+Windows8.1-KB2999226-x86.msu
+Windows8-RT-KB2999226-x64.msu
+Windows8-RT-KB2999226-x86.msu
diff --git a/scp2/InstallModule_windows.mk b/scp2/InstallModule_windows.mk
index 296f7fccfa5b..bd6e478e7785 100644
--- a/scp2/InstallModule_windows.mk
+++ b/scp2/InstallModule_windows.mk
@@ -22,6 +22,7 @@ $(eval $(call gb_InstallModule_add_defs,scp2/windows,\
 $(eval $(call gb_InstallModule_add_scpfiles,scp2/windows,\
     scp2/source/ooo/folder_ooo \
     $(if $(MSM_PATH),scp2/source/ooo/vc_redist) \
+    $(if $(UCRT_REDISTDIR),scp2/source/ooo/ucrt) \
     scp2/source/ooo/windowscustomaction_ooo \
 ))
 
diff --git a/scp2/source/ooo/ucrt.scp b/scp2/source/ooo/ucrt.scp
new file mode 100644
index 000000000000..4a13309f6364
--- /dev/null
+++ b/scp2/source/ooo/ucrt.scp
@@ -0,0 +1,154 @@
+/*
+ * This file is part of the LibreOffice project.
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+#include "macros.inc"
+
+File gid_File_Windows6_1_KB2999226_x64_msu
+    Name = "Windows6.1-KB2999226-x64.msu";
+    Dir = gid_Brand_Dir_Program;
+    Styles = (PACKED, BINARYTABLE, BINARYTABLE_ONLY);
+End
+
+File gid_File_Windows8_RT_KB2999226_x64_msu
+    Name = "Windows8-RT-KB2999226-x64.msu";
+    Dir = gid_Brand_Dir_Program;
+    Styles = (PACKED, BINARYTABLE, BINARYTABLE_ONLY);
+End
+
+File gid_File_Windows8_1_KB2999226_x64_msu
+    Name = "Windows8.1-KB2999226-x64.msu";
+    Dir = gid_Brand_Dir_Program;
+    Styles = (PACKED, BINARYTABLE, BINARYTABLE_ONLY);
+End
+
+#ifndef WINDOWS_X64
+
+File gid_File_Windows6_1_KB2999226_x86_msu
+    Name = "Windows6.1-KB2999226-x86.msu";
+    Dir = gid_Brand_Dir_Program;
+    Styles = (PACKED, BINARYTABLE, BINARYTABLE_ONLY);
+End
+
+File gid_File_Windows8_RT_KB2999226_x86_msu
+    Name = "Windows8-RT-KB2999226-x86.msu";
+    Dir = gid_Brand_Dir_Program;
+    Styles = (PACKED, BINARYTABLE, BINARYTABLE_ONLY);
+End
+
+File gid_File_Windows8_1_KB2999226_x86_msu
+    Name = "Windows8.1-KB2999226-x86.msu";
+    Dir = gid_Brand_Dir_Program;
+    Styles = (PACKED, BINARYTABLE, BINARYTABLE_ONLY);
+End
+
+#endif /* WINDOWS_X64 */
+
+/* A deferred not-impersonated action that will call wusa.exe to actually install
+   msu. Since deferred actions don't have access to current DB, the action depends
+   on immediate-executed action inst_ucrt (see below) that precedes it, unpacks
+   the binary to a temp file, and sets this action's CustomActionData property.
+*/
+WindowsCustomAction gid_Customaction_inst_msu
+	Name = "inst_msu";
+	Typ = "3073";
+	Source = "inst_msu_msi.dll";
+	Target = "InstallMSU";
+	Inbinarytable = 1;
+	Assignment1 = ("InstallExecuteSequence", "Not Installed And inst_msu", "InstallFiles");
+End
+
+/* An immediately-executed action that will unpack a binary, which name in binary table is set
+   in "InstMSUBinary" property, to a temporary file, and sets "inst_msu" and "cleanup_msu" props.
+*/
+WindowsCustomAction gid_Customaction_unpack_msu
+	Name = "unpack_msu";
+	Typ = "1";
+	Source = "inst_msu_msi.dll";
+	Target = "UnpackMSUForInstall";
+	Inbinarytable = 1;
+	Assignment1 = ("InstallExecuteSequence", "Not Installed And InstMSUBinary", "cleanup_msu");
+End
+
+/* A rollback action that removes temp file. It must precede inst_msu.
