Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My application installs for a single user on a Windows machine. Any user may install the application for himself, but the application will save some information common to all users in a separate directory (currently in the subdirectory of the hidden ProgramData folder on Win Vista, 7 and 8). The application will need read and write access to this subdirectory and all of its subdirectories.

What are the minimum access rights, and which user must have them, i.e. do I need to assign read/write access to that subdirectory to each user separately, or is it enough to assign it to one user/group and which one? The application runs on Windows XP, Vista, 7 and 8.

share|improve this question
    
Users have permissions to these folders by default. If they are part of the User group then they have the require permissions. Windows XP places the data in a different location then everything after Vista or it should. –  Ramhound May 10 '13 at 14:31
    
Yes, the application automatically saves in the location appropriate for the OS. But what you say is curious, given that the application has been installed on a client's machine and was denied access. The installation process created the base directory, but the application could neither read from it nor write into it. The administrators there said they cannot give read/write access to that directory for some reason, to which I responded that the application won't work without them. We've had similar troubles before while trying to delete files, which is why I'm looking for an alternative. –  Nikola Novak May 13 '13 at 13:01

1 Answer 1

up vote 0 down vote accepted

You can either add the individual user or use built-in groups. The simplest way would be to assign the group read/write permissions to the parent directory the application needs permission to and propagate permissions down to the children via inheritance (usually automatic).

As far as groups there are many built-in groups as well as custom groups you can create. The default local groups, Administrator and User, should be sufficient to accomplish what you want. Alternatively you can also use the Authenticated Use" group.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.