Search code examples
c++windows-installerprivilegesuac

C++ MSI Package Administative Privileges


Here is the issue that I am having,

I have a C++ application that runs by writing data to .txt files and I want to create an MSI Package for the application.

When I build and run my app all is fine but when I run my MSI Setup File the created application does get granted the correct privileges to function.

I can't find a way to allow the app to write to the .txt files needed even if I include them in the package and set them as system files.

If I "Run as administrator" all is well but that isn't really plausible as I need it to function while "Running as User".

Is there anyway to prompt the user while installing to agree to an install with admin rights, so it doesn't have to be done manually before a prompt each launch.

Anything that can get my code running again would be brilliant, thanks.


Solution

  • Longer Writeup: System.UnauthorizedAccessException while running .exe under program files (several other options in addition to the ones listed below).


    Per-User Folder: I would think you should install the files in question to a per-user folder (writeable for user - for example My Documents), or as templates to a per-machine folder (not writeable for normal users - for example %ProgramFiles%) and then have your application copy the templates from the per-machine location to the current user's My Documents folder - for example. Then you write to the files there - where a regular user will have write access. I suppose you could also write to a network share which is set up for users to have access.

    Elevation: It is possible, to require the application to run elevated (link might be outdated - for .NET it is slightly different), but this is a horrible approach for something as simple as writing to text files. I would never require such elevation. Elevated rights are pervasive, and you don't want your application to run with the keys to the city - you become a hacker target and bugs in your tool become armed and dangerous.

    ACL Modification: It is also possible to install the text files to a per-machine location and apply ACL permissioning to them so that they are writeable for regular users even if they don't have elevated rights. There is some information on how to do this here (bullet point 2). This approach is frowned upon in this day and age, but it will work. Be on the alert that your ACL permissioning shouldn't be too tight, in case you write to a new file, delete the old one and rename the new file to the old name during your write operation - you need file create in addition to file write obviously - there is very fine-grained control in NTFS. GenericWrite should do the trick I think.


    Some Links (loosely connected, added for easy retrieval):