+*/
+WindowsCustomAction gid_Customaction_cleanup_msu
+	Name = "cleanup_msu";
+	Typ = "1345";
+	Source = "inst_msu_msi.dll";
+	Target = "CleanupMSU";
+	Inbinarytable = 1;
+	Assignment1 = ("InstallExecuteSequence", "Not Installed And cleanup_msu", "inst_msu");
+End
+
+WindowsCustomAction gid_Customaction_check_win7x64_ucrt
+	Name = "check_win7x64_ucrt";
+	Typ = "51";
+	Source = "InstMSUBinary";
+	Target = "Windows61-KB2999226-x64msu";
+	Inbinarytable = 0;
+	Assignment1 = ("InstallExecuteSequence", "Not Installed And VersionNT = 601 And VersionNT64 And Not UCRT_DETECTED", "FileCost");
+	Styles = "NO_FILE";
+End
+
+WindowsCustomAction gid_Customaction_check_win8x64_ucrt
+	Name = "check_win8x64_ucrt";
+	Typ = "51";
+	Source = "InstMSUBinary";
+	Target = "Windows8-RT-KB2999226-x64msu";
+	Inbinarytable = 0;
+	Assignment1 = ("InstallExecuteSequence", "Not Installed And VersionNT = 602 And VersionNT64 And Not UCRT_DETECTED", "check_win7x64_ucrt");
+	Styles = "NO_FILE";
+End
+
+WindowsCustomAction gid_Customaction_check_win81x64_ucrt
+	Name = "check_win81x64_ucrt";
+	Typ = "51";
+	Source = "InstMSUBinary";
+	Target = "Windows81-KB2999226-x64msu";
+	Inbinarytable = 0;
+	Assignment1 = ("InstallExecuteSequence", "Not Installed And VersionNT = 603 And VersionNT64 And Not UCRT_DETECTED", "check_win8x64_ucrt");
+	Styles = "NO_FILE";
+End
+
+#ifndef WINDOWS_X64
+
+/* 32-bit installer must be prepared to run on both 32- and 64-bit Windows. So, it might need to
+   install either 32-bit or 64-bit UCRT package, depending on OS bitness.
+*/
+
+WindowsCustomAction gid_Customaction_check_win7x32_ucrt
+	Name = "check_win7x32_ucrt";
+	Typ = "51";
+	Source = "InstMSUBinary";
+	Target = "Windows61-KB2999226-x86msu";
+	Inbinarytable = 0;
+	Assignment1 = ("InstallExecuteSequence", "Not Installed And VersionNT = 601 And Not VersionNT64 And Not UCRT_DETECTED", "check_win81x64_ucrt");
+	Styles = "NO_FILE";
+End
+
+WindowsCustomAction gid_Customaction_check_win8x32_ucrt
+	Name = "check_win8x32_ucrt";
+	Typ = "51";
+	Source = "InstMSUBinary";
+	Target = "Windows8-RT-KB2999226-x86msu";
+	Inbinarytable = 0;
+	Assignment1 = ("InstallExecuteSequence", "Not Installed And VersionNT = 602 And Not VersionNT64 And Not UCRT_DETECTED", "check_win7x32_ucrt");
+	Styles = "NO_FILE";
+End
+
+WindowsCustomAction gid_Customaction_check_win81x32_ucrt
+	Name = "check_win81x32_ucrt";
+	Typ = "51";
+	Source = "InstMSUBinary";
+	Target = "Windows81-KB2999226-x86msu";
+	Inbinarytable = 0;
+	Assignment1 = ("InstallExecuteSequence", "Not Installed And VersionNT = 603 And Not VersionNT64 And Not UCRT_DETECTED", "check_win8x32_ucrt");
+	Styles = "NO_FILE";
+End
+
+#endif /* WINDOWS_X64 */
diff --git a/setup_native/Library_inst_msu_msi.mk b/setup_native/Library_inst_msu_msi.mk
new file mode 100644
index 000000000000..d423b5168697
--- /dev/null
+++ b/setup_native/Library_inst_msu_msi.mk
@@ -0,0 +1,40 @@
+# -*- Mode: makefile-gmake; tab-width: 4; indent-tabs-mode: t -*-
+#
+# This file is part of the LibreOffice project.
