Write Access to Program Files folder

my application include a self-updater executable that is used to update the application.

One of the first steps the updater is performing is to check that it does have write permission to the application folder

IPermission perm = new FileIOPermission(FileIOPermissionAccess.AllAccess, _localApplicationCodebase);

When executing under Win7/Vista, this code pass (meaning that according to CAS, the code does have write access), however when I try to write files, I got an Access Denied (and I confirmed that the files are NOT in use)

I understand that Vista/Win7 UAC is preventing users from writing files in the program files folders. However, what I don’t understand is why the permission is granted if in reality it is not

PS : If I run the same code using ‘Run As Administrator’, it works fine

3 Answers 3

The important thing to know about UAC is that by default, no code runs with Administrator privileges and thus cannot write to the Program Files directory. Even if you are logged in as an administrator, the apps are launched with standard user privliges.

There are two ways around this. You can have the user start the app with the Run As Administrator menu item. But this relies on the user to remember something. The better was is to embed a manifest into your executable that requests administrator privileges. In the manifest, set requestedExecutionLevel to requireAdministrator. This will cause UAC to prompt the user for admin credentials as soon as the app starts.

Windows write file c program files

This forum has migrated to Microsoft Q&A. Visit Microsoft Q&A to post new questions.

Answered by:

Question

I am unable to copy files to the Program Files or Program Files (x86) folders, despite my status as Administrator on a single-user system. As an advanced user, I have many legitimate needs to place files there and cannot live with this level of protection from myself.

How can I defeat this? Many thanks.

Rick A.
Pleasanton CA

Answers

All replies

Have you run Explorer with elevated rights? If this does not help, then start Explorer in Scheduled Tasks with SYSTEM account.

The 2 «Program Files» folders have super-duper protections on them. Unfortunately in Windows8 I don’t think there is a way to remove it because it is tied in to UAC and you can’t turn off UAC any more.

The workaround is that while you cannot directly save to the «Program Files» folders (for example, from notepad) you can copy files into it. So to change a ini file or something like that you have to:

1. load the file
2. edit it
3. save it to desktop or «My Documents»
4. move it from its location to the Program Files area
5. Answer the UAC prompt that yes, you really do know what you are doing and yes, you really do actually want to do it

This is why I created a «c:\MyPrograms» folder and install everything into it

Many thanks, Mark.

I do not need to save to the Program Files folders; I just need to copy files there. The UAC prompt is only annoying, but once I get past it, I am faced with Access Denied errors.

I wish I had thought of creating my own Programs folder. who knew?? I absolutely positively must be able to have write access to the Program Files folders. If I cannot resolve this, I will most certainly be retreating to Windows 7. Any thoughts and advice would be appreciated.

Please check the following two areas.

1. Go to Computer Management, expand Users in the left pane, double click the current user, ensure it is only a member of Administrators group. Remove other groups such as users.
2. Go to C drive, right click Program Files, on Security tab click Advanced, check if Administrators has full control.

Niki Han
TechNet Community Support

Niki, I have confirmed that I am a member of only the Admin group. As for that Advanced tab off of Security, curiously, I am listed there twice. Here is a screen image — can you shed any light.

My permissions look exactly like that. The key is that «Administrators» have full control.

If it is a one-time thing, you can log in as the actual administrator account, I believe it can read/write to the folder without any UAC restrictions. Go to ComputerManagement (right-click in lower left corner) and select the local user account Administrator and enable it. Then you should be able to log in as it if you need to

But, this is such a stupid thing that MS did. Hope they fix it.

I know this is an old thread, but can’t believe no one actually solved your problem the right way.

First: you should not use an administrator user for day to day tasks. it puts your system at risk which is why the default admin account is disabled. simple elevate your user permissions only where necessary. ( such as allowing write access to program files, vice adding to admin group)

second: windows permissions work in a combined manner. and more importantly, deny permissions will always trump allow permissions. Your ‘user’ membership is trumping your ‘admin’ membership.

in your screenshot you noticed your self that you are listed multiple times, (with multiple permission sets). one listing says you only have read & execute, that permission set also means you are denied write access. Even though you have another permission set that marks you as an administrator, the lower permission set is trumping it. It is a security feature and a good one. simply removed your other permission sets, and leave only one, either your specific user which is granted full control, OR just leave the administrators account which has full control (since you are a member of that group).

I know it seems like a pain, but it is really to make your system more secure.

Net Admin EWTGPAC

I appreciate your chiming in on this, Nick. I tried to follow your instructions, but I do not know how to remove the permission sets. The Remove command is not available for the user membership (or any of the others, for that matter). I tried logging in as Admin to see if that made a difference; it did not.

