Nested Directory Permissions

[prostetnic]

I have to repackage a lot of programs because people still dont quite seem to understand what a locked down environment is.

I have to change the permissions of the HKLM and the Program files directory AND ALL SUBKEYS/DIRECTORIES this is somewhat annoying with developer as I set for instance the permissions on Component registry Lokal machine. Then I have to go through and set a lot of the keys manually..this is seriously time consuming..is there a way to propogate permissions?? or is this a bug and it should do it?

[TsungH]

Microsoft Windows Installer Service attempts to preserve the security on objects that already exist on the system (LockPermissions table for reference). You will have to make sure the permission is set on the topmost registry key so that when subkeys are created, they will inherit security descriptor of their parent registry key.

The other thing is to make sure the registry key with explicit permissions is created before any of the subkeys is created. If my memory serves me well, it's the same order as it appears in Registry table. Unfortunately, I don't have any known document on that.

[prostetnic]

yes, that was it 🙂 I recreated the registry table with the topmost key first and then everything worked okay. 🙂 thanks