windows 尝试从 C:\ProgramData 访问文件时出现“拒绝访问”

Getting 'Access Denied' when trying to access file from C:\ProgramData

提问by Ashish Pancholi

Our clients are frequently reporting issue that they are getting "Access Denied" exception when they used to run application that has been installed with downloaded setup file. Our installer, installs executable on 'Program Files' and creates configuration files at C:\ProgramData. Once installation is done, our application automatically run first time. Whenever user going to run it next time, it throws Access is deniedas program can not able to access configuration files at C:\ProgramData.

我们的客户经常报告他们在运行已通过下载的安装文件安装的应用程序时遇到“拒绝访问”异常的问题。我们的安装程序在“Program Files”上安装可执行文件并在 C:\ProgramData 创建配置文件。安装完成后，我们的应用程序第一次自动运行。每当用户下次要运行它时，它都会抛出访问被拒绝，因为程序无法访问 C:\ProgramData 中的配置文件。

Yes.. "Run as Administrator" is the solution but we can not ask our all paid users to do such. I have searched option at can set privileges by some alternative way then manually run executable as "Run as Administrator".

是的..“以管理员身份运行”是解决方案，但我们不能要求所有付费用户都这样做。我搜索了可以通过某种替代方式设置权限的选项，然后以“以管理员身份运行”手动运行可执行文件。

I have found that help pagebut that's not working for me. My application is java desktop application so I have created .exe.manifest file and put that manifest file into executable where images and other product's properties files resides.

我找到了帮助页面，但这对我不起作用。我的应用程序是 Java 桌面应用程序，因此我创建了 .exe.manifest 文件并将该清单文件放入图像和其他产品属性文件所在的可执行文件中。

Manifest does not work for me and I am still getting "Access Denied" issue.

清单对我不起作用，我仍然遇到“拒绝访问”问题。

This is content of manifest file -

这是清单文件的内容 -

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> 
  <assemblyIdentity version="1.0.0.0"
     processorArchitecture="X86"
     name="<product_name>"
     type="win32"/> 
  <description>Description of your application</description> 
  <!-- Identify the application security requirements. -->
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel
          level="requireAdministrator"
          uiAccess="true"/>
        </requestedPrivileges>
       </security>
  </trustInfo>
</assembly>

How I can attach the application manifest to the executable as I have only copied that manifest where images and other product's properties files resides ?

我如何将应用程序清单附加到可执行文件，因为我只复制了图像和其他产品属性文件所在的清单？

Is there any thing need to update in manifest file as I have copied as-is content except ?

是否有任何需要在清单文件中更新的内容，因为我已按原样复制了内容，除了？

Exception --

例外 -

java.io.FileNotFoundException: C:\ProgramData\.<poduct_name>\config\<Product_Name>.xml (Access is denied) stacktrace javax.xml.transform.TransformerException: java.io.FileNotFoundException: C:\ProgramData\.<Product_Name>\config\<Product_Name>.xml (Access is denied) at com.sun.org.apache.xalan.internal.xsltc.trax.TransformerImpl.getOutputHandler(Unknown Source) at com.sun.org.apache.xalan.internal.xsltc.trax.TransformerImpl.transform(Unknown Source) at com.<Product_Name>.main.dr.a(Unknown Source) at com.<Product_Name>.main.dr.a(Unknown Source) at com.<Product_Name>.main.dr.a(Unknown Source) at com.<Product_Name>.main.h.k(Unknown Source) at com.<Product_Name>.main.ay.run(Unknown Source) Caused by: java.io.FileNotFoundException: C:\ProgramData\.<Product_Name>\config\<Product_Name>.xml (Access is denied) at java.io.FileOutputStream.open(Native Method) at java.io.FileOutputStream. (Unknown Source) at java.io.FileOutputStream. (Unknown Source) ... 7 more --------- java.io.FileNotFoundException: C:\ProgramData\.<Product_Name>\config\<Product_Name>.xml (Access is denied) at java.io.FileOutputStream.open(Native Method) at java.io.FileOutputStream. (Unknown Source) at java.io.FileOutputStream. (Unknown Source) at com.sun.org.apache.xalan.internal.xsltc.trax.TransformerImpl.getOutputHandler(Unknown Source) at com.sun.org.apache.xalan.internal.xsltc.trax.TransformerImpl.transform(Unknown Source) at com.<Product_Name>.main.dr.a(Unknown Source) at com.<Product_Name>.main.dr.a(Unknown Source) at com.<Product_Name>.main.dr.a(Unknown Source) at com.<Product_Name>.main.h.k(Unknown Source) at com.<Product_Name>.main.ay.run(Unknown Source) and the cause isjava.io.FileNotFoundException: C:\ProgramData\.<Product_Name>\config\<Product_Name>.xml (Access is denied)

