Question

Is is possible to build a MSI installer which can do a per-user install for a non-admin user (copy files to the non-admin user’s directories) but also copy files into Program Files or other admin-only directories? With NSIS there exists a UAC plugin that allows some steps to be run as the normal user and others to run with elevated privileges. Does such a thing exist for MSI or is there some way to retain the original user context while gaining the admin permissions?

Answer 1

No, it’s not possible. The installation either runs in user context or in elevated system context.

Yet it does not prevent you from copying some files into user’s profile. These files will inherit the default permissions set on folders. The defaults are full access to the user, system and administrators group.

---

Although it’s technically possible, I would not recommend using it. Consider a computer with several users: one of them installs your MSI package, and they get files installed in user’s profile. Another user logs on this computer and starts your application from Start menu: there are no files in user’s profile whereas your application expects them there.

The best approach to overcome this problem is to install the files that you want to go into user’s profile to Program Files. At the first start of your application, it copies these files to user’s profile. Thus every user of a multi-user computer will be able to use your application.

If these data are to be shared between users, consider installing them into ProgramData, CommonAppDataFolder property. This way the files will be visible and readable to all users of computer. Yet only the user who installed the application will have write access, so your installer should modify permissions on your application folder inside ProgramData to give write rights to other users.