Re: maybea silly question

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

Yes there is a VB6 sample to set permissions on NTFS folders. See Q240176,
"HOWTO: Set Security on a NTFS Folder Programmatically". It's not in MSKB
online version, but maybe in the web and MSDN Library - October 2001. Here
is a web version that I found:

http://www.tek-tips.com/viewthread.cfm?qid=644287


Thank you. I didn't know where to start. It is strange
that the MS page is missing. A Google search of the
Q number just turns up lots of VB code sites.


Yes you can do that, but it's a bad idea from a security stand point. A
limited user could modify the file or a virus modify it, then if an Admin
later logs on and runs the program expecting that the user can't modify
the
EXE because of NTFS security, the system gets infected.

It's okay however if you have a "Data" subfolder and change the
permissions
on that folder and add the per machine INI there, but I haven't tested
this
situation on Vista to see if it's redirected even if you have changed the
permissions.

I guess what I'm wondering is, are folder permissions
independent of parent folder permissions?

It can be set both ways. There is an option to inherit the security of the
parent or not.


OK. That's clear. I haven't made any effort to adapt
to Vista thus far, but the notion of a data folder under
app.path, with no permission worries, seems like a very
sensible idea. (At least it's sensible for storing settings.
It doesn't solve the problem of a program that actually
needs to run without restriction, but I suppose that for
that the end-user needs to simply be informed and allowed
to make their own choice.)

You probably can get a used PC in your area with a legal copy of XP for
less
than $100 to test with. Check "For sale/Computers" below and search for XP
or Vista. Vista requires 512 MB RAM Minimum.

I have XP. But I mainly only use it for testing
software. And though I've dabbled a bit with
setting up various types of users, I find that to
be a pain in the neck, generally. The difficulty for
me is that I've only used PCs as a "power user"
on a stand-alone machine, and I act accordingly
when I write software -- aiming at that audience.
Before Vista that wasn't an issue.

Example:
Just this morning, in another group, someone was
complaining that VBScripts don't run the same way
when shelled from my script editor (in Vista) as they
do when the script file is saved and double-clicked.
I'm guessing that's an issue with permission and/or
file virtualization. The editor is something mainly used
by programmers, system administrators, etc. Therefore
it generally needs to have full file system and Registry
access, and scripts being run are likely to be accessing
the full file system and Registry. That's the kind of
problem I see with running as a limited user on NT
systems. I'm just not writing a word processor to be
used on corporate workstations.

Nevertheless, using an App.Path\Data folder does
at least solve the problem of allowing global settings
that aren't spread around the system.


.

Relevant Pages

  • Re: Too late for Administrators Password?
    ... if you're going to be messing with permissions then ALWAYS FIRST SET ... folder and click the Security Options folder. ... Next, administrator, you need to have the security tab show when you ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Still Read-only
    ... >That is how XP and W2k3 are. ... >read-only attribute of the folder. ... >and file permissions are different things. ... Security) ...
    (microsoft.public.windowsxp.security_admin)
  • Re: For those of you who have disabled UAC while using user/admin, you dont have full admin rights &
    ... In Vista, an admin user doesn't have permissions to do everything they did in previous verions of Windows, but still has the ability to take ownership and change permissions. ... Really, all one has to do is add a second user account on the folder or file and give full rights as like the Administrator group, which would be the User account of the user/admin that logs into the machine. ...
    (microsoft.public.windows.vista.general)
  • Re: For those of you who have disabled UAC while using user/admin, you dont have full admin rights &
    ... In Vista, an admin user doesn't have permissions to ... has the ability to take ownership and change permissions. ... all one has to do is add a second user account on the folder ...
    (microsoft.public.windows.vista.general)
  • Re: XP File and printer sharing SOLVED!! A HIDDEN FIREWALL!!
    ... Then click a shared folder to open it. ... problem is probably caused by share permissions or NTFS file system ... I decided that it /had/ to be a firewall problem. ... I hadn't used any Symantec security software ...
    (microsoft.public.windowsxp.network_web)