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+
+$(eval $(call gb_Library_Library,inst_msu_msi))
+
+$(eval $(call gb_Library_add_defs,inst_msu_msi,\
+	-U_DLL \
+))
+
+$(eval $(call gb_Library_add_cxxflags,inst_msu_msi,\
+	$(if $(MSVC_USE_DEBUG_RUNTIME),/MTd,/MT) \
+))
+
+$(eval $(call gb_Library_add_ldflags,inst_msu_msi,\
+	/DEF:$(SRCDIR)/setup_native/source/win32/customactions/inst_msu/inst_msu_msi.def \
+	/NODEFAULTLIB \
+))
+
+$(eval $(call gb_Library_add_exception_objects,inst_msu_msi,\
+	setup_native/source/win32/customactions/inst_msu/inst_msu \
+))
+
+$(eval $(call gb_Library_use_system_win32_libs,inst_msu_msi,\
+	libcmt \
+	libcpmt \
+	libucrt \
+	libvcruntime \
+	kernel32 \
+	Ole32 \
+	Shell32 \
+	Msi \
+))
+
+# vim: set noet sw=4 ts=4:
diff --git a/setup_native/Module_setup_native.mk b/setup_native/Module_setup_native.mk
index 43d1adb181ff..abf37aff6c86 100644
--- a/setup_native/Module_setup_native.mk
+++ b/setup_native/Module_setup_native.mk
@@ -24,6 +24,7 @@ $(eval $(call gb_Module_add_targets,setup_native,\
 ifeq ($(OS),WNT)
 $(eval $(call gb_Module_add_targets,setup_native,\
 	Library_instooofiltmsi \
+	Library_inst_msu_msi \
 	Library_qslnkmsi \
 	Library_reg4allmsdoc \
 	Library_regactivex \
diff --git a/setup_native/source/win32/customactions/inst_msu/inst_msu.cxx b/setup_native/source/win32/customactions/inst_msu/inst_msu.cxx
new file mode 100644
index 000000000000..b03d3cf3791c
--- /dev/null
+++ b/setup_native/source/win32/customactions/inst_msu/inst_msu.cxx
@@ -0,0 +1,515 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/*
+ * This file is part of the LibreOffice project.
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+#include <memory>
+#include <string>
+#include <sstream>
+#include <iomanip>
+
+#define WIN32_LEAN_AND_MEAN
+#include <windows.h>
+#include <Shlobj.h>
+#include <Wuerror.h>
+#include <msiquery.h>
+
+namespace
+{
+template <typename IntType> std::string Num2Hex(IntType n)
+{
+    std::stringstream sMsg;
+    sMsg << "0x" << std::uppercase << std::setfill('0') << std::setw(sizeof(n) * 2) << std::hex
+         << n;
+    return sMsg.str();
+}
+
+template <typename IntType> std::string Num2Dec(IntType n)
+{
+    std::stringstream sMsg;
+    sMsg << n;
+    return sMsg.str();
+}
+
+void ThrowHResult(const char* sFunc, HRESULT hr)
+{
+    std::stringstream sMsg;
+    sMsg << sFunc << " failed (HRESULT = " << Num2Hex(hr) << ")!";
+
+    throw std::exception(sMsg.str().c_str());
+}
+
+void CheckHResult(const char* sFunc, HRESULT hr)
+{
+    if (FAILED(hr))
+        ThrowHResult(sFunc, hr);
+}
+
+void ThrowWin32Error(const char* sFunc, DWORD nWin32Error)
+{
+    std::stringstream sMsg;
+    sMsg << sFunc << " failed with Win32 error code " << Num2Hex(nWin32Error) << "!";
+
+    throw std::exception(sMsg.str().c_str());
+}
+
+void ThrowLastError(const char* sFunc) { ThrowWin32Error(sFunc, GetLastError()); }
+
+void CheckWin32Error(const char* sFunc, DWORD nWin32Error)
+{
+    if (nWin32Error != ERROR_SUCCESS)
+        ThrowWin32Error(sFunc, nWin32Error);
+}
+
+std::wstring GetKnownFolder(const KNOWNFOLDERID& rfid)
+{
+    PWSTR sPath = nullptr;
+    HRESULT hr = SHGetKnownFolderPath(rfid, KF_FLAG_DEFAULT, nullptr, &sPath);
+    CheckHResult("SHGetKnownFolderPath", hr);
+    std::wstring sResult(sPath);
+    CoTaskMemFree(sPath);
+    return sResult;
+}
+
+void WriteLogElem(MSIHANDLE hInst, MSIHANDLE hRecord, std::ostringstream& sTmpl, UINT)
+{
+    MsiRecordSetStringA(hRecord, 0, sTmpl.str().c_str());
+    MsiProcessMessage(hInst, INSTALLMESSAGE_INFO, hRecord);
+}
+
+void RecSetString(MSIHANDLE hRec, UINT nField, LPCSTR sVal)
+{
+    MsiRecordSetStringA(hRec, nField, sVal);
+}
+
+void RecSetString(MSIHANDLE hRec, UINT nField, LPCWSTR sVal)
+{
+    MsiRecordSetStringW(hRec, nField, sVal);
+}
+
+template <class Ch, class... SOther>
+void WriteLogElem(MSIHANDLE hInst, MSIHANDLE hRec, std::ostringstream& sTmpl, UINT nField,
+                  const Ch* elem, const SOther&... others)
+{
+    sTmpl << " [" << nField << "]";
+    RecSetString(hRec, nField, elem);
