Folder Permissions

[JohnH]

Using the Access Control page in InstallAware 6.22 I can set right to individual files. Can I set access rights on a whole folder, so all the files added to or created their before / after the installation has read / write access?

The folder would be C:\\ProgramData\\Company\\UserData

Regards.

John

[CandiceJones]

Yes, simply enter the folder path instead of a file path.

[emu99]

when i use the access control to change permission on a folder with
object type = file system,
operation = set chosen users with access rights,
user accounts = everyone + authenticated users
access rights = read + write

installaware (6.24 / 6.31) sets full control for those everyone + authenticated users, this is not what is should be, since write is not equal to full control.

This seems like a bug. Also there should be more graduation possible inside the access rights options, e.g. which type of permission to set (or remove) like read & execute, Modify, Write, Full Control.

[CandiceJones]

Hi,

This behavior is as-designed.

Read includes Execute, Write includes Modify, etc. So these values are shorthands and not exact correlates of their similarly named permission types.

[emu99]

Hi Candice,

sorry, but no Admin wants users to have full-access / full control on folders.

users are tempering with folders and in worst case they remove administrators / systemaccount from accessing the folder. no one wants this situation.

i'm quiet sure, most of the others using IA are the same opinion.

there should be at least a graduation, where one can define which permission users should have on folders / files.

This should really be changed.

best regards
emu

[jrush]

Not only do I totally agree but you also must make it so any new files or folders created under that folder inherit those permission settings. I can get the permission settings set properly but any new files created have (worst possible case) NO PERMISSION! This means even the end user administrator cannot remove them without resetting ownership and then changing permissions and then deleting the files by hand.

Further - if a folder has its permissions set to Everyone Full Control and in the that folder is a file (specified with a wildcard in the installation) that file get no permission - in this case the un-installer doesn't even work.

Suggestion: Allow people to specify exact permissions on exact folders for exact users - its my installation I know exactly what I need. Make sure that these setting also get inherited by new files and folder created by the end user.

This, in my opinion is huge shortcoming of your product.

[CandiceJones]

You have to create the folder and set permissions before Windows Installer takes over. This way the permissions are applied to all subfolders and files successfully.

So, you'd manually create the folder and assign the desired permissions before calling Apply Install. You can create the folder using Call DLL Function on CreateDirectoryA in kernel32.dll, the first parameter being the name of the folder and the second just NULL. After this is done be sure to set the permissions also, before you call Apply Install.

[rentzk]

Won't using the CreateDirectoryA call prevent the uninstall from removing this folder? I thought that an uninstall only removed things that it created, and that going straight to the OS like this would mess things up.

[CandiceJones]

That's a good point. However, you can easily remedy the situation by inserting another call to RemoveDirectoryA in kernel32.dll right after Apply Uninstall (which makes the command come right after MSI's uninstallation) using Call DLL Function.