<p>I have found an example for encrypting a web.config during installation <a href="http://madtechnology.wordpress.com/2007/05/04/using-wix-to-secure-a-connection-string/" rel="nofollow noreferrer">here</a>, but my app is a windows service.  The <code>aspnetreg_iis</code> method works only for web.config files.</p>

<p>I know how to programatically encrypt the config file, but I don't think I can do that using WiX.  Am I wrong?  Any ideas?</p>

You should be able to do it within a custom action.  The catch that I've found is that loading an assembly for an ExeConfigurationFileMap will throw an exception, but you can handle that by adding an AssemblyResolve handler to the AppDomain.  This is kind of a hack-up from a rich-client app I wrote to encrypt/decrypt protected configuration sections using a machine encryption key.  It's probably not the prettiest code, but I'm hoping you can get the picture from it.  This code assumes that you have the ProtectionProvider you want to use defined in the config file.
```
```
//class global
static System.Reflection.Assembly DefiningAssembly;

AppDomain currentDomain = AppDomain.CurrentDomain;
currentDomain.AssemblyResolve += new ResolveEventHandler(MyResolveEventHandler);

static System.Reflection.Assembly MyResolveEventHandler(object sender, ResolveEventArgs args)
{
     return DefiningAssembly;
}
```
```
Then, you can load your configuration like this:
```
```
DefiningAssembly = System.Reflection.Assembly.LoadFrom("path to defining assembly for config");

//Set the Configuration using an ExeConfigurationFileMap - This works for any .config file.
ExeConfigurationFileMap CfgMap = new ExeConfigurationFileMap();
CfgMap.ExeConfigFilename = "path to config file";
Configuration config = ConfigurationManager.OpenMappedExeConfiguration(CfgMap, ConfigurationUserLevel.None);

List<string> DefiningAssemblyTypes = new List<string>();
foreach (System.Type type in DefiningAssembly.GetExportedTypes())
{
     DefiningAssemblyTypes.Add(type.Name);
}

foreach (ConfigurationSection tempSection in config.Sections)
{
     if (DefiningAssemblyTypes.Contains(tempSection.ElementInformation.Type.Name))
     {
          section = tempSection;
          break;
     }
}
ProtectionProviderName = section.SectionInformation.ProtectionProvider.Name;
section.SectionInformation.ProtectSection(ProtectionProviderName);
config.Save(ConfigurationSaveMode.Minimal, true);
```
```
I hope this helps you, best of luck.