+    WriteLogElem(hInst, hRec, sTmpl, nField + 1, others...);
+}
+
+template <class S1, class... SOther>
+void WriteLogElem(MSIHANDLE hInst, MSIHANDLE hRec, std::ostringstream& sTmpl, UINT nField,
+                  const S1& elem, const SOther&... others)
+{
+    WriteLogElem(hInst, hRec, sTmpl, nField, elem.c_str(), others...);
+}
+
+static std::string sLogPrefix;
+
+template <class... StrType> void WriteLog(MSIHANDLE hInst, const StrType&... elements)
+{
+    PMSIHANDLE hRec = MsiCreateRecord(sizeof...(elements));
+    if (!hRec)
+        return;
+
+    std::ostringstream sTemplate;
+    sTemplate << sLogPrefix;
+    WriteLogElem(hInst, hRec, sTemplate, 1, elements...);
+}
+
+typedef std::unique_ptr<void, decltype(&CloseHandle)> CloseHandleGuard;
+CloseHandleGuard Guard(HANDLE h) { return CloseHandleGuard(h, CloseHandle); }
+
+typedef std::unique_ptr<const wchar_t, decltype(&DeleteFileW)> DeleteFileGuard;
+DeleteFileGuard Guard(const wchar_t* sFileName) { return DeleteFileGuard(sFileName, DeleteFileW); }
+
+typedef std::unique_ptr<SC_HANDLE__, decltype(&CloseServiceHandle)> CloseServiceHandleGuard;
+CloseServiceHandleGuard Guard(SC_HANDLE h)
+{
+    return CloseServiceHandleGuard(h, CloseServiceHandle);
+}
+
+std::wstring GetTempFile()
+{
+    wchar_t sPath[MAX_PATH + 1];
+    DWORD nResult = GetTempPathW(sizeof(sPath) / sizeof(*sPath), sPath);
+    if (!nResult)
+        ThrowLastError("GetTempPathW");
+
+    wchar_t sFile[MAX_PATH + 1];
+    nResult = GetTempFileNameW(sPath, L"TMP", 0, sFile);
+    if (!nResult)
+        ThrowLastError("GetTempFileNameW");
+    return sFile;
+}
+
+bool IsWow64Process()
+{
+#if !defined _WIN64
+    BOOL bResult = FALSE;
+    typedef BOOL(WINAPI * LPFN_ISWOW64PROCESS)(HANDLE, PBOOL);
+    LPFN_ISWOW64PROCESS fnIsWow64Process = reinterpret_cast<LPFN_ISWOW64PROCESS>(
+        GetProcAddress(GetModuleHandleW(L"kernel32"), "IsWow64Process"));
+
+    if (fnIsWow64Process)
+    {
+        if (!fnIsWow64Process(GetCurrentProcess(), &bResult))
+            ThrowLastError("IsWow64Process");
+    }
+
+    return bResult;
+#else
+    return false;
+#endif
+}
+
+// Checks if Windows Update service is disabled, and if it is, enables it temporarily.
+class WUServiceEnabler
+{
+public:
+    WUServiceEnabler(MSIHANDLE hInstall)
+        : mhInstall(hInstall)
+        , mhService(EnableWUService(hInstall))
+    {
+    }
+
+    ~WUServiceEnabler()
+    {
+        try
+        {
+            if (mhService)
+            {
+                EnsureServiceEnabled(mhInstall, mhService.get(), false);
+                StopService(mhInstall, mhService.get());
+            }
+        }
+        catch (std::exception& e)
+        {
+            WriteLog(mhInstall, e.what());
+        }
+    }
+
+private:
+    static CloseServiceHandleGuard EnableWUService(MSIHANDLE hInstall)
+    {
+        auto hSCM = Guard(OpenSCManagerW(nullptr, nullptr, SC_MANAGER_ALL_ACCESS));
+        if (!hSCM)
+            ThrowLastError("OpenSCManagerW");
+        WriteLog(hInstall, "Opened service control manager");
+
+        auto hService = Guard(OpenServiceW(hSCM.get(), L"wuauserv",
+                                           SERVICE_QUERY_CONFIG | SERVICE_CHANGE_CONFIG
+                                               | SERVICE_QUERY_STATUS | SERVICE_STOP));
+        if (!hService)
+            ThrowLastError("OpenServiceW");
+        WriteLog(hInstall, "Obtained WU service handle");
+
+        if (ServiceStatus(hInstall, hService.get()) == SERVICE_RUNNING
+            || !EnsureServiceEnabled(hInstall, hService.get(), true))
+        {
+            // No need to restore anything back, since we didn't change config
+            hService.reset();
+            WriteLog(hInstall, "Service configuration is unchanged");
+        }
+
+        return hService;
+    }
+
+    // Returns if the service configuration was actually changed
+    static bool EnsureServiceEnabled(MSIHANDLE hInstall, SC_HANDLE hService, bool bEnabled)
+    {
+        bool bConfigChanged = false;
+
+        DWORD nCbRequired = 0;
