Empirum Advanced Agent - Controlling the Visibility of Software Packages in the Kiosk
Table of Contents
1.1 Control via NTFS Rights on the Package Level
Please disable this option if you do NOT want to control package visibility via NTFS rights!
If no user is logged in, assigned and activated software packages are always installed!
To control software package visibility in the kiosk via NTFS permissions, the "UseExecuteRight" option in the depot properties must be enabled accordingly.
In this case, the Advanced Agent will check the NTFS permission (read/execute) for the respective check file (Setup.inf) of a package within the context of the logged-in user, if the "Check rights" option in the Misc tab of the Register Properties is also enabled (checkmarked).
The following combinations are possible through the combination of the global "UseExecuteRight" property and the "Check rights" register property:
| "UseExecuteRight" option | "Check rights" option | Will rights for packages below the tab be checked? |
|---|---|---|
| Enabled | Enabled | Yes |
| Enabled | Disabled | No |
| Disabled | Enabled | No |
| Disabled | Disabled | No |
- All group memberships for the logged-in user will be determined locally.
You can use the DebugView-Log or the "Whoami /Groups" command to perform a check.
DebugView keyword:
FileAccessChecker.cpp(684):INFO File access checker ------------- Token Trace --------------------
- NTFS permissions (DACL) for the check file (Setup.inf) will be determined remotely for all software packages.
To do so, the Advanced Agent user must have read permissions (read/execute) for the Configurator$ directory, including all subdirectories.
DebugView keyword:
FileAccessChecker.cpp(478):INFO File access checker ------------- Trace security descriptor ----------
- Now, a comparison is performed to determine whether the logged-in user has permission to read the respective check file (Setup.inf).
- If the user has the read permission, the respective package is displayed in the software kiosk.
- If the user has no read permission, the respective package is not displayed in the software kiosk accordingly.
Certain user groups (SID) are filtered out from this comparison, since they are identical on the client and the server, but have different meanings (a user who is the local administrator on a client is not the local administrator on a server, despite identical SIDs!).
This is relevant for all BUILTIN\SIDs and all NT AUTHORITY\SIDs,
e.g.,:
- BUILTIN\Administrators
- NT AUTHORITY\Authenticated Users
DebugView keyword for success:
ComJobSmb.cpp(423):INFO Job Smb Permissions GRANTED for user User1, domain XENDESKTOP, on file \\XEMP14\Configurator$\Packages\WinZip Computing\WinZip ENU\9.0\Install\Setup.inf
DebugView keyword for failure:
ComJobSmb.cpp(423):INFO Job Smb Permissions DENIED for user User1, domain XENDESKTOP, on file \\XEMP14\Configurator$\Packages\WinZip Computing\WinZip ENU\9.0\Install\Setup.inf
1.2 Control via Group Memberships on the Tab Level
Visibility of software packages can also be restricted granting permissions via group memberships on the tab level.
Checks are always performed locally on the respective client.
If the logged-in user is a member of one of the specified groups, all software packages below this tab are displayed in the software kiosk.
This control is not dependent on the "UseExecuteRight" option!