WiX sets App_Data folder permission to change for NetworkService
I am struggling with this. I need to set permissions of App_Data folder in ASP.Net site to change for NetworkService account via Wix installer. I tried the following but no luck.
<CreateFolder>
<util:PermissionEx GenericAll="yes" ChangePermission="yes" Delete="yes"
DeleteChild="yes" User="[WIX_ACCOUNT_NETWORKSERVICE]" />
</CreateFolder>
I tried specifying Append as well, but I got an error saying this is not allowed.
source to share
You want User = "NetworkService". The SecureObj.cpp code contains a list of known users that PermissionEx supports.
`// figure out the right user to put into the access block
if (!*pwzDomain && 0 == lstrcmpW(pwzUser, L"Everyone"))
{
hr = AclGetWellKnownSid(WinWorldSid, &psid);
}
else if (!*pwzDomain && 0 == lstrcmpW(pwzUser, L"Administrators"))
{
hr = AclGetWellKnownSid(WinBuiltinAdministratorsSid, &psid);
}
else if (!*pwzDomain && 0 == lstrcmpW(pwzUser, L"LocalSystem"))
{
hr = AclGetWellKnownSid(WinLocalSystemSid, &psid);
}
else if (!*pwzDomain && 0 == lstrcmpW(pwzUser, L"LocalService"))
{
hr = AclGetWellKnownSid(WinLocalServiceSid, &psid);
}
else if (!*pwzDomain && 0 == lstrcmpW(pwzUser, L"NetworkService"))
{
hr = AclGetWellKnownSid(WinNetworkServiceSid, &psid);
}
else if (!*pwzDomain && 0 == lstrcmpW(pwzUser, L"AuthenticatedUser"))
{
hr = AclGetWellKnownSid(WinAuthenticatedUserSid, &psid);
}
else if (!*pwzDomain && 0 == lstrcmpW(pwzUser, L"Guests"))
{
hr = AclGetWellKnownSid(WinBuiltinGuestsSid, &psid);
}
else if(!*pwzDomain && 0 == lstrcmpW(pwzUser, L"CREATOR OWNER"))
{
hr = AclGetWellKnownSid(WinCreatorOwnerSid, &psid);
}
else if (!*pwzDomain && 0 == lstrcmpW(pwzUser, L"INTERACTIVE"))
{
hr = AclGetWellKnownSid(WinInteractiveSid, &psid);
}
else if(!*pwzDomain && 0 == lstrcmpW(pwzUser, L"Users"))
{
hr = AclGetWellKnownSid(WinBuiltinUsersSid, &psid);
}
else`
The Windows Installer blocking table (Permission element in WiX) also supports most of the famous names, but they are localized, which is very bad design IMHO. That's why WiX has this famous list.
source to share
Well, I figured out the answer (maybe not the answer). You cannot set file permission using the utility: PermissionEx for the "Network Service" account (not very well known, or something like that). In the end, I wrote a custom action that sets the permission using the cacls.exe utility.
<CustomAction Id="PermissionAppData" Directory="TARGETDIR"
ExeCommand=""[SystemFolder]cacls.exe"
"[INSTALLDIR]\App_Data"
/T /E /G "NT AUTHORITY\Network Service:C"" Return="check" />
source to share