+        if (!QueryServiceConfigW(hService, nullptr, 0, &nCbRequired))
+        {
+            DWORD nError = GetLastError();
+            if (nError != ERROR_INSUFFICIENT_BUFFER)
+                ThrowLastError("QueryServiceConfigW");
+        }
+        std::unique_ptr<char[]> pBuf(new char[nCbRequired]);
+        LPQUERY_SERVICE_CONFIGW pConfig = reinterpret_cast<LPQUERY_SERVICE_CONFIGW>(pBuf.get());
+        if (!QueryServiceConfigW(hService, pConfig, nCbRequired, &nCbRequired))
+            ThrowLastError("QueryServiceConfigW");
+        WriteLog(hInstall, "Obtained service config");
+
+        DWORD eNewStartType = 0;
+        if (bEnabled && pConfig->dwStartType == SERVICE_DISABLED)
+        {
+            bConfigChanged = true;
+            eNewStartType = SERVICE_DEMAND_START;
+            WriteLog(hInstall, "Service is disabled, and requested to enable");
+        }
+        else if (!bEnabled && pConfig->dwStartType != SERVICE_DISABLED)
+        {
+            bConfigChanged = true;
+            eNewStartType = SERVICE_DISABLED;
+            WriteLog(hInstall, "Service is enabled, and requested to disable");
+        }
+
+        if (bConfigChanged)
+        {
+            if (!ChangeServiceConfigW(hService, SERVICE_NO_CHANGE, eNewStartType, SERVICE_NO_CHANGE,
+                                      nullptr, nullptr, nullptr, nullptr, nullptr, nullptr,
+                                      nullptr))
+                ThrowLastError("ChangeServiceConfigW");
+            WriteLog(hInstall, "WU service config successfully changed");
+        }
+        else
+            WriteLog(hInstall, "No need to modify service config");
+
+        return bConfigChanged;
+    }
+
+    static DWORD ServiceStatus(MSIHANDLE hInstall, SC_HANDLE hService)
+    {
+        SERVICE_STATUS aServiceStatus{};
+        if (!QueryServiceStatus(hService, &aServiceStatus))
+            ThrowLastError("QueryServiceStatus");
+
+        std::string sStatus;
+        switch (aServiceStatus.dwCurrentState)
+        {
+            case SERVICE_STOPPED:
+                sStatus = "SERVICE_STOPPED";
+                break;
+            case SERVICE_START_PENDING:
+                sStatus = "SERVICE_START_PENDING";
+                break;
+            case SERVICE_STOP_PENDING:
+                sStatus = "SERVICE_STOP_PENDING";
+                break;
+            case SERVICE_RUNNING:
+                sStatus = "SERVICE_RUNNING";
+                break;
+            case SERVICE_CONTINUE_PENDING:
+                sStatus = "SERVICE_CONTINUE_PENDING";
+                break;
+            case SERVICE_PAUSE_PENDING:
+                sStatus = "SERVICE_PAUSE_PENDING";
+                break;
+            case SERVICE_PAUSED:
+                sStatus = "SERVICE_PAUSED";
+                break;
+            default:
+                sStatus = Num2Hex(aServiceStatus.dwCurrentState);
+        }
+        WriteLog(hInstall, "Service status is", sStatus);
+
+        return aServiceStatus.dwCurrentState;
+    }
+
+    static void StopService(MSIHANDLE hInstall, SC_HANDLE hService)
+    {
+        if (ServiceStatus(hInstall, hService) != SERVICE_STOPPED)
+        {
+            SERVICE_STATUS aServiceStatus{};
+            if (!ControlService(hService, SERVICE_CONTROL_STOP, &aServiceStatus))
+                ThrowLastError("ControlService");
+            WriteLog(hInstall,
+                     "Successfully sent SERVICE_CONTROL_STOP code to Windows Update service");
+            // No need to wait for the service stopped
+        }
+        else
+            WriteLog(hInstall, "Windows Update service is not running");
+    }
+
+    MSIHANDLE mhInstall;
+    CloseServiceHandleGuard mhService;
+};
+}
+
+// Immediate action "unpack_msu" that has access to installation database and properties; checks
+// "InstMSUBinary" property and unpacks the binary with that name to a temporary file; sets
+// "cleanup_msu" and "inst_msu" properties to the full name of the extracted temporary file. These
+// properties will become "CustomActionData" property inside relevant deferred actions.
