Access and Permission just do not work as instructed

[blandry]

Hello...

I am getting quite frustrated with InstallAware as it regards setting Permissions and Shares. That is, I have followed the instructions passed to me, and the results are the same. My install creates folders in the ProgramData hierarchy and then I want to have those folders available for EVERYONE. So here is the code I used as advised...

Code: Select all

if Variable ADVERTISE Equals TRUE
  Apply Advertised (get result into variable SUCCESS)
  else
  Apply Install (get result into variable SUCCESS)
  if Variable SUCCESS not Equals ERROR
    if Variable SUCCESS not Equals CANCEL
      if Variable MAINTENANCE not Equals TRUE
        Comment: *****************************************************************************************
        Comment: Manage Rights - Permissions first, then Security
        Comment: *****************************************************************************************
        MessageBalloon: Product Activation, Managing Rights...
        Comment: *****************************************************************************************
        Comment: Update Access Rights for every Schema file
        Comment: *****************************************************************************************
        Grant Complete Access to File System Object "$CONFIGDIR$"
        Grant Complete Access to File System Object "$EXPORTDIR$"
        Grant Complete Access to File System Object "$LOGSDIR$"
        Grant Complete Access to File System Object "$SCHEMADIR$"
        Grant Complete Access to File System Object "$VIDEODIR$"
        Comment: *****************************************************************************************
        Comment: Update Access Rights (Only applies after APPLY INSTALL)
        Comment: *****************************************************************************************
        Grant Complete Access to Folder Share "$CONFIGDIR$"
        Grant Complete Access to Folder Share "$EXPORTDIR$"
        Grant Complete Access to Folder Share "$LOGSDIR$"
        Grant Complete Access to Folder Share "$SCHEMADIR$"
        Grant Complete Access to Folder Share "$VIDEODIR$"
        Comment: *****************************************************************************************
        Comment: Update Access Rights for these files
        Comment: *****************************************************************************************
        Grant Complete Access to File System Object "$CONFIGDIR$\ReportIT4.settings"
        Grant Complete Access to File System Object "$LOGSDIR$\ReportIT_ErrorLog.txt"
        Grant Complete Access to File System Object "$LOGSDIR$\ReportIT_RunLog.txt"
      end
    end
  end

For clarity sake, this would produce this tree hierarchy...

\ProgramData\CompanyName
\ProgramData\CompanyName\AppName
\ProgramData\CompanyName\AppName\Schemas
\ProgramData\CompanyName\AppName\Exports
\ProgramData\CompanyName\AppName\Logs
\ProgramData\CompanyName\AppName\Videos

After running the install, users cannot gain access to Schemas, Exports, Logs, or Videos. Its as though the InstallAware code simply does not work.

When I first implemented this code, it didnt work, and I was told to put the code AFTER the Apply Install command - you can see, I did that. Doesnt seem to make any difference.

Please, what is the trick here? What am I missing? Or is it that this simply cannot be done... (I find that hard to believe, but...)

[FrancescoT]

Dear blandry,

I will test and check it ... so give me just some time and I wiil try to be back to you asap.

Regards

[blandry]

FrancescoT,

We tried over the weekend to get this IA code to work, and well, nothing we did resolved the problem. However, we did find a working solution and for the sake of info, I will share it here.

We set the permissions and shares up at the top of our install code and then issued an Apply Install to get those in place, and then began copying files. We expected that this would mean the folders would get the permissions, and then the files, as they were being installed, would inherit the permissions. Well - the folders never got the permission - its seemed as though the IA command simply did not work, period.

So at the botton of our code we added the the following block...

If ISNT equals True
Run Program ICACLS C:\ProgramData\ConverterTechnology\ReportIT4 /T /C /Q /Grant Users:F
end

What this did is change the permissions to Full Control for the files in these folder, but NOT the folders themselves. Oddly though, the Folders DID get Special Permissions and in the detail of those we noticed that Read/Write was there. So it appears the IA Grant Access command WAS doing something - but the ICACLS command is the one that actually hit the 42 files in the sub-folders mentioned in my first post on this topic.

I suppose we could play around with this a bit more and run ICACLS more toward the top, and then see if the cascade of files (as they are installed) actually inherits, but what we have right now works and after much struggle to get it to work, thats pretty much what we're after.

Once Caveat!!! Notice in my code snippet above we use the ISNT variable (meaning "is this an NT machine") to run ICACLS because this command is only valid on Windows Vista, Win 2000 and Win 7 - it will NOT work on XP. However, our problem did not crop up on XP - so we are good there. But for the sake of info, if someone needs to use this on XP, the command you are after is the earlier CACLS command (not ICACLS which wont run on XP).

I hope in coming updates to IA this gets scripted there a bit more effectively - but I dont blame IA - I blame Microsoft, whose idea of "tight security" is like building a skyscraper with NO doors at all. That way, NO ONE gets in. Yeah, thats tight security, but of course, no one can use the building at all. This kind of security in Vista, Win7 and Win2000 is getting ridiculous because they are costing tons of hours at our client sites spent uselessly on just getting machines so people can get their work done - and of course Microsoft's documentation is up to their usual lousy status where they tell you what something is, but not how to effectively use it.

So for now, for us, ICACLS has given us a solution that works. Unfortunately, I think Grant Access works in IA too (2012 version), but it sets this "Special Permission" that if you are not careful, you dont see (you need to scroll down in the security tab) - My bad as I think I missed that, but even with that set, the files DID NOT inherity that setting.

Hope this helps someone else!

[FrancescoT]

Dear Blandry,

many thanks for your post and I really hope that could help someone else too.

Thanks again!!