How To Set Permissions Using the LockPermissions Table

This article describes use of the LockPermissions Table to add or restrict permissions on registry keys, files, or folders.

The LockPermissions Table can be used to set permissions on objects that are created by your Windows Installer database. You cannot use LockPermissions to modify objects that are not created by your database. The LockPermissions Table's first argument specifies a key from either the File Table, CreateFolders Table, or the Registry Table.

The permissions that can be set are as follows:
A common example of using the LockPermissions Table is to set full privileges to a registry key that would normally be locked down. This key might need to contain settings that the user can change, so the user must have full permissions to that key.


This sample demonstrates giving of full permission to the Everyone group on the SampleReg registry key created in the Registry Table.

You can create permissions for a parent folder or registry key that have lesser permissions than their child keys. You cannot have lesser permissions on a child key than its parents.

Example: A package installs a folder on the root directory called "Parent". The folder permissions are set to read and write. A folder is created in the Parent folder called "Child". This folder may have read, write, or read and write permissions only.

Note: In Windows Installer versions prior to version 2.0, you cannot set permissions on files that are stored in external or internal cabinet files. This problem has been resolved in version 2.0 of the Windows Installer.

For more information on the LockPermissions Table see the Windows Installer SDK documentation.

You can download the Windows Installer SDK from the following Web page: