Solution: WinXP Restricted users connecting to Oracle

Question

For a while we've been having the problem that with a default install of the Oracle Client (in our case 9.2 - Not sure if the problem exists with earlier versions), restricted users on WinXP (possibly 2K too, I've not been able to test it) cannot connect to any server because they cannot see the oracle client files. For some reason, the oracle client install sets strange permissions that mean only administrators can access the client files. Worse still, any attempt to reset the permissions on the ORACLE_HOME directory and propagate them down all the sub directories always fails with Permission Denied (even for admins?!?!?!). Even attempting to take ownership fails.
Anyway, we've found a solution:
Logged in as an admin, we copied the c:\oracle\Ora92 directory from a fresh install of the oracle client on WinXP to a machine with Fat32 (Win98) - Thereby removing all permissions from the files. We then renamed the old Oracle directory on the WinXP PC, created a new one and copied back the Ora92 directory from the Win98 PC - This resulted in the c:\Oracle directory and all sub directories having default permissions, specifically Read and Execute to all users and Full to admins. We also reset the permission on all sub-directories of c:\program files\oracle to those of c:\program files\oracle ( Using the "Reset permission on all child objects and enable propagation of inheritable permissions" check box in windows advanced security ).
The end result is that restricted users can now access the necessary oracle client files, but don't have permission to alter them (which prevents them changing any connection parameters).
The problem still remains that the installer creates strange permissions on files in the Oracle Home directory, but at least there is a workaround until Oracle sorts out the installer.
Anyone think of a better way to get the same result?

Answer 1

if you set the restricted users into the power users group you may be asking for other troubles as these users will then have update permissions to most files on the system, including those files in the winnt folder.
it is not clear to me whether you are unable to set the file permissions to read/write access, or whether you are able to do so but that after you do so the users still get errors launching the client. it sounds like the solution to your problem may have been setting the read/write access in the \program files\oracle folder.
you should make sure you install oracle when you are logged in as administrator. note that this is different than doing the install while logged in as user "X", where "X" is a member of the administrator group.
if after doing the install as administrator you still have problems, i would recommend that you turn on auditing, reboot the system, launch the client as a restricted user, and then review the event log to see what file(s) are being denied access.
to set up auditing, go to start->programs->administrative tools->local security policy. select local policies, then audit policies. set "audit object access" to failure. then go to my computer, right click on C:, select properties, then the security tab. click on the advanced button, then the auditing tab. select the "everyone" group, then click ok. in the next window, check all boxes in the "failed" column. click ok.
don't forget to reverse the process and turn off auditing once you have found the problem files and set the necessary permissions.