Stop user changing installation path

[gonzalioz]

Hi all,

I have a setup project that install my application to the application directory.

It's very important that it isn't installed anywhere else because since my application will download another application(an updater) that overwrites the application files, it can't be in the program files directory because vista won't allow that.

How can I make sure the user does not change the path where the application is installed?

[si_the_geek]

That is entirely the wrong thing to do, and is a large part of the reason why Vista has that security in the first place.

What you should be doing is installing to the ProgramFiles folder, and when you are updating it elevate the process (ie: invoke admin permissions, using a UAC prompt if apt) so that it has permission to overwrite the files.

Unfortunately I can't give you a VB.Net example of that, but I'm sure you can find one easily on the forums.

[dilettante]

Actually Microsoft has blessed this kind of thing, with severe cautions about the potential risks si_the_geek mentions.

The two "blessed" scenarios are:

• Self-updating applications, primarily games.
• Per-user installation of applications. Generally simple applications that don't require a Service, DCOM, GAC assemblies, etc.

There are a number of additional caveats. For example if such an application uses isolated component libraries or .Net assemblies they won't be serviced normally (e.g. bug fixes via Windows Update). MSDN lists a few more issues as well.

But there isn't much that can keep a determined user from moving such applications. There are approved locations for them though, formalized in Windows 7 and Installer 5.0:

FOLDERID_UserProgramFiles: “%LocalAppData%\Programs”
FOLDERID_UserProgramFilesCommon: “%LocalAppData%\Programs\Common”

See: Authoring a single package for Per-User or Per-Machine Installation context in Windows 7.

Just to keep the arms race going, Microsoft has provided GPO settings that will prevent any such programs from being run by users. This of course includes anything using ClickOnce deployment as well!


But it is always best to deploy to Programs (formerly "Program Files").

[illskills]

That is entirely the wrong thing to do.

very true your paths should be dynamic

this is one of the firsts tests i do which is change the app folder name and make sure everything still works and nothing is hard coded.

you should be able to code your work to handle this

[si_the_geek]

That test isn't reliable I'm afraid, because there are some things which must rely on the path staying the same once the installation process has finished.

One that springs to mind is integration with Explorer (eg: adding extra options when you right-click on a folder), which needs the full path to the executable.

[illskills]

ive never looked at integrating stuff to the shell but its a good check to remove hard coded links ... any chance you could have a look @ my thread si ?

its in this forum re app security

[si_the_geek]

I looked at your thread earlier, and cannot help because I haven't got that kind of VB.Net experience yet.

[illskills]

I looked at your thread earlier, and cannot help because I haven't got that kind of VB.Net experience yet.

thanks dude ... yeah its new ground for me too