Can you tell me how I would remove a permission set?

Nick — good catch! though I am not sure it is accurate for Win8. My account is a member of «Administrators» and «HomeUsers» and is not a member of «Users,» yet I have the same issue and am also unable to make any changes to permissions of the Program Files folders. Unless «Users» at the file permission level refers to the category of «any user on the computer» rather than the specific local group «Users.»

Update: «Authenticated Users» is a member of «Users» which should mean that it is the category rather than the specifics. Poorly done, if I am a member of a group, either explicitly or implicitly then it should say so.

Rick — if you click the «change permissions» button, normally you should get the ability to make changes. However in this case you can’t so you still need to log in as «administrator» before you make the change.

Note that I wouldn’t remove the «allow users (Rick-Desktop\Users) read/execute» line, instead, add the «modify» permission to that groups permissions. The reason is that any other user account that is not a member of Administrators will start failing in strange bizarre ways since they will have no access at all to the program file folder

RickAltman — I don’t think there is a good solution to this. Microsoft has invested considerable energy into preventing you from doing what you want to do — They believe for security purposes nobody should write/edit in the program files folder.

If you want to edit text/ini files, right-click on the notepad executable and select «run as administrator» that should give you the ability to directly load/save to the area. For other uses, I suspect you would have to delete the permissions directly in the program files folder — and make sure you have a good backup because in all probability it will destroy functionality somewhere.

I think the ultimate answer is — you can’t. Which is why I made a new folder called «c:\Programs» and installed all of my apps in there instead of «program files.» It is less secure but at least I can do what I want to do.

While I understand MS’s position, they are unrealistic, and seems to be going the way of iOS by hiding the ability to do simple things.

For example, I have plugins I use for Adobe After Effects, and the simply need to be copied into the correct subfolders in the «program files» folder. Not allowing me to do so is absolutely Mac-ish and unacceptable.

The workaround, which is stupid too, is to set permissions correctly (which I have), and then copy the files to my desktop and THEN to the location inside the «program files» folder.

While I understand MS’s position, they are unrealistic, and seems to be going the way of iOS by hiding the ability to do simple things.

For example, I have plugins I use for Adobe After Effects, and the simply need to be copied into the correct subfolders in the «program files» folder. Not allowing me to do so is absolutely Mac-ish and unacceptable.

The workaround, which is stupid too, is to set permissions correctly (which I have), and then copy the files to my desktop and THEN to the location inside the «program files» folder.

Thanks for this much easier fix. It is stupid that this has to be done. But it worked perfectly

While I understand MS’s position, they are unrealistic, and seems to be going the way of iOS by hiding the ability to do simple things.

I can understand the need to set up an operating system for the masses (who don’t understand computing concepts very well) so that it’s more «idiot proof». The problem is that people who don’t fully understand what they’re doing tinker around and destroy their ability to run Windows. Or malware does it for them.

And I don’t think anyone ever said that the file system security setup — originally developed by Digital Equipment Corporation — is simple or easy to deal with. I got training in it at a 1980 DEC conference that has proven oh so valuable in dealing with permissions issues over the decades. It’s funny the little things that prove useful in life.

With suitable knowledge and reconfiguration (and even the application of 3rd party programs) the system CAN be made to be much more powerful FOR the (knowledgeable) user and less protected FROM the (knowledgeable) user. This suits power-users.

Some things said in this thread that are not accurate or are incompletely stated:

. you can’t turn off UAC any more.

Well, you CAN — through a registry modification — though because of Microsoft’s decision to arbitrarily limit functionality this completely shuts out the possibility to run Metro/Modern apps. For those who only need desktop functionality this isn’t a bad thing.

. you should not use an administrator user for day to day tasks. it puts your system at risk..

This is overgeneralized. In terms of advice for everyday non-technical users, this may be reasonable, but there are cases where computer-knowledgeable people really do need to be able to do that to get all the productivity they can. There are ways to insulate oneself from malware that are FAR better than inviting it into your system (IE runs ActiveX from the Internet Zone by default) then trying to block it at the last possible second. Most people consider UAC prompts nothing more than irritating and just click through them as quickly as possible. If avoiding malware is something you’d like to do, even if you’d prefer to continue to run with UAC enabled, I suggest taking the following three measures: Get the hosts file from mvps.org, reconfigure Internet Explorer so as to not allow ActiveX to run from the Internet zone, and replace the out-of-box antivirus protection Microsoft provides with something better (e.g., Avast!).