回答by ewall

The problem is because the user settings file is stored in the wrong place.

问题是因为用户设置文件存储在错误的地方。

Only executable binaries and related resources belong in the ProgramData directory ("C:\Program Files..."), and this data should only change when a user with administrator rights installs or updates a program installation. Any configuration or data that the user needs to change must be kept in places where the user has rights to edit, such as their home folder, "My Documents", their HKEY_CURRENT_USER Registry key, or better yet, their AppData directory.

只有可执行二进制文件和相关资源属于 ProgramData 目录（“C:\Program Files...”），并且只有当具有管理员权限的用户安装或更新程序安装时，这些数据才会发生变化。用户需要更改的任何配置或数据都必须保存在用户有权编辑的地方，例如他们的主文件夹、“我的文档”、他们的 HKEY_CURRENT_USER 注册表项，或者更好的是他们的 AppData 目录。

You can read more about these Windows programming requirements for user data storage here, and here is how some people have done this in Java. Hope that helps get you fixed up!

你可以阅读更多有关这些用户数据存储的Windows编程需求在这里，并在这里是怎么有些人已经在Java中做到了这一点。希望能帮助你解决问题！

On second thought, perhaps using a tool like PROCMON.EXEwould help narrow down the specifics of the denial--because it will show you whether the programming is opening the file/directory for reading, writing-with-all-permissions, trying to create a file that already exists, etc.

再想一想，也许使用像PROCMON.EXE这样的工具可以帮助缩小拒绝的具体范围——因为它会告诉你程序是否正在打开文件/目录进行读取、写入和所有权限，试图创建一个已经存在的文件等。

回答by jveazey

The quickest solution is for you to use the xcacls.exe utilityor the icacls.exe utility. Using them, you can give "Everyone" or whomever the permission to read/write/etc configuration files in C:\ProgramData.

最快的解决方案是使用xcacls.exe 实用程序或icacls.exe 实用程序。使用它们，您可以授予“所有人”或任何人读取/写入/等在 C:\ProgramData 中的配置文件的权限。

• icacls (win2k8) scripting examples
• Xcacls Examples

• icacls (win2k8) 脚本示例
• Xcacls 示例

Note:Make sure to only change the permissions on the files you need to access from your program. ProgramData is a system folder and should not be generally accessible.

注意：确保仅更改您需要从程序访问的文件的权限。ProgramData 是一个系统文件夹，一般不应访问。

Update:Also, you need to embed the manifest into the executable specifically as a RT_MANIFEST resource. This can be easily done with the Manifest Tool (mt.exe). More information on this can be found in this answer.

更新：此外，您需要将清单专门作为 RT_MANIFEST 资源嵌入到可执行文件中。这可以使用清单工具 (mt.exe)轻松完成。可以在此答案中找到有关此的更多信息。

回答by user207421

it throws Access is denied

它抛出访问被拒绝

Does it really?

真的吗？

There is no such exception.

没有这样的例外。

What is the actualexception, and the actualmessage, and what actualline of code is it thrown at?

什么是实际的异常，实际的消息，以及它抛出的实际代码行是什么？