How to clear all permissions from a file using NSIS?

Question

I'm building an installer, and I am trying to set a file to be executable only by administrators.

AccessControl::GrantOnFile \
"$INSTDIR/mercheckadmin.exe" "Administrators" "FullAccess"
Pop $0

I'm using that to grant permission, but I'm trying to figure out how to prevent regular users from opening the app. Thanks.

Answer 1

You can use ClearOnFile to give access to just one trustee but you might want to give full access to SYSTEM as well with GrantOnFile "c:\\path\\thefile" (SY) FullAccess after using ClearOnFile .

AccessControl::ClearOnFile "$INSTDIR\mercheckadmin.exe" "(BA)" "FullAccess"
Pop $0

The other alternative is to block access for specific trustees with DenyOnFile ...