In the good old days it was quite normal to use an external VBScript which ran xacls.exe or something similar, to set permissions on files and registry keys that were included in your msi-file. Setting these permissions using the ‘LockPermissions‘ table was not recommended.
One of the problems facing when you used the LockPermissions table, was that permissions on already existing local files were simply overwritten and were not added/merged with the already existing permissions on these files. Another limitation was that it didn’t natively localized user groups based on well-known SIDs. When you e.g. were setting permissions on the ‘Users’ group and ran the msi on a Russian Win7 system the msi would fail to install, because it didn’t know of a usergroup called ‘Users’. In Russian the group is called ‘Пользователи’. You would receive error message 1609 “An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry.“ There was a way to solve this with a special mergemodule called SIDLookup, but not everyone knew of its existence.
Since Windows Installer 5.0 (included in Windows 7 by default) there is a brand-new table called ‘MsiLockPermissionsEx‘ which can be used to set permissions on files, registry, folders, and services that are installed with your msi-package. You can find the TechNet page explaining all this here:
http://msdn.microsoft.com/en-us/library/windows/desktop/dd408009%28v=vs.85%29.aspx
