[wpkg-users] Relax Win 7 permissions for unprivileged users

[Troy Hamilton]

Hi Mark,

> For some applications I need to relax the security settings on the Program
> Directory. For example, I would like Mozilla firefox and thunderbird to be
> able to self-update even for my users that are unprivileged. I thought
> something like the following would work in a batch file:
>
>
> "%SOFTWARE%\firefox\Firefox Setup 3.6.12.exe" -ms
> icacls "%ProgramFiles(x86)%\Mozilla Firefox" /grant Users:F
>
> But I've had inconsistent results. Is this the best method?

After you run the above icacls command, does the expected "users" ACE
show up in the permissions tab of the "Mozilla Firefox" directory
properties?  If not, then you might give setacl.exe
(http://helgeklein.com/setacl/examples/managing-file-system-permissions-with-setacl-exe/)
a try to see if you get the ACE you expect.

Once the users group has full control of the firefox directory (either
from running icacls, setacl, or manually setting the permissions) does
the self-update work correctly?

I don't have nearly as much experience with Win7 as XP, so I can't
comment on whether UAC or something else would be causing problems
even when the permissions are set.


Cheers,

Troy