title: Installshield : calling icacls to change write permission for special folder
body: <p>I've created an Installshield 2015 (Installscript) which installs a .NET application in an installation directory.</p>
  
  <p>The .NET application relies on a SQL CE 4.0 database.</p>
  
  <p>The installation process is run under Administrator or local administrator account.</p>
  
  <p>In Installshield project, I've put the emptied SQL CE 4.0 Database .sdf file into the [CommonAppDataFolder]. Installation process will copy the database in the following location :</p>
  
  <p>Windows Vista (or later) :  C:\ProgramData\MYCOMPANY\MYAPP\database.sdf</p>
  
  <p>At the end of the installation process, the MSI will call a batch file to set write permissions for the "Users" group like this (because of ownership taken when creating the file in the commonAppData folder) :</p>
  
  <pre><code>icacls C:\ProgramData\MYCOMPANY /T /grant *S-1-5-32-545:W
  </code></pre>
  
  <p>The application will be executed under a standard user process (not elevated by UAC) in order to connect and write to the compact database by members of the "Users" group.</p>
  
  <p>I was wondering if I was allowed to perform the 'icacls' command without creating a security hole for IT administrators and if I had to take into account other group SIDs ?</p>
  
  <p>Thanks in advance for your response,</p>