Permission Element

Description

Sets ACLs on File, Registry, or CreateFolder. When under a Registry element, this cannot be used if the Action attribute's value is remove or removeKeyOnInstall. This element has no Id attribute. The table and key are taken from the parent element.

Windows Installer references

LockPermissions Table

Parents

CreateFolder, File, FileShare, Registry, ServiceInstall

Inner Text

None

Children

None

Attributes

Name	Type	Description	Required
Append	YesNoType	The right to append data to the end of a file.
ChangePermission	YesNoType	The standard access right to modify permissions in the object's security descriptor.
CreateChild	YesNoType	For a directory, the right to create a subdirectory. Only valid under a 'CreateFolder' parent.
CreateFile	YesNoType	For a directory, the right to create a file in the directory. Only valid under a 'CreateFolder' parent.
CreateLink	YesNoType	Reserved for system use.
CreateSubkeys	YesNoType	The right to create subkeys of a registry key.
Delete	YesNoType	The standard access right to delete the object.
DeleteChild	YesNoType	For a directory, the right to delete a directory and all the files it contains, including read-only files. Only valid under a 'CreateFolder' parent.
Domain	String	The domain of the user getting the specified permissions.
EnumerateSubkeys	YesNoType	The right to get a list of a registry key's subkeys.
Execute	YesNoType	The right to execute a file.
Extended	YesNoType	Specifies whether or not to use the LockPermissions table when the Permission element is nested under a Registry, File, or CreateFolder element. If Extended is set to 'yes' then the WiX SecureObject custom action will be used to lock down the resource instead of the "legacy" LockPermissions table. Specifying 'yes' for this attribute will require you to link your MSI with the wixca.wixlib. By using the SecureObject custom action you can apply permissions for many more well known user SIDs as well as for user accounts that are created as part of the install.
GenericAll	YesNoType	General read, write, and execute access, mapped by Windows to a set of standard and object-specific access rights.
GenericExecute	YesNoType	General execute access, mapped by Windows to a set of standard and object-specific access rights.
GenericRead	YesNoType	General read access, mapped by Windows to a set of standard and object-specific access rights. Specifying only GenericRead is not allowed; you must combine it with some additional attribute.
GenericWrite	YesNoType	General write access, mapped by Windows to a set of standard and object-specific access rights.
Notify	YesNoType	The right to request notification of changes to a registry key.
Read	YesNoType	The standard access right to read the object.
ReadAttributes	YesNoType	The right to open and copy file system attributes from a folder or file.
ReadExtendedAttributes	YesNoType	The right to open and copy extended file system attributes from a folder or file.
ReadPermission	YesNoType	The standard access right to read permissions in the object's security descriptor.
ServiceChangeConfig	YesNoType	Required to call the ChangeServiceConfig or ChangeServiceConfig2 function to change the service configuration. Only valid under a 'ServiceInstall' parent.
ServiceEnumerateDependents	YesNoType	Required to call the EnumDependentServices function to enumerate all the services dependent on the service. Only valid under a 'ServiceInstall' parent.
ServiceInterrogate	YesNoType	Required to call the ControlService function to ask the service to report its status immediately. Only valid under a 'ServiceInstall' parent.
ServicePauseContinue	YesNoType	Required to call the ControlService function to pause or continue the service. Only valid under a 'ServiceInstall' parent.
ServiceQueryConfig	YesNoType	Required to call the QueryServiceConfig and QueryServiceConfig2 functions to query the service configuration. Only valid under a 'ServiceInstall' parent.
ServiceQueryStatus	YesNoType	Required to call the QueryServiceStatus function to ask the service control manager about the status of the service. Only valid under a 'ServiceInstall' parent.
ServiceStart	YesNoType	Required to call the StartService function to start the service. Only valid under a 'ServiceInstall' parent.
ServiceStop	YesNoType	Required to call the ControlService function to stop the service. Only valid under a 'ServiceInstall' parent.
ServiceUserDefinedControl	YesNoType	Required to call the ControlService function to specify a user-defined control code. Only valid under a 'ServiceInstall' parent.
Synchronize	YesNoType	The standard access right to use the object for thread synchronization.
TakeOwnership	YesNoType	The standard access right to change the owner in the object's security descriptor.
Traverse	YesNoType	For a directory, the right to traverse the directory. By default, users are assigned the BYPASS_TRAVERSE_CHECKING privilege, which ignores the FILE_TRAVERSE access right. Only valid under a 'CreateFolder' parent.
User	String	The user getting the specified permissions.	Yes
Write	YesNoType	The right to open and write to a file, folder, and registry key.
WriteAttributes	YesNoType	The right to open and write file system attributes to a folder or file.
WriteExtendedAttributes	YesNoType	The right to open and write extended file system attributes to a folder or file.

See Also

Wix Schema