Ok @Stefano Bonicatti, or someone familiar with WIX, it looks like the error is here https://github.com/osquery/osquery/blob/master/cmake/wix_patches/osquery_wix_patch.xml#L14 and that path should be quoted.

This was the only way i can get it to start as well: https://osquery.slack.com/archives/C0FHNQ2N6/p1566424692170400

Account='NT AUTHORITY\SYSTEM'

->

LocalSystem

Strange for the user, that's the same that the original packaging script uses. Was osquery 3.3.2 working fine for you?

3.3.2 was installed via chocolatey, without service flag. service was installed afterwards using:

'"C:\Program Files\osquery\osqueryd\osqueryd.exe" --install'

which creates the service properly with

Log on

as

LocalSystem

Yeah the path has been recently corrected, though I suspect then that also osquery 3.3.2 MSI had the same issue