C++ MSI Package Administative Privileges

Question

Here is the issue that I am having,

I have a C++ application that runs by writing data to .txt files and I want to create an MSI Package for the application.

When I build and run my app all is fine but when I run my MSI Setup File the created application does get granted the correct privileges to function.

I can't find a way to allow the app to write to the .txt files needed even if I include them in the package and set them as system files.

If I "Run as administrator" all is well but that isn't really plausible as I need it to function while "Running as User".

Is there anyway to prompt the user while installing to agree to an install with admin rights, so it doesn't have to be done manually before a prompt each launch.

Anything that can get my code running again would be brilliant, thanks.

Answer 1

Longer Writeup: System.UnauthorizedAccessException while running .exe under program files (several other options in addition to the ones listed below).

---

Per-User Folder: I would think you should install the files in question to a per-user folder (writeable for user - for example My Documents), or as templates to a per-machine folder (not writeable for normal users - for example %ProgramFiles%) and then have your application copy the templates from the per-machine location to the current user's My Documents folder - for example. Then you write to the files there - where a regular user will have write access. I suppose you could also write to a network share which is set up for users to have access.

Elevation: It is possible, to require the application to run elevated (link might be outdated - for .NET it is slightly different), but this is a horrible approach for something as simple as writing to text files. I would never require such elevation. Elevated rights are pervasive, and you don't want your application to run with the keys to the city - you become a hacker target and bugs in your tool become armed and dangerous.

ACL Modification: It is also possible to install the text files to a per-machine location and apply ACL permissioning to them so that they are writeable for regular users even if they don't have elevated rights. There is some information on how to do this here (bullet point 2). This approach is frowned upon in this day and age, but it will work. Be on the alert that your ACL permissioning shouldn't be too tight, in case you write to a new file, delete the old one and rename the new file to the old name during your write operation - you need file create in addition to file write obviously - there is very fine-grained control in NTFS. GenericWrite should do the trick I think.

---

Some Links (loosely connected, added for easy retrieval):

• Create folder and file on Current user profile, from Admin Profile
• Why is it a good idea to limit deployment of files to the user-profile or HKCU when using MSI?
• Create a .config folder in the user folder

Answer 2

There is no connection at all between the install of an application and the running of an application regarding privileges. In other words there is nothing you can do in an MSI install that grants elevated privileges to the app being installed. It would be a massive security breach if a limited user could create an MSI setup that then installed an app that ran elevated.

So this question is actually nothing to do with Windows Installer - it's about whether you require users to be limited users or elevated users. If it's acceptable that users must be privileged, then you give the app an elevation manifest. If limited users will use it, then all writes or modifications to files or registry entries must be to locations available to limited users. It also means that the app won't be able to perform privileged operations, such as starting or stopping services.