With Windows Installer, there is a LockPermission table that will allow you to set file and registry permissions. This is a more elegant method of setting permissions as it utilizes the Installer Service.
Thanks Nicholas. I would not say it is more elegant however. Using the LockPermissions table does not allow appending. It resets all current security permissions to what you specify. I don't know about you, but I like leaving the default Administrators, Creator Owner, and System permissions intact (Without recreating them in the table). Also, what a pain to use AdminStudio's interface. I would be more apt to if you could set it in the folder/file view without needing to go fishing for components. I have also ran into problems in nested installs where setting INSTALLDIR and folder permissions on the 2nd msi failed.
So just my 2 cents. Lock table for one off files and cacls for folder structures.