Best way to set permissions

[CChong]

In my opinion the best way to append security and retain inheritance is to call a custom action to use Windows XP’s calcs.exe. Please not the following syntax:

To run program already on System as Custom Action
Location: Stored in the Directory Table
Source: [SystemFolder]
Command: cacls.exe "[ProgramFilesFolder]Directory" /e /t /c /g Users:C

Note: [INSTALLDIR] property resolves to a path with a "\" at the end. Cacls Program is incompatible with [INSTALLDIR] property.

Too bad about INSTALLDIR.


Patrick

[nicholas_ong]

With Windows Installer, there is a LockPermission table that will allow you to set file and registry permissions. This is a more elegant method of setting permissions as it utilizes the Installer Service.

[CChong]

Thanks Nicholas. I would not say it is more elegant however. Using the LockPermissions table does not allow appending. It resets all current security permissions to what you specify. I don't know about you, but I like leaving the default Administrators, Creator Owner, and System permissions intact (Without recreating them in the table). Also, what a pain to use AdminStudio's interface. I would be more apt to if you could set it in the folder/file view without needing to go fishing for components. I have also ran into problems in nested installs where setting INSTALLDIR and folder permissions on the 2nd msi failed.

So just my 2 cents. Lock table for one off files and cacls for folder structures.