I created a small Windows app, and am building a setup for it using NSIS, but what I can't find out is where to put the executables to conform to the new Windows security model.

Traditionally we put program files in, well, "c:\program files". With the security model getting more mangled with each Windows version, some users have restricted accounts, and I'm not sure installing into program files will work for these users.

Where can I install my program's files that will cater for these lower-privileged users?

Oh and I want to avoid ClickOnce.

  • 4
    wouldn't this be better suited to Stack Overflow? it's a little gray area, but installer packaging is still a development question so i think it belongs there. i'll leave it up to the community; @KeyboardMonkey, flag for mod attention if you'd like us to go ahead and migrate it. Jun 11, 2010 at 8:33
  • 1
    I did consider posting on SO, however the question's not directly programming related, as I'm not asking about scripting or code specifically, but OS-related application/file structure and practices.
    – invert
    Jun 17, 2010 at 8:53

1 Answer 1


If you look into the requirements for "Windows 7 Client Software Logo Program", you will find the answer:

Install to the correct folders by default

Rational: Users should have a consistent and secure experience with the default installation location of files, while maintaining the option to install an application to the location they choose. It is also necessary to store application data in the correct location to allow several people to use the same computer without corrupting or overwriting each other's data and settings.

Criteria: Windows provides specific locations in the file system to store programs and software components, shared application data, and application data specific to a user:

  • Applications should be installed to the Program Files (%ProgramFiles% for native 32-bit and 64-bit applications, and %ProgramFiles(x86)% for 32-bit applications running on x64 respectively) folder by default. User data or application data must never be stored in this location because of the security permissions configured for this folder
  • All application data that must be shared among users on the computer should be stored within ProgramData
  • All application data exclusive to a specific user and not to be shared with other users of the computer must be stored in Users\\AppData
  • Never write directly to the "Windows" directory and or subdirectories. Use the correct methods for installing files, such as fonts or drivers
  • In “per-machine” installations, user data must be written at first run and not during the installation. This is because there is no correct user location to store data at time of installation. Attempts by an application to modify default association behaviors at a machine level after installation will be unsuccessful. Instead, defaults must be claimed on a per-user level, which prevents multiple users from overwriting each other's defaults.
  • Sadly Microsoft recommends the opposite of what I need: where to store binary executables on restricted accounts, where Program files is not accessible. Thanks for the client logo program link though! :)
    – invert
    Jun 17, 2010 at 8:59
  • Lower-priveleged (non-Admin) users can't install applications on Win7 for the most part. They don't have write access to C:\, so they can't have an installer create a new folder there; they don't have write access to %PROGRAMFILES%, so they can't create a folder there either. Administrative accounts are supposed to be used to install applications; it's part of the security instituted with UAC.
    – Ken White
    Feb 4, 2011 at 19:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.