Set Access Control

[tzachk]

Hi,

I'm trying to use the Set Access Control command on a registry key for the current installing user.
During the install I added messagebox and noticed that the access control for the registry key was not changed even though using the same user that installer is running with I can change permissions.
I then tried to change it for everyone, which also failed

It seems that I can't get Set Access Control to change access.
Anything special that I need to perform?

Code sample

Code: Select all

~InstallAware Clipboard Data~
~End~
~{F3547C5C-8B6E-4557-A028-1BF69027428B}~
~MessageBox~
~{BD088721-8814-4971-8A3F-C9BB40FB6660}~
~3~
~~
~0~
~1~
~~
~Set Access Control~
~{6A05D92A-CC01-41E5-8F79-553A41BF48A7}~
~HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\~
~FALSE~
~TRUE~
~FALSE~
~FALSE~
~~
~TRUE~
~FALSE~
~TRUE~
~FALSE~
~FALSE~
~FALSE~
~FALSE~
~TRUE~
~FALSE~
~FALSE~
~MessageBox~
~{3CB49F26-E39F-4AE2-BA71-7FAD4F68F5AB}~
~2~
~~
~0~
~1~
~~
~Set Variable~
~{F36A50F7-F99B-45DC-80A2-393118FE59F5}~
~NATIVE_ENGINE$MYAH$MYAH$FALSE~
~FALSE~
~Write Registry~
~{BC214C71-06A9-4D8F-8878-0826D64DAB37}~
~0~
~2|~
~SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths\~
~$TARGETDIR$~
~0~
~FALSE~
~TRUE~
~Set Variable~
~{4061A2BB-B0BF-4ACA-B13A-6AF6B15817DE}~
~NATIVE_ENGINE$MYAH$MYAH$FALSE~
~TRUE~
~MessageBox~
~{2FD6299E-9FBF-48DB-83CB-372C24F7485E}~
~1~
~~
~0~
~1~
~~
~Set Access Control~
~{7DE73FCC-B026-4D9C-A608-E183ACC6589A}~
~HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\~
~FALSE~
~TRUE~
~FALSE~
~FALSE~
~~
~TRUE~
~TRUE~
~TRUE~
~FALSE~
~FALSE~
~FALSE~
~FALSE~
~TRUE~
~FALSE~
~FALSE~
~If~
~{FD1FC717-0063-4279-A634-E6572518AC0F}~
~MSESSENTIALSINSTALLED~
~0~
~NO$KEY~
~TRUE~
~Check Registry~
~{2EBA81A6-F827-4D41-B53A-FC39A24FF700}~
~MSESSENTIALSINSTALLED|~
~2~
~SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths~
~~
~End~
~{4D0C542D-2118-4D34-AA8F-55B8C75D16F5}~
~Terminate Install~
~{3EB270C6-2578-41F7-B17B-F1215A6DF248}~
~MessageBox~
~{BA53BCC7-9995-4501-B777-D553A23CE4B2}~
~$TITLE$ Setup Error~
~This product requires at least Administrator Privileges.$NEWLINE$$NEWLINE$Setup cannot continue.~
~3~
~1~
~~
~If~
~{82312EC7-CCD0-4678-A44D-18575A1CCCEA}~
~CHECKSYSTEM~
~0~
~TRUE~
~TRUE~
~Get System Settings~
~{18CA5826-E995-44A8-8F3A-97624AD39D7C}~
~CHECKSYSTEM~
~0~


Regards,
T.

[FrancescoT]

Dear Tzachk,

I am not able to use the code you posted ... probably there was an error when you pasted it, but using the code below I am able to grant read/write permission to "Users".

Code: Select all

~InstallAware Clipboard Data~
~Set Access Control~
~{76431AAA-5C0D-463C-9804-8A7EDF184C77}~
~HKLM\software\mytest~
~FALSE~
~FALSE~
~FALSE~
~TRUE~
~Users~
~TRUE~
~TRUE~
~TRUE~
~FALSE~
~FALSE~
~FALSE~
~FALSE~
~TRUE~
~FALSE~
~FALSE~
~Comment~
~{2A11BF47-F41D-47B2-B1D4-A94EE2D99383}~
~~
~Set Variable~
~{062E9C59-6B7B-4BCE-AA72-7A25F686EC06}~
~NATIVE_ENGINE$MYAH$MYAH$FALSE~
~FALSE~
~Write Registry~
~{FD6431BF-1930-4955-9C31-D986AC894D4A}~
~0~
~2~
~software\mytest~
~Mykey~
~test~
~TRUE~
~FALSE~
~Set Variable~
~{59B8CADE-CCA6-454F-BA27-FF3B7EBC2532}~
~NATIVE_ENGINE$MYAH$MYAH$FALSE~
~TRUE~


Hope this helps you.

