Writing to existing profiles

[CChong]

I am currently tring to create an MSI that will assign permissions to an existing registry key.

I am trying to restrict/Grant permissions to a key in HKCU

Using AdminStudio 5.5 I have created a component (componentx)

Within that component I have added the key I wish to change (HKCU\Control Panel\Desktop)

Issue #1

I right click and go to permissions. I can add grant permmisions on this key, but I cannot deny them. :confused: Can someone suggest something here? Do I need to make a change in the LockPermissions table? If so what Value would I use to deny rights?

Issue #2

I then do the same for the .default user registry key. This will populate the permissions to any new profiles created. My issue is how can I force these permissions to the existing profiles on the computer. Can I force the MSI to reinstall for each user?

Thank you in advance for your assistance

[MSI_DW]

You can permission the registry keys by using a custom action (CACLS.exe, or 3rd party utils like setacl.exe).

Associate this custom action to component that will be run for each new user\every time you log on. be sure to run this CA in system context.
dW

[CChong]

I guess my confusion comes in while trying to assosciate a component to run for all users. It is probable quite simple, but I haven't done it yet. Can you point me to a place that references how to do it?

[MSI_DW]

Associate the HKCU registry entries to the executable, and set them to be KeyPath's. When the user tries to run the .exe, it will verify that the HKCU keys are available. If they are not, they will be created.

If you associate the custom action to the same component,this will also run, permisioning the keys.

dw