title: Inno Setup and Permissions for non-admins: everyone, users, or authusers?
body: <p>Should I give "modify" permissions to 'everyone' or 'users' or 'authusers' if, under UAC, I want to make data folders and files writable to non-admin users of the program?</p>
  
  <p>I want that basically everyone who can sit at the computer can read/write the data through the program. I've also read that using 'everyone' for modify permission can open a security hole over the network. What is the difference between everyone, users, and authusers? What are the security implications?</p>
  
  <p>Implementation details for InnoSetup follow:</p>
  
  <p>Using InnoSetup, I install an EXE in a standard Program Files subfolder, and a Data subfolder within it, like this:  </p>
  
  <p>C:\Program Files\My Prog\Prog.exe<br>
  C:\Program Files\My Prog\Data\MyData.dat  </p>
  
  <p>Now, to make it so that MyData.dat can be modified by Prog.exe even if Prog.exe is launched by a non-admin users, I give "modify" permissions to the subfolder "Data" with this line:</p>
  
  <pre><code>[Dirs]  
  Name: "{app}\Data"; Permissions: everyone-modify;  
  ;This is the question: should I use users or authusers instead of everyone?  
  
  [Files]  
  Source: "MyProg.exe"; DestDir: "{app}"; Flags: replacesameversion;  
  Source: "MyData.dat"; DestDir: "{app}\Data"; Flags: replacesameversion; 
  </code></pre>
  
  <p>This question is similar to <a href="https://stackoverflow.com/questions/2686918">2686918</a> but I didn't find enough info there about the types of permissions, hence this new one. I'll update that question after clarifying this one.</p>
  
  <p>InnoSetup in particular defines these groups:</p>
  
  <ul>
  <li>admins Built-in Administrators group</li>
  <li>authusers Authenticated Users group</li>
  <li>everyone Everyone group</li>
  <li>powerusers Built-in Power Users group</li>
  <li>system Local SYSTEM user</li>
  <li>users Built-in Users group</li>
  </ul>
  
  <p>Which of those is the nearest to "any user who is sitting at the machine, admin, non-admin, or whatever, but nobody who is accessing the machine from networks"?</p>