Regards

[tzachk]

Hi Francesco,

Your code works but mine does not.
My code tries to add an exception to Microsoft essentials (A.V).
I tried to copy back my code from the support web site and paste it to Installaware and it was fine.

Code: Select all

~InstallAware Clipboard Data~
~End~
~{F3547C5C-8B6E-4557-A028-1BF69027428B}~
~MessageBox~
~{BD088721-8814-4971-8A3F-C9BB40FB6660}~
~3~
~~
~0~
~1~
~~
~Set Access Control~
~{6A05D92A-CC01-41E5-8F79-553A41BF48A7}~
~HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\~
~FALSE~
~FALSE~
~FALSE~
~TRUE~
~Users~
~TRUE~
~FALSE~
~TRUE~
~FALSE~
~FALSE~
~FALSE~
~FALSE~
~TRUE~
~FALSE~
~FALSE~
~MessageBox~
~{3CB49F26-E39F-4AE2-BA71-7FAD4F68F5AB}~
~2~
~~
~0~
~1~
~~
~Set Variable~
~{F36A50F7-F99B-45DC-80A2-393118FE59F5}~
~NATIVE_ENGINE$MYAH$MYAH$FALSE~
~FALSE~
~Write Registry~
~{BC214C71-06A9-4D8F-8878-0826D64DAB37}~
~0~
~2|~
~SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths\~
~$TARGETDIR$~
~0~
~FALSE~
~TRUE~
~Set Variable~
~{4061A2BB-B0BF-4ACA-B13A-6AF6B15817DE}~
~NATIVE_ENGINE$MYAH$MYAH$FALSE~
~TRUE~
~MessageBox~
~{2FD6299E-9FBF-48DB-83CB-372C24F7485E}~
~1~
~~
~0~
~1~
~~
~Set Access Control~
~{7DE73FCC-B026-4D9C-A608-E183ACC6589A}~
~HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\~
~FALSE~
~FALSE~
~FALSE~
~TRUE~
~Users~
~TRUE~
~TRUE~
~TRUE~
~FALSE~
~FALSE~
~FALSE~
~FALSE~
~TRUE~
~FALSE~
~FALSE~
~If~
~{FD1FC717-0063-4279-A634-E6572518AC0F}~
~MSESSENTIALSINSTALLED~
~0~
~NO$KEY~
~TRUE~
~Check Registry~
~{2EBA81A6-F827-4D41-B53A-FC39A24FF700}~
~MSESSENTIALSINSTALLED|~
~2~
~SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths~
~~
~End~
~{4D0C542D-2118-4D34-AA8F-55B8C75D16F5}~
~Terminate Install~
~{3EB270C6-2578-41F7-B17B-F1215A6DF248}~
~MessageBox~
~{BA53BCC7-9995-4501-B777-D553A23CE4B2}~
~$TITLE$ Setup Error~
~This product requires at least Administrator Privileges.$NEWLINE$$NEWLINE$Setup cannot continue.~
~3~
~1~
~~
~If~
~{82312EC7-CCD0-4678-A44D-18575A1CCCEA}~
~CHECKSYSTEM~
~0~
~TRUE~
~TRUE~
~Get System Settings~
~{18CA5826-E995-44A8-8F3A-97624AD39D7C}~
~CHECKSYSTEM~
~0~


[tzachk]

Hi Francesco,

I just found out why it is not working for me. If there is a user set with permissions on this key, Set Access Control won't change his access control.
How can I bypass this issue? Can I remove a user from a key?

Regards,
T.

[FrancescoT]

Let me check.

Regards

[FrancescoT]

Dear Tzachk,

I just tried to grant a READ/WRITE permission to Users, over a REG-Key that already has a READ permission ... and it worked fine.

I can only suppose that probably exist something else at the source of your problem and this due the nature of the key your are trying to edit (Microsoft Antimalware). For example, it could be possible that may exist a security policy that affects that key and this due the purpose of the key itself.

I may suggest you to verify if exist any documentation about this, that could be available with the application that generated the key.

Hope this helps you.

Regards

[tzachk]

Hi Francesco,

Thanks.

I shall check it out.

Regards,
T.

[FrancescoT]

[tzachk]

Hi Francesco,

I got back to this issue and now I saw that Microsoft antimalware registry has only SYSTEM account with set value enabled.
Is it possible in Installaware to set registry keys while running with SYSTEM account ACL? (without executing external program. A solution that I shal revert to if nothing else helps).

Regards,
T.

[FrancescoT]

Dear Tzachk,

if you run the package under System Account, I am sure you can set registry keys ... but I don't know if that particular key may have some other behaviors.

You could use "PSTools" for such purpose.
http://technet.microsoft.com/en-us/sysinternals/bb896649.aspx

Regards