+extern "C" UINT __stdcall UnpackMSUForInstall(MSIHANDLE hInstall)
+{
+    try
+    {
+        sLogPrefix = "UnpackMSUForInstall:";
+        WriteLog(hInstall, "started");
+
+        WriteLog(hInstall, "Checking value of InstMSUBinary");
+        wchar_t sBinaryName[MAX_PATH + 1];
+        DWORD nCCh = sizeof(sBinaryName) / sizeof(*sBinaryName);
+        CheckWin32Error("MsiGetPropertyW",
+                        MsiGetPropertyW(hInstall, L"InstMSUBinary", sBinaryName, &nCCh));
+        WriteLog(hInstall, "Got InstMSUBinary value:", sBinaryName);
+
+        PMSIHANDLE hDatabase = MsiGetActiveDatabase(hInstall);
+        if (!hDatabase)
+            ThrowLastError("MsiGetActiveDatabase");
+        WriteLog(hInstall, "MsiGetActiveDatabase succeeded");
+
+        std::wstringstream sQuery;
+        sQuery << "SELECT `Data` FROM `Binary` WHERE `Name`='" << sBinaryName << "'";
+
+        PMSIHANDLE hBinaryView;
+        CheckWin32Error("MsiDatabaseOpenViewW",
+                        MsiDatabaseOpenViewW(hDatabase, sQuery.str().c_str(), &hBinaryView));
+        WriteLog(hInstall, "MsiDatabaseOpenViewW succeeded");
+
+        CheckWin32Error("MsiViewExecute", MsiViewExecute(hBinaryView, 0));
+        WriteLog(hInstall, "MsiViewExecute succeeded");
+
+        PMSIHANDLE hBinaryRecord;
+        CheckWin32Error("MsiViewFetch", MsiViewFetch(hBinaryView, &hBinaryRecord));
+        WriteLog(hInstall, "MsiViewFetch succeeded");
+
+        const std::wstring sBinary = GetTempFile();
+        auto aDeleteFileGuard(Guard(sBinary.c_str()));
+        WriteLog(hInstall, "Temp file path:", sBinary.c_str());
+
+        CheckWin32Error("MsiSetPropertyW",
+                        MsiSetPropertyW(hInstall, L"cleanup_msu", sBinary.c_str()));
+
+        {
+            HANDLE hFile = CreateFileW(sBinary.c_str(), GENERIC_WRITE, 0, 0, CREATE_ALWAYS,
+                                       FILE_ATTRIBUTE_NORMAL, 0);
+            if (hFile == INVALID_HANDLE_VALUE)
+                ThrowLastError("CreateFileW");
+            auto aFileHandleGuard(Guard(hFile));
+
+            const DWORD nBufSize = 1024 * 1024;
+            std::unique_ptr<char[]> buf(new char[nBufSize]);
+            DWORD nTotal = 0;
+            DWORD nRead;
+            do
+            {
+                nRead = nBufSize;
+                CheckWin32Error("MsiRecordReadStream",
+                                MsiRecordReadStream(hBinaryRecord, 1, buf.get(), &nRead));
+
+                if (nRead > 0)
+                {
+                    DWORD nWritten;
+                    if (!WriteFile(hFile, buf.get(), nRead, &nWritten, nullptr))
+                        ThrowLastError("WriteFile");
+                    nTotal += nWritten;
+                }
+            } while (nRead == nBufSize);
+
+            WriteLog(hInstall, "Successfully wrote", Num2Dec(nTotal), "bytes");
+        }
+
+        CheckWin32Error("MsiSetPropertyW", MsiSetPropertyW(hInstall, L"inst_msu", sBinary.c_str()));
+
+        // Don't delete the file: it will be done by following actions (inst_msu or cleanup_msu)
+        aDeleteFileGuard.release();
+        return ERROR_SUCCESS;
+    }
+    catch (std::exception& e)
+    {
+        WriteLog(hInstall, e.what());
+    }
+    return ERROR_INSTALL_FAILURE;
+}
+
+// Deferred action "inst_msu" that must be run from system account. Receives the tempfile name from
+// "CustomActionData" property, and runs wusa.exe to install it. Waits for it and checks exit code.
