Wix - installing patches without admin rights

Question

Following is the wxs file for the main installer. This will be signed with Sign.pfx after it is created.

<?xml version="1.0" encoding="UTF-8"?>
<Wix xmlns="http://schemas.microsoft.com/wix/2006/wi">
    <Product Id="48C49ACE-90CF-4161-9C6E-9162115A54DD"
        Name="WiX Patch Example Product"
        Language="1033"
        Version="1.0.0"
        Manufacturer="Dynamo Corporation"
        UpgradeCode="48C49ACE-90CF-4161-9C6E-9162115A54DD">
        <Package Description="Installs a file that will be patched."
            Comments="This Product does not install any executables"
            InstallerVersion="200"
            Compressed="yes" AdminImage="no" />

        <Media Id="1" Cabinet="product.cab" EmbedCab="yes"/>


        <FeatureRef Id="SampleProductFeature"/>

        <PatchCertificates>
            <DigitalCertificate Id="MyNewCertificate" SourceFile="Sign.pfx"/>
        </PatchCertificates>

        <PackageCertificates>
            <DigitalCertificate Id="MyNewCertificate" SourceFile="Sign.pfx"/>
        </PackageCertificates>

    </Product>

    <Fragment>
        <Feature Id="SampleProductFeature" Title="Sample Product Feature" Level="1">
            <ComponentRef Id="SampleComponent" />
        </Feature>
    </Fragment>

    <Fragment>
        <DirectoryRef Id="SampleProductFolder">
            <Component Id="SampleComponent" Guid="{C28843DA-EF08-41CC-BA75-D2B99D8A1983}" DiskId="1">
                <File Id="SampleFile" Name="Sample.txt" Source=".\$(var.Version)\Sample.txt" />
            </Component>
        </DirectoryRef>
    </Fragment>

    <Fragment>
        <Directory Id="TARGETDIR" Name="SourceDir">
            <Directory Id="ProgramFilesFolder" Name="PFiles">
                <Directory Id="SampleProductFolder" Name="Patch Sample Directory">
                </Directory>
            </Directory>
        </Directory>
    </Fragment>
</Wix>

Following is the patch file which needs to be installed without requiring admin rights.Currently the patch works fine but requires admin rights.

<?xml version="1.0" encoding="UTF-8"?>
<Wix xmlns="http://schemas.microsoft.com/wix/2006/wi">
    <Patch 
        AllowRemoval="yes"
        Manufacturer="Dynamo Corp" 
        MoreInfoURL="http://www.dynamocorp.com/"
        DisplayName="Sample Patch" 
        Description="Small Update Patch" 
        Classification="Update"
        >

        <Media Id="5000" Cabinet="RTM.cab">
            <PatchBaseline Id="RTM"/>
        </Media>

        <PatchFamilyRef Id="SamplePatchFamily"/>

    </Patch>

    <Fragment>    
        <PatchFamily Id='SamplePatchFamily' Version='1.2.0.0' Supersede='yes' ProductCode="48C49ACE-90CF-4161-9C6E-9162115A54DD">
            <ComponentRef Id="SampleComponent"/>
        </PatchFamily>
    </Fragment>
</Wix>

The example code was taken from the official wix tutorial at http://wixtoolset.org/documentation/manual/v3/patching/wix_patching.html

How can I make it so that the application is installed for all users (with admin rights) (currently done) but non-admins can install the patch file.

What I've tried: added the PatchCertificates and PackageCertificates. Makes no difference.

Answer 1

Most of the examples I can find use a .cer file instead of a .pfx for a PatchCertificates/DigitalCertificate/@SourceFile (e.g. Question about UAC patching on Vista-patch certificate is not recognized which includes alternate directions for creating a .cer from a .pfx if you don't have one already, leveraging MsiGetFileSignatureInformation.) It's possible you need to specify a .cer file instead.