Edit config in ProgramFiles with UAC turned on

Question

My question is quite similar to Launch application after installation complete, with UAC turned on

Rather than build a complex set of configuration screens into the installer, we would like to launch a config process after the installer is complete.

In all cases this will require the editing of content in ProgramFiles folder which is not editable as a standard user when UAC is enabled without elevation.

Options we know of and prefer not to use:

• to elevate the whole installer with a bootstrap - we would like not to do this to support 1 action of execute the config at the end elevated.
• including forced elevation in the config process - while we could in some cases work this into the app, in some cases we want to launch a simple editor on App.config where this forced elevation would not be an option.

Is there some way of getting an elevated version of

<Property Id="WixShellExecTarget" Value="[INSTALLDIR]\app.config" />
<CustomAction Id="LaunchApplication" BinaryKey="WixCA" DllEntry="WixShellExec" />

Or is it more appropriate to make custom UI and add the checkbox earlier in the UI and launch it as a deferred action without waiting, like

<CustomAction Id="Config.SetProperty" Property="Config" Value='"Open" app.config' />
<CustomAction Impersonate="no" Execute="deferred" Return="ignore" 
    Id="Config" BinaryKey="WixCA" DllEntry="CAQuietExec" />

Or do we just forget it all as a bad idea and the admin can go find the file and right click elevate to edit.

Answer 1

One of the options could be to launch your app non-elevated from the installer as you do now. Then when your app detects that it needs to edit config files, and it requests elevation.

Another option is to store config files in ProgramData directory rather than in Program Files. This location is writable without elevation. One caveat here: files and directories that created there will have write/modify permissions only for the user who created them; other users will have read-only access. If it's not desirable, you can change ACLs for your app config files.