+extern "C" UINT __stdcall InstallMSU(MSIHANDLE hInstall)
+{
+    try
+    {
+        sLogPrefix = "InstallMSU:";
+        WriteLog(hInstall, "started");
+
+        WriteLog(hInstall, "Checking value of CustomActionData");
+        wchar_t sBinaryName[MAX_PATH + 1];
+        DWORD nCCh = sizeof(sBinaryName) / sizeof(*sBinaryName);
+        CheckWin32Error("MsiGetPropertyW",
+                        MsiGetPropertyW(hInstall, L"CustomActionData", sBinaryName, &nCCh));
+        WriteLog(hInstall, "Got CustomActionData value:", sBinaryName);
+        auto aDeleteFileGuard(Guard(sBinaryName));
+
+        // In case the Windows Update service is disabled, we temporarily enable it here
+        WUServiceEnabler aWUServiceEnabler(hInstall);
+
+        const bool bWow64Process = IsWow64Process();
+        WriteLog(hInstall, "Is Wow64 Process:", bWow64Process ? "YES" : "NO");
+        std::wstring sWUSAPath = bWow64Process ? GetKnownFolder(FOLDERID_Windows) + L"\\SysNative"
+                                               : GetKnownFolder(FOLDERID_System);
+        sWUSAPath += L"\\wusa.exe";
+        WriteLog(hInstall, "Prepared wusa path:", sWUSAPath);
+
+        std::wstring sWUSACmd
+            = L"\"" + sWUSAPath + L"\" \"" + sBinaryName + L"\" /quiet /norestart";
+        WriteLog(hInstall, "Prepared wusa command:", sWUSACmd);
+
+        STARTUPINFOW si{};
+        si.cb = sizeof(si);
+        PROCESS_INFORMATION pi{};
+        if (!CreateProcessW(sWUSAPath.c_str(), const_cast<LPWSTR>(sWUSACmd.c_str()), nullptr,
+                            nullptr, FALSE, CREATE_NO_WINDOW, nullptr, nullptr, &si, &pi))
+            ThrowLastError("CreateProcessW");
+        auto aCloseProcHandleGuard(Guard(pi.hProcess));
+        WriteLog(hInstall, "CreateProcessW succeeded");
+
+        DWORD nWaitResult = WaitForSingleObject(pi.hProcess, INFINITE);
+        if (nWaitResult != WAIT_OBJECT_0)
+            ThrowWin32Error("WaitForSingleObject", nWaitResult);
+
+        DWORD nExitCode = 0;
+        if (!GetExitCodeProcess(pi.hProcess, &nExitCode))
+            ThrowLastError("GetExitCodeProcess");
+
+        HRESULT hr = static_cast<HRESULT>(nExitCode);
+        if (hr == HRESULT_FROM_WIN32(ERROR_SUCCESS_REBOOT_REQUIRED))
+            hr = WU_S_REBOOT_REQUIRED;
+
+        switch (hr)
+        {
+            case S_OK:
+            case S_FALSE:
+            case WU_S_ALREADY_INSTALLED:
+            case WU_E_NOT_APPLICABLE: // Windows could lie us about its version, etc.
+            case ERROR_SUCCESS_REBOOT_REQUIRED:
+            case WU_S_REBOOT_REQUIRED:
+                WriteLog(hInstall, "wusa.exe succeeded with exit code", Num2Hex(nExitCode));
+                return ERROR_SUCCESS;
+
+            default:
+                ThrowWin32Error("Execution of wusa.exe", nExitCode);
+        }
+    }
+    catch (std::exception& e)
+    {
+        WriteLog(hInstall, e.what());
+    }
+    return ERROR_INSTALL_FAILURE;
+}
+
+// Rollback deferred action "cleanup_msu" that is executed on error or cancel.
+// It removes the temporary file created by UnpackMSUForInstall action.
+// MUST be placed IMMEDIATELY AFTER "unpack_msu" in execute sequence.
+extern "C" UINT __stdcall CleanupMSU(MSIHANDLE hInstall)
+{
+    try
+    {
+        sLogPrefix = "CleanupMSU:";
+        WriteLog(hInstall, "started");
+
+        WriteLog(hInstall, "Checking value of CustomActionData");
+        wchar_t sBinaryName[MAX_PATH + 1];
+        DWORD nCCh = sizeof(sBinaryName) / sizeof(*sBinaryName);
+        CheckWin32Error("MsiGetPropertyW",
+                        MsiGetPropertyW(hInstall, L"CustomActionData", sBinaryName, &nCCh));
+        WriteLog(hInstall, "Got CustomActionData value:", sBinaryName);
+
+        if (!DeleteFileW(sBinaryName))
+            ThrowLastError("DeleteFileW");
+        WriteLog(hInstall, "File successfully removed");
+    }
+    catch (std::exception& e)
+    {
+        WriteLog(hInstall, e.what());
+    }
+    // Always return success - we don't want rollback to fail.
