My application installs for a single user on a Windows machine. Any user may install the application for himself, but the application will save some information common to all users in a separate directory (currently in the subdirectory of the hidden ProgramData folder on Win Vista, 7 and 8). The application will need read and write access to this subdirectory and all of its subdirectories.

What are the minimum access rights, and which user must have them, i.e. do I need to assign read/write access to that subdirectory to each user separately, or is it enough to assign it to one user/group and which one? The application runs on Windows XP, Vista, 7 and 8.

  • Users have permissions to these folders by default. If they are part of the User group then they have the require permissions. Windows XP places the data in a different location then everything after Vista or it should.
    – Ramhound
    May 10, 2013 at 14:31
  • Yes, the application automatically saves in the location appropriate for the OS. But what you say is curious, given that the application has been installed on a client's machine and was denied access. The installation process created the base directory, but the application could neither read from it nor write into it. The administrators there said they cannot give read/write access to that directory for some reason, to which I responded that the application won't work without them. We've had similar troubles before while trying to delete files, which is why I'm looking for an alternative. May 13, 2013 at 13:01

1 Answer 1


You can either add the individual user or use built-in groups. The simplest way would be to assign the group read/write permissions to the parent directory the application needs permission to and propagate permissions down to the children via inheritance (usually automatic).

As far as groups there are many built-in groups as well as custom groups you can create. The default local groups, Administrator and User, should be sufficient to accomplish what you want. Alternatively you can also use the Authenticated Use" group.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .