[wpkg-users] Relax Win 7 permissions for unprivileged users

Troy Hamilton troy.a.hamilton at gmail.com
Fri Feb 11 19:37:03 CET 2011


Hi Mark,

> For some applications I need to relax the security settings on the Program
> Directory. For example, I would like Mozilla firefox and thunderbird to be
> able to self-update even for my users that are unprivileged. I thought
> something like the following would work in a batch file:
>
>
> "%SOFTWARE%\firefox\Firefox Setup 3.6.12.exe" -ms
> icacls "%ProgramFiles(x86)%\Mozilla Firefox" /grant Users:F
>
> But I've had inconsistent results. Is this the best method?

After you run the above icacls command, does the expected "users" ACE
show up in the permissions tab of the "Mozilla Firefox" directory
properties?  If not, then you might give setacl.exe
(http://helgeklein.com/setacl/examples/managing-file-system-permissions-with-setacl-exe/)
a try to see if you get the ACE you expect.

Once the users group has full control of the firefox directory (either
from running icacls, setacl, or manually setting the permissions) does
the self-update work correctly?

I don't have nearly as much experience with Win7 as XP, so I can't
comment on whether UAC or something else would be causing problems
even when the permissions are set.


Cheers,

Troy



More information about the wpkg-users mailing list