File permissions across user profiles

Question

I am using ClickOnce deployment for a Windows Forms application and I need configuration information on a machine basis that persists across deployments and across user profiles. As such, per user configuration does not help. I would also like the configuration file to be easily accessible with a text editor in a well known location on each machine (well known, that is, by the organization).

The problem I have is that ClickOnce overwrites the app.config on each deployment. I am aware of the configsource attribute, but from what I understand, the target file has to be in the path of the application - that means that I can't control the location effectively.

So I created a class for the data I want to persist and am serializing / deserializing it to and from the location I want. This all works well, except that if the file doesn't exist I am creating it (using XmlSerializer and a TextWriter). The problem here is that the user that is running the app when it is created becomes the only user that can access it. Subsequent users do not have permission unless I grant permission to a broader AD group manually. Even this is fine except for the fact that I don't want to touch each computer the first time it is installed.

So is there a good way to programatically set permissions when the file is created or should I re-think my design because I have missed something about the built in configuration features?

EDIT: Looked in to Application.CommonAppDataPath, but it maintains a folder for each version of the application which means that each new deployment is starting over.

Answer 1

Based on this SO post I did this:

FileSecurity fileSecurity = File.GetAccessControl(file);
fileSecurity.AddAccessRule(new FileSystemAccessRule("Users", 
                                             FileSystemRights.FullControl, 
                                             AccessControlType.Allow));
File.SetAccessControl(file, fileSecurity);

Answer 2

IIRC, You can reference the All Users Application Data folder in click once apps.

What you do is distribute your default configuration to the normal application data folder for each app, but never read config information from that file. Instead, on app startup you look in your All users application data folder for the config file, and if you don't find it copy the default file there. Then read in your config from that location.