Detailed how-to in my eBooks:

Folks, let me turn this discussion around a bit. I am sure you can fool your own machine into whatever state you need it to, but what do i do with my customers’ machine(s) when i install my software on it? My program needs to record users’ preferences. THey get written to an XML file. The XML file is created in the same directory where the exe is — and by default, it would be the Program Files folder — at which point, my code blows up. So, my bigger question is: what/where is the simplest way to save user’s preferences via a file if the Program Files\MyAppName directory is protected?

Software installers are generally expected to set the permissions on all the folders, registry keys, etc. that they will need their application to be able to access. This is why protections get escalated to Administrator level (and thus a UAC prompt is issued) when those installers run.

There are ways — including as Bob mentions above, using the ProgramData folder — for installing software without need for an escalation. If you use exclusively the folders you’re allowed (and encouraged) to write into to store program data, the installer manifest won’t need to specify the need for escalation.

This list shows the «known folders» in Windows. For user-specific data, consider using the CSIDL_APPDATA location.

Detailed how-to in my eBooks:

There’s no real problem about writing to a file anywhere on your system if you have been granted permissions to do so. I don’t know the Debugging Tools for Windows, but it may make sense to keep a .ini file in a single central location — for example if the tools are such that there can’t be different preferences per user, that sort of thing.

Microsoft has taken it upon themselves to deem writing to some parts of it «undesirable», in an effort to help settle down problems people and malware cause — thus UAC was born, such as it is. That doesn’t keep a different part of Microsoft from not following that guideline.

Detailed how-to in my eBooks:

I too have an app that needs to write to a program files folder, in my instance I need to copy a DLL from a 3rd party vendor, that is integral to my apps functionality. I currently have the DLL sitting elsewhere on the computer awaiting a solution for my Windows 8 users. I have zero input where the DLL must to be located. Installation worked fine for all versions up to Windows 8.

A problem is that the users are scattered anywhere in the world, with many as self proclaimed computer illiterates. I’ll never get to meet them or have hands on with their computer, so I need a programmed solution, with no manual tinkering around their computers.

With your experience, do you know a programmed solution (VB or VBA) that will.
1. take ownership of the required program files folder and
2. copy my DLL to the folder

With my current attempt, my code fires but the file does not copy (FileSystemObject.CopyFile) to the folder.

Many thanks
Russ (MSCD)

But, this is such a stupid thing that MS did. Hope they fix it.

UAC is a poor implementation of a questionable idea. Call me opinionated, but I consider this a simple truth.

Inviting malware into your system then trying to block it with permissions at the last instant from changing the files it wants is not a reasonable approach.

Because users typically just mechanically «click through» to grant permission to whatever pops up. They don’t want to be bothered, because the computer should protect itself and they want to keep doing whatever it is they’re doing, not talk something over with the OS. Boom, after that the malware is in. What did UAC do? Annoy, but not protect.

Far, FAR better than using UAC is blocking parasite web sites with the MVPS hosts file, not allowing ActiveX to run from just any old web site on the wild internet, and back these things with a good anti-malware solution as a safety net. But perhaps paramount to all this is to just practice responsible, intelligent computing practices. If you’re doing things right you DON’T need UAC and you’ll never see a notification from the anti-malware software having to block something bad. If I weren’t living this dream myself I wouldn’t say it. I’ve installed each of XP x64, Vista x64, Windows 7 x64, and now Windows 8.1 x64 EXACTLY ONCE. Never had an infection, never had a UAC prompt — because I turn that useless annoyance off.

Detailed how-to in my eBooks:

What works for me is to run Windows Explorer as Administrator (right-click and select «run as administrator»).

Then everything you do as far as working with any files is «normal» then.

What works for ANYONE is to set the permissions of the files/folders you want to be able to access so as to ALLOW you the access you need.

Running Explorer «As Administrator» is just a workaround to the ridiculous UAC «feature». Do that once, use Properties to set up your file/folder permissions (i.e. grant full control to your username), and you will not have to do it again.

I am having a similar problem with the C:\ folder. I am simply trying to edit a text file there, which I have edited recently, along with other files (though there was an update recently?).

Changing permissions does not help, partly because when they are being changed, messages appear to say that access to given folders/files is denied. I get this even when logged into the hidden admin account.

If I go to Computer Management, I cannot see the Users and Local Groups section.

Control Panel — Admin Tools — no Local Security Policy option visible.

With UAC turned on, the root folder C:\ is basically off limits for users writing files there, it’s way too easy for malware to mess with your boot files that way. You’ll have to copy or move the file somewhere else to edit it.

You can’t copy files to the root of C without providing the admin password. If you are a User with Administrator privileges, you are never prompted to give the password and then it fails.

If you are a standard user, you can move a file to the root of C because it asks you for an Administrator password to do so.

