puppetlabs/puppet_for_the_win — pull request #50 by joshcooper (2013-08-13 00:00:49+00:00)
Title: (#22064) Lock down facts.d folder without resorting to custom actions

Previously, we were using a WiX custom action to translate well-known
security IDs, e.g. WIX_ACCOUNT_ADMINISTRATORS, to localized names,
e.g. Administrators, since that is what the MSI LockPermissions table
expects[1]. However, this was causing Windows installer to create
access control entries to a non-existent user (S-1-5-32) on the
facts.d directory, preventing interactive puppet runs from
working.

This commit changes the wix file to use the common user names
"Everyone" and "Administrators" which according to the docs, "are
mapped to well-known SIDs."

Also, we no longer explicitly grant LocalSystem full control, because
"LocalSystem is given full control in all security descriptors created
through the LockPermissions Table."

[1] http://msdn.microsoft.com/en-us/library/windows/desktop/aa369774(v=vs.85).aspx