MsiLockPermissionsEx table

MsiLockPermissionsEx Table in Windows 7 enhances the functionality over LockPermissions Table. With MsiLockPermissionsEx table, users now have the ability to set access permissions on objects impacted by the application install that previously required using custom actions or other methods outside of Windows Installer


Expanding the set of permissions that can be applied to a resource by incorporating the Security Descriptor Definition Language(SDDL) in Windows Installer. This allows the security settings for an object to be more flexible, including;


o Ability to apply Deny ACLs to objects
o Indicate inheritance properties for permissions
o Expand the set of well-known SIDs
o Ability to set Owner, Group, and SACLs to the objects in addition to the regular access permissions


Security settings can be applied to services as well in addition to Files, Folders, Registry keys


Ability to apply permissions specific to user accounts – including accounts that are newly created on the system during the course of installation
Read more about this in Windows installer team blog