InstallShield 2012 Express Edition User Guide - Knowledge Base ...

Chapter 7: Specifying Installation Information
Configuring General Project Settings
Note: The trailing backslash specifies that the final portion of the specifier is the name of a key and not a value name.
Securing Files, Folders, and Registry Keys in a Locked-Down
Environment
InstallShield offers different ways to secure files, folders, and registry keys for end users who run your
product in a locked-down environment:
• Traditional Windows Installer handling—InstallShield stores permission information for your product
in the LockPermissions table of the .msi database.
• Custom InstallShield handling—InstallShield stores permission information for your product in the
ISLockPermissions table of the .msi database. InstallShield also adds custom actions to your
project.
These methods enable you to assign permissions for a file, folder, or registry key to specific groups and
users. For example, you may assign Read, Write, and Delete permissions for a particular file to the
Administrators group, but only Read permissions for all of the users in a different group.
Determining Which Option to Use
The following table compares the different types of methods for setting permissions.
Table 7-1: Comparison of Different Ways to Secure Objects (Files, Folders, and Registry Keys) in a Locked-Down
Environment
Comparison Category Explanation of Available Support
Well-known security
identifiers (SIDs)
Localized names for
SIDs
Ability to deny specific
permissions
• Traditional Windows Installer handling—Supports a limited number of SIDs
(Administrators, Everyone).
• Custom InstallShield handling—Supports many SIDs (Administrators, Authenticated
Users, Creator Owner, Everyone, Guests, Interactive, Local Service, Local System,
Network Service, Power Users, Remote Desktop Users, and Users).
• Traditional Windows Installer handling—Does not support localized names for
SIDs; if you try to use a localized name, the installation fails.
• Custom InstallShield handling—Supports localized names for all of the supported
well-known SIDs (Administrators, Authenticated Users, Creator Owner, Everyone,
Guests, Interactive, Local Service, Local System, Network Service, Power Users,
Remote Desktop Users, and Users).
• Traditional Windows Installer handling—Not supported. This handling lets you set
specific permissions; you cannot deny permissions. Thus, you can give a user readonly
access to a file. However, you cannot prevent a user from having read-only
access.
• Custom InstallShield handling—Supported. This option lets you indicate whether
you want to deny a user or group from having the permissions that you are specifying.
InstallShield 2012 Express Edition User Guide ISE-1800-UG01 141