Folder permissions with Vista and Network drives

[RobwEllis]

Hi,

One of my installation tasks to install an Access database in a user specified folder which may be on a network drive. (The default location is “[CommonApplicationData]\MyCo\MyApp\”).

The folder is created and the file is installed fine but I have an issue with permissions. If the user installs on a Vista machine, the created folder does not have sufficient permissions to run my application (it does not have the ability to create the database lock file). I thought the fix to this was simple and just modified the folders permissions from within Project Definition->Files and Folders to grant Everyone the necessary access level.

All works fine until the installation is run with the data directory specified on a network drive. The folder is created and file installed fine but I get the error “Could not set file security for file 'X:\Fred\DBDir\'. Error 3. Verify that you have sufficient privileges to modify the security permissions for this file." when it tries to set the permissions. This even occurs if the folder already exists and has the correct permissions.

I have read this topic http://www.advancedinstaller.com/forums ... ion#p17303 which is similar but it doesn’t really work for me since I can’t get xcacls to work on Vista. I have also tried to use icacls.exe from a custom action to just set the permission if installing on a vista machine to a non-network drive but icacls fails me.

This is the last thing I need to fix with my installer and it is driving me mad!!! Please help!

Rob

[Cosmin]

Hi,

If the user installs on a Vista machine, the created folder does not have sufficient permissions to run my application (it does not have the ability to create the database lock file). I thought the fix to this was simple and just modified the folders permissions from within Project Definition->Files and Folders to grant Everyone the necessary access level.

Actually, the application doesn't have enough privileges for the folder. Usually this is resolved by setting the correct permissions for the user account under which the application runs. The name of the current user is stored in the "USERNAME" property, so you can try setting permissions for it. Note that each permission uses specific permission options.

All works fine until the installation is run with the data directory specified on a network drive. The folder is created and file installed fine but I get the error “Could not set file security for file 'X:\Fred\DBDir\'. Error 3. Verify that you have sufficient privileges to modify the security permissions for this file." when it tries to set the permissions. This even occurs if the folder already exists and has the correct permissions.

Is the install performed per-machine or per-user? Usually when the installation needs to set permissions it is recommended to run it per-machine or per user with Administrator rights required. This way the install process will have enough privileges to set the permissions.

For network folders you need to make sure that the local system account (for per-machine installs) or the current user account (for per-user installs) has enough privileges to set permissions.

I have read this topic viewtopic.php?f=2&t=7558&p=17303&hilit=xcacls+custom+action#p17303 which is similar but it doesn’t really work for me since I can’t get xcacls to work on Vista. I have also tried to use icacls.exe from a custom action to just set the permission if installing on a vista machine to a non-network drive but icacls fails me.

On Vista the custom actions which need Administrator privileges should run as Deferred with no impersonation. This way they will run under the local system account with full privileges.

Regards,
Cosmin

[RobwEllis]

Hi Cosmin,

I finally got this working early this morning. I've ended up using a custom action which runs an exe that sets the permissions only if running on Vista and installing on a local drive.

I understand that the user needs the correct permission to change the security of a network folder but why, when using the folders permissions from within Project Definition->Files and Folders, does the install try to set folder permissions even if the folder already exists and has the correct permissions?

Cheers

Rob

[Cosmin]

Hi Rob,

why, when using the folders permissions from within Project Definition->Files and Folders, does the install try to set folder permissions even if the folder already exists and has the correct permissions?

This is how Window Installer manages permissions. The permissions in the package will be set no matter what permissions are already set on the target machine. The original permissions are replaced by the ones in the package.

Regards,
Cosmin