There's now a cute dialog for setting these file, and registry ACLs in Developer 7.03, hopefully Author will have these soon.
When using the lockpermissions table, the MSI.CHM says that if you're not wanting to use the built-in accounts such as Administrator, you must use custom actions to set the user/domain.
I found that very confusing, they actually mean that you should use Properties to pass them.
looeee