Why wix bundle cache file is removed?

Question

We have a Wix bundle installer contains a main installer and two dependencies: VC runtime and .NET desktop runtime.

We found that if restarting Win11 system after installation, the cache for bundle installer(marked in red) will be removed from C:\ProgramData\Package Cache. This will cause the error "an error occurred while trying to uninstall it may have already been uninstalled" when trying uninstalling the application.

Why Wix bundle cache file is removed? Is there any way we can find out what application remove the cache? Thanks.

Here is the cache file list after installation:

Answer 1

Hi Liang, Ming,

Thank you for reaching out to the Microsoft Q&A Forum. I know how confusing and frustrating it can be when an installer works fine, but uninstalling later suddenly fails. You did the right thing by investigating the Package Cache folder, and I’m happy to help clarify what’s happening.

WiX Burn (the bootstrapper engine behind your bundle) always stores a copy of the bundle executable under C:\ProgramData\Package Cache\{Bundle-GUID} during installation. Windows relies on this cached copy later for repair, modify, or uninstall operations.

Most importantly, WiX itself does not delete its own cache once the product is installed. If it's disappearing after a reboot, something external is removing it. Common causes might include:

• Cleanup utilities (system optimizers, disk cleaners, automated maintenance tools)
• Endpoint security software / antivirus products (e.g., Bitdefender has been known to block access or remove items inside Package Cache)
• Enterprise device policies or scripts that attempt to “clean” ProgramData
• Misconfigured Storage Sense or similar cleanup tools
• Profile or temp cleanup tools when install is per-user instead of per-machine

Here are two methods to track down the culprit and find out which app deleted the cache:

1 - Use Process Monitor (ProcMon), this method tells you exactly which process deleted the file.

• Download Process Monitor (Sysinternals).
• Go to Options → Enable Boot Logging.
• Reboot the machine.
• After reboot, open ProcMon again and load the boot log.
• Filter for:
  • Path contains: Package Cache
  • Operation: SetDispositionInformationFile or anything containing Delete
• You will see the exact executable that deleted the cached bundle.

2 - Enable Windows auditing to log deletions if you prefer using Windows Event Logs:

• Enable File System auditing via Local Security Policy.
• Add a delete audit rule on C:\ProgramData\Package Cache.
• After reboot, check Event Viewer → Security for events:
  • 4663 (attempted delete)
  • 4660 (file deleted)
• This will show which process or user removed the file.

I look forward to receiving your update. Let me know if you need further assistance, feel free to ask me by clicking "Add Comment" or "Add Answer" if you cannot add comment so your response will be visible. Thanks for your effort.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have additional questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.