+    return ERROR_SUCCESS;
+}
+
+/* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/setup_native/source/win32/customactions/inst_msu/inst_msu_msi.def b/setup_native/source/win32/customactions/inst_msu/inst_msu_msi.def
new file mode 100644
index 000000000000..49ade9c0169e
--- /dev/null
+++ b/setup_native/source/win32/customactions/inst_msu/inst_msu_msi.def
@@ -0,0 +1,5 @@
+LIBRARY		"inst_msu_msi.dll"
+EXPORTS
+			UnpackMSUForInstall
+			InstallMSU
+			CleanupMSU
\ No newline at end of file
diff --git a/solenv/bin/modules/installer/windows/idtglobal.pm b/solenv/bin/modules/installer/windows/idtglobal.pm
index a8b9ea6097dc..2fa46fbbdb6a 100644
--- a/solenv/bin/modules/installer/windows/idtglobal.pm
+++ b/solenv/bin/modules/installer/windows/idtglobal.pm
@@ -1084,9 +1084,8 @@ sub add_custom_action_to_install_table
 
         my $actionposition = 0;
 
-        if ( $position eq "end" ) { $actionposition = get_last_position_in_sequencetable($installtable) + 25; }
-        elsif ( $position =~ /^\s*behind_/ ) { $actionposition = get_position_in_sequencetable($position, $installtable) + 2; }
-        else { $actionposition = get_position_in_sequencetable($position, $installtable) - 2; }
+        if ( $position =~ /^\s*\d+\s*$/ ) { $actionposition = $position; }    # setting the position directly, number defined in scp2
+        else { $actionposition = "POSITIONTEMPLATE_" . $position; }
 
         my $line = $actionname . "\t" . $actioncondition . "\t" . $actionposition . "\n";
         push(@{$installtable}, $line);
@@ -1129,12 +1128,6 @@ sub add_custom_action_to_install_table
 
         $actioncondition =~ s/FEATURETEMPLATE/$feature/g;   # only execute Custom Action, if feature of the file is installed
 
-#       my $actionposition = 0;
-#       if ( $position eq "end" ) { $actionposition = get_last_position_in_sequencetable($installtable) + 25; }
-#       elsif ( $position =~ /^\s*behind_/ ) { $actionposition = get_position_in_sequencetable($position, $installtable) + 2; }
-#       else { $actionposition = get_position_in_sequencetable($position, $installtable) - 2; }
-#       my $line = $actionname . "\t" . $actioncondition . "\t" . $actionposition . "\n";
-
         my $positiontemplate = "";
         if ( $position =~ /^\s*\d+\s*$/ ) { $positiontemplate = $position; }    # setting the position directly, number defined in scp2
         else { $positiontemplate = "POSITIONTEMPLATE_" . $position; }
diff --git a/solenv/bin/modules/installer/windows/msiglobal.pm b/solenv/bin/modules/installer/windows/msiglobal.pm
index 383f7f3599cc..d0ddb8920d3d 100644
--- a/solenv/bin/modules/installer/windows/msiglobal.pm
+++ b/solenv/bin/modules/installer/windows/msiglobal.pm
@@ -1009,6 +1009,7 @@ sub set_uuid_into_component_table
 # Adding final 64 properties into msi database, if required.
 # RegLocator : +16 in type column to search in 64 bit registry.
 # All conditions: "VersionNT" -> "VersionNT64" (several tables).
+# DrLocator: "SystemFolder" -> "System64Folder"
 # Already done: "+256" in Attributes column of table "Component".
 # Still following: Setting "x64" instead of "Intel" in Summary
 # Information Stream of msi database in "get_template_for_sis".
@@ -1099,6 +1100,34 @@ sub prepare_64bit_database
                 }
             }
         }
+
+        # 3. Replacing all occurrences of "SystemFolder" by "System64Folder" in "DrLocato.idt"
+
+        my $drlocatofilename = $basedir . $installer::globals::separator . "DrLocato.idt";
+        if ( -f $drlocatofilename )
+        {
+            my $saving_required = 0;
+            my $drlocatofile = installer::files::read_file($drlocatofilename);
+
+            for ( my $i = 3; $i <= $#{$drlocatofile}; $i++ )    # ignoring the first three lines
+            {
+                my $oneline = ${$drlocatofile}[$i];
+
+                if ( $oneline =~ /\bSystemFolder\b/ )
+                {
+                    ${$drlocatofile}[$i] =~ s/\bSystemFolder\b/System64Folder/g;
+                    $saving_required = 1;
+                }
+            }
+
+            if ( $saving_required )
+            {
+                # Saving the files
+                installer::files::save_file($drlocatofilename ,$drlocatofile);
+                $infoline = "Making idt file 64 bit conform: $drlocatofilename\n";
+                push(@installer::globals::logfileinfo, $infoline);
+            }
+        }
     }
 
 }