Examkin

Question

Difficulty: HardApplication Installation and Configuration Concepts

A desktop technician is deploying a legacy line-of-business application on a shared Windows 11 workstation used by multiple domain users. During installation, the core application files are written to %PROGRAMFILES%, and shared runtime configuration files are placed in %PROGRAMDATA%. When standard domain users launch the application, it crashes immediately with a permission denied error when attempting to modify its runtime configuration file. Which of the following is the MOST secure configuration change that resolves the issue while following the principle of least privilege?

  1. Grant the local Users group Modify permissions specifically on the application's subfolder within %PROGRAMDATA%.Answer
  2. B
    Add all standard domain users to the local Administrators group on the workstation.
  3. C
    Reinstall the application executable using the /qn command-line switch to automate UAC permission elevation.
  4. D
    Upgrade the workstation operating system to Windows 11 Enterprise to enable automatic shared application file access.

Answer

Grant the local Users group Modify permissions specifically on the application's subfolder within %PROGRAMDATA%.
By default, Windows restricts standard users from modifying files within %PROGRAMDATA%. When an application requires multi-user write access to shared configuration files stored in %PROGRAMDATA%, the system administrator should grant Modify permissions on that application's specific folder to the local Users group. This allows the application to function correctly for all users while upholding the principle of least privilege.

Step-by-Step Solution

1
Analyze the location of the failing file.
Identified that the application attempts to write runtime configuration data to %PROGRAMDATA%, which by default restricts Write/Modify permissions for standard users.
Standard users have Read/Execute permissions in %PROGRAMDATA% by default, causing legacy or improperly designed applications requiring runtime updates to crash.
2
Evaluate security restrictions and least privilege requirements.
Rule out solutions that grant broad administrative access or change OS editions unnecessarily.
Least privilege dictates granting only the minimal permissions necessary for the specific resource.
3
Apply targeted Folder ACL modification.
Grant Modify permissions to standard users exclusively on the specific application folder inside %PROGRAMDATA%.
This resolves the runtime file write error while restricting user access outside the designated application folder.

Key Concept

Application installation scope, NTFS permissions, and %PROGRAMDATA% storage requirements
Rate this question

Topics

Application Installation and Configuration Concepts

More questions from this topic