Windows Integrity Level

[djohnst10]

I created a new, empty, WiX project to gradually convert our existing project. When I built the new project, I noticed that there is something different about how the MSI file gets generated.

On the MSI file built from the new project (the new MSI), the file properties' Details pane allows me to edit some of the details like Title, Subject, Categories, Tags, Comments, Authors, and Revision number.

On the MSI file built from the old project (the old MSI), the file properties' Details pane does not allow me to edit any property. I noticed that the Security tab on the old MSI has the UAC shield on the Edit button whereas the new MSI does not. When you click the Advanced button on the old MSI file it shows something I've never seen in Windows before: Integrity Level with a value of High Mandatory Level.

Another effect of this seems to be that when the old MSI is edited in Orca, it is read only despite the file not being read only.

When the old MSI file is copied to another location, the copy no longer has the High Mandatory Level, and it is not treated as read only by Orca.

If the old MSI file is moved to another location it will still have the High Mandatory Level and it will still be treated as read only by Orca.

What is going on?

[barnson]

No repro. On my system (Win10/VS2022), my account is the owner. Are you running VS elevated?

[djohnst10]

@barnson Yes I am.

Our solution is an ASP.NET app that deploys to IIS.

[barnson]

That seems consistent with other project types.

[djohnst10]

I've not seen that behavior (Integrity Level: High Mandatory Level) in any other app binary (DLL or EXE) that is compiled in the same solution as an elevated user with the old and new WiX project.

The part about editable file properties is unique to the MSI built from the new WiX v4.0 project. I'm guessing that it is editable because it is an MSI file.

This isn't a critical issue, but I was wondering what Integrity Level is for and why the MSI from the new WiX v4 project doesn't have it? Maybe the MSI is copied to the output directory from a temporary location?

[barnson]

It is copied from the intermediate folder. Try adding -resetacls to the additional build arguments.