Showing results for 
Show  only  | Search instead for 
Did you mean: 

Best way to set permissions

By Level 11 Flexeran
Level 11 Flexeran
In my opinion the best way to append security and retain inheritance is to call a custom action to use Windows XP’s calcs.exe. Please not the following syntax:

To run program already on System as Custom Action
Location: Stored in the Directory Table
Source: [SystemFolder]
Command: cacls.exe "[ProgramFilesFolder]Directory" /e /t /c /g Users:C

Note: [INSTALLDIR] property resolves to a path with a "\" at the end. Cacls Program is incompatible with [INSTALLDIR] property.

Too bad about INSTALLDIR.

(2) Replies
With Windows Installer, there is a LockPermission table that will allow you to set file and registry permissions. This is a more elegant method of setting permissions as it utilizes the Installer Service.
By Level 11 Flexeran
Level 11 Flexeran
Thanks Nicholas. I would not say it is more elegant however. Using the LockPermissions table does not allow appending. It resets all current security permissions to what you specify. I don't know about you, but I like leaving the default Administrators, Creator Owner, and System permissions intact (Without recreating them in the table). Also, what a pain to use AdminStudio's interface. I would be more apt to if you could set it in the folder/file view without needing to go fishing for components. I have also ran into problems in nested installs where setting INSTALLDIR and folder permissions on the 2nd msi failed.

So just my 2 cents. Lock table for one off files and cacls for folder structures.