Using the Wise Package Studio to Set File, Folder, and Registry Security Permissions
There are some articles in the Juice forum which let you to Set permission using Secedit, Cacls, or by directly editing tables in Wise Package Studio. In this article I have tried explain setting permission by GUI Options available in Wise Package Studio. With this you can define security settings for files, folders and registry keys with ease. By setting security permissions, you can make certain that your installed application runs effectively and properly.
Introduction
During an installation, you may need to give additional file, folder, or registry access rights to a user in order for the application to function properly. By configuring the permissions for files, folders or registry keys, you are actually replacing the machine's or user's current permission settings. If you need to add to the current security permissions for files, folders, or registry keys, you must specify the current information as well as the permission changes. The security settings so defined will be stored in LockPermissions table in Windows Installer and this lets you set specific security permissions for your installation.
Setting File Permissions
Start Wise Package Studio then open Windows Installer Editor to edit the application.
Select Installation Expert tab, and then Navigate to Files page in Installation Expert tab.
In the bottom right pane, select the file to which you want to set permissions and click the Details button.
The File Details dialog appears.
Select Permissions tab and then on the Permissions tab click the Add button.
The Lock Permissions Details dialog appears.
Enter the following information in the fields on the Lock Permissions Details dialog:
- Domain: Enter the appropriate domain. If you want to set rights for a local computer user, specify the domain as [ComputerName] or, to specify the current user's domain, use [%USERDOMAIN].
- User: Enter the appropriate user. You can specify a group name, such as Users or Everyone, or a specific username. To specify the current user's ID, use the property, [LogonUser].
Click OK to close the dialog.
Select the permissions by checking the check boxes as appropriate.
Click OK to save your changes.
Setting Registry Permissions
Start Wise Package Studio then open Windows Installer Editor to edit the application.
Select Installation Expert tab, and then Navigate to Registry page in Installation Expert tab.
Right Click on the Registry/ Registry tree to which you want to set permissions.
From the Menu Select Permissions
On the Permissions tab click the Add button.
The Lock Permissions Details dialog appears.
Enter the following information in the fields on the Lock Permissions Details dialog:
- Domain: Enter the appropriate domain. To set rights for a local computer user, enter [ComputerName], or to specify the current user's domain, enter [%USERDOMAIN].
- User: Enter the appropriate user. You can specify a group name, such as Users or Everyone, or a specific username. To specify the current user's ID, enter [LogonUser].
Click OK to Close the Lock Permissions Details dialog.
Select the permissions by checking the checkboxes as appropriate.
Click OK to save your changes.
Setting Folder Permissions
Folder Permissions can be set from Installation Expert page and also from Setup Editor page. I will explain both the cases in the following section.
Case 1: Installation Expert page
Start Wise Package Studio then open Windows Installer Editor to edit the application.
Select Installation Expert tab, and then Navigate to Files page in Installation Expert tab.
In the Destination Computer pane, select the folder to which you want to set permissions and then click the Details button.
The Create Folder Details dialog appears.
On the Permissions tab click the Add button.
The Lock Permissions Details dialog appears.
Enter the following information in the fields on the Lock Permissions Details dialog:
- Domain: Enter the appropriate domain. If you want to set rights for a local computer user, specify the domain as [ComputerName] or, to specify the current user's domain, use [%USERDOMAIN].
- User: Enter the appropriate user. You can specify a group name, such as Users or Everyone, or a specific username. To specify the current user's ID, use the property, [LogonUser].
Click OK to close the dialog.
Select the permissions by checking the checkbox as appropriate.
Click OK to save your changes.
Case 2 Setup Editor Page
Select Setup Editor, click the Features tab.
In the left pane, Right-Click the feature to which you want to set permission.
From the Right-Click menu, select New and then select Create Folder.
The Create Folder Details dialog appears.
Select the directory in which you want to create the new folder from the Directory drop-down list. To enter a new directory, type a backslash (\) at the end of the existing path followed by the new folder name.
On the Permissions tab click the Add button.
The Lock Permissions Details dialog appears.
Enter the following information in the fields on the Lock Permissions Details dialog:
- Domain: Enter the appropriate domain. To specify the domain for a local computer user, enter [ComputerName], or to specify the current user's domain, enter [%USERDOMAIN].
- User: Enter the appropriate user. You can specify a group name (such as Users or Everyone, or a specific username. To specify the current user's ID, enter [LogonUser].
Click OK to Close the dialog.
Select the permissions by checking the checkbox as appropriate.
Click OK to save your changes.
LockPermissions Table
The security settings so defined will be stored in LockPermissions table in Windows Installer and this lets you set specific security permissions for your installation. One can set security settings by directly editing LockPermissions table, while doing so one has to be very careful in entering the data in the columns.
The following gives the most commonly used values in permission column.
Thanks,
Sid
Comments
You say: "During an
You say:
"During an installation, you may need to give additional file, folder, or registry access rights to a user in order for the application to function properly."
But the reason that Secedit, Cacls etc. is used instead of the LockPermission Table or the UI is that Wise overwrites all permissions on the particular file/folder/reg.key and DOES NOT ADD!
In your example, the file that you give Domain Users permissions too, will wipe out Groups/Admin accounts that have permissions on that file already.
Which will only leave.......Domain Users and it's permission.
This is something that you never want, so my 2 cents.
Stay away from the LockPermission Table.
~Maggie
LockPermission Table
I think the LockPermission Table gets a bad press, for sure we all know it does not include inheritence. If you are only dealing with program files\adobe\reader or other application under program files, then in the main who cares if you replace the current permissions with Authenticated Users = Full Control. This is from the perspective that you only need to modify the current permissions because something doesn't work and you need to allow users more permission on the locked down environment.
Would you like to reply?
Login or Register to post your comment.