The workaround I use is the following and it works every time:

1) Start command prompt with admin rights. (Search for «cmd» —> right click «Command Prompt» —> «Run as administrator. Or just right click the start button and select «Command Prompt (Admin)».

2) Type: cd «address»

Where address is the location of the file you want to copy. e.g. if the location is the desktop, then type: cd «Desktop»

2) Type: copy «filename.extension» «new_address»

Where filename.extension is the name of the file you want to copy along with its extension and new_address is the location where you want to copy the file. e.g. if the filename is «test» with an «.exe» extension and Program Files is the location where you want to copy the file, then type: copy «test.exe» «C:\Program Files»

This thread was an excellent educational lesson for me! Not only is my understanding of UAC’s and related Permission settings deepened but I was also able to lift out a Read-Only file from a directory within the Win 7 Program Files (x86) folder, edit it and then place it right back inside the originating folder. Best of all, doing so didn’t harm the program whose file was edited.

Chances are that I won’t remember all the information contained in this valuable thread as until today, I had never needed to edit any file within the protected (x86) folder. But, I’ve bookmarked the topic as it contains very good information about UAC’s and File Permission settings.

Many thanks to everyone who contributed in this thread!

Best is to store file somewhere else like under user profile or you could update the registry to allow access:

set EnableLUA to 1

Make sure you have turn of ur UAC settings to Do not notify. Then just restart your PC.

This is NOT recommended because it provides modify access to your local C drive.

Actually, windows NTFS permissions combine to the least restrictive level of permissions, not the the most restrictive. If you are a member of a group with write permissions and another group with read permissions and your account is given Full Control, you have effectively full control. Unless your account or a group you are a member is explicitly denied a right (by clicking the Deny tick box) — Deny trumps everything.

So this condition has been present since Windows 8 I see. Wow, so many responses to find a work around too!

I updated my PC to Windows 10 last year and also experienced the blocking effects of UAC on the Program Files folder(s) as well as the Windows and User folders. After years of using Windows 7 the change to the OS was/are drastic, but thankfully the same steps used to take ownership of my own files still apply. Secure or not it is a big inconvenience to have a program error out and crash simply because Trusted Installer has all the power any my puny «User» account has been left homeless on the street so to speak.

Apparently there really isn’t a need to post a solution to this thread but I seen the conversation and thought I would add an additional way to take your Program Files folder back. All without having to elevate this and that or log into the hidden account. It’s the same old song and dance really. Take ownership of the entire directory structure at the root and make your currently signed in «User Name» the account with all the permissions. This may not be the best course of action on a multi-user system, with many accounts available to sign in with. However, on a single user system it’s the only way I know to make those folder areas work as they did in Windows 7 and earlier versions of Windows.

The way I went about doing this is to first open File Explorer and navigate to the Boot Drive, usually Local Disk C:, unless you renamed the drive.

I’ll use an imaginary folder called «Data» as the reference name to refer to the folder we’ll be working with. Of course you’ll need to replace Data with your folder of choice.

Next right click Data and select properties. You can do this on a per folder basis if taking over the whole Program Files directory is to scary for you.

You’ll see the Advanced button at the bottom of the properties dialog box, click that. This will open the Advanced Security Settings for «Data». Low and behold there’s lots of items listed. We won’t bother those, that’s how things get messed up. We’re here to change owners of this folder, so click the blue link marked «Change»

Now an additional window appears, this is the user group entry form. In the object name box type your User Name, in my case it was Britton. Then hit «Check Names», if that account exist the OS will update the name accordingly with something like Britton (Gigabyte/Britton), for example.

Hit Ok and that windows goes away and you’re back at the advanced settings windows, you should check on the box «Replace owner on subcontainers and contents» if that option appears. Then click Ok and then click Ok again on the original properties box. You will get a nag screen as well asking are you sure, etc. Of course you are.

Then immediately right click and select properties on «Data» again. You have to close and reopen the properties so that the ownership change takes effect. We’ll be going back in there to set the permission access levels this time, for your «User Name» group. This part is simple, on the properties page hit edit and a similar window appears on top of the other one. It looks the same for the most part but now that your the owner of «Data» you can check the boxes off. I simply selected my name from the list and checked on the Full Control in the Permissions area at the bottom. Hit apply and then ok when the system is done applying the properties to all the files within the «Data» folder.

That’s it, you’re now the proud owner of your data again. Repeat this process for any folder that causes you headaches down the road.

Now as for the duplicate entries in the permsision groups, I am not sure. I seen that to and was like WTH is all that for. I didn’t want to risk denying Windows itself access to program or system data so I just left the list of duplicate entries in the ownership folder alone, would hate to have a non booting system because I inadvertently removed read/write actions from SYSTEM or the TrustedInstaller groups.