Let’s discuss this issue here:
https://notepad-plus-plus.org/community/topic/16982/need-suggestions-for-plugins-plugin-list-home

BUT Microsoft has also issued the policy that files with executable code have to be stored under %ProgramFiles% because this location offers some sort of protection against malware attacks. Thus neither %LocalAppData% nor %ProgramData% is the right place for storing plugin DLL files.
…
How about declining the requests for a Notepad++ UWP app variant because of security concerns and because the whole concept of UWP apps is crap?

Let’s discuss this issue here:
https://notepad-plus-plus.org/community/topic/16982/need-suggestions-for-plugins-plugin-list-home

Just one consideration:
In managed environments, where what is installed or not is determined by company policies and by the administrator, users should in no circumstance be allowed to be able to install whatever piece of software, and that includes plugins.
So, the new install MUST provide a way for the system administrator to install everything as in version 7.5.9 and previous, with the plugins located at %ProgramFiles\Notepad++\plugins, so that no user can install plugins - they should be limited to what the administrator gives them.
If you want to provide support for multi-user - and that’s ok - then you should give the administrator the possibility to decide if users are allowed or not to install plugins.

So, is it correct that the current configuration is final (in general), and possibility to install plugins for non-admin users will not comeback (in nearest versions)?

i don’t know for sure, as i’m only a regular user, but at the moment this seems to stay for the near future.

And, even if we grant full access for users on “c:\ProgramData\Notepad++\plugins” UAC message will arise anyway?

yes, uac would still be triggered if you try to install/uninstall any plugins with plugins manager.

there is however a workaround, where instead of using plugins admin, the user can put the desired plugins to %ProgramData%\Notepad++\plugins manually, if you allow this.

you could also create a set of self extracting zips, one for each plugin, that extracts them automatically and directly to the plugins folder of a user for an easier deployment, and if you want you could distribute the sfx’s to your users for self installation.

So, is it correct that the current configuration is final (in general), and possibility to install plugins for non-admin users will not comeback (in nearest versions)?

And, even if we grant full access for users on “c:\ProgramData\Notepad++\plugins” UAC message will arise anyway?

you could take it with a bit of humour and tell the customers:

it is called “plugins admin” sir, and not “plugins user”, so please don’t press it unless you are an admin.
we hope you enjoyed our help and wish you a nice and pleasant day.

😉

now seriously:
sorry for the inconvenience.
as far as i can tell, most of the companies wanted this security restriction and more.
while a tighter security makes sense to me, i can also understand that people at help desks or i.t. support will have more work to do, if notepad++ is deployed to default users.

Allow me, @meta-chuh, to add, to your explanation, that, since the 7.6 version of N++, for a manual installation of a plugin, let’s say MyAwesomePlugin.dll, we must :

• First, create a MyAwesomePlugin sub-folder, inside the $InstallDir\plugins directory

• Place the MyAwesomePlugin.dll library, as well as all the plugin structure, in the sub-folder $InstallDir\plugins\MyAwesomePlugin

However, as I said, in the post, below, new plugins’s organization, in the plugins folder, may prevent some plugins for being totally functional :-((

https://notepad-plus-plus.org/community/topic/16823/open-file-from-file-explorer-plugin-within-notepad/7

Best regards

guy038

i use the portable version for that reason, maybe it is something you are willing to try.
if you do so, everything will be eg. within e:\MyData\npp and not divided to 3 places.

an alternative to the portable version is to install the full notepad++ package to C:\Applications\Notepad++ and select “Do not use %APPDATA%” as installer option.
(important, it must not be installed inside %PROGRAMFILES% or %PROGRAMFILES(X86)% due to restricted permissions to these folders)

best thing about both these variants are that, in addidion of making your backups easier, you can copy this notepad++ folder to any other machine with any other windows version and it will run straight away.

it is a headache to reach there to put a new script file or to bring an existing script to edit in npp itself.

I propose you give an .ini entry in which user can decide the folder where the plugins will be used from, say
PluginUserPath=e:\MyData\npp\plugins

also give a ProgramData path for similar use, say
PluginProgramDataPath=e:\MyData\npp\prgdata

may be you can give not just User plugins folder, but also entire User folder, say
UserPath=e:\MyData\npp\user

you can study firefox and thunderbird, how we can just define the location of our data (profile) and they do everything from our moved profile folder location.

then we can keep our plugins and relevant files at these locations and it will be easier for us to reach them and to back them up, and also to use the same setting from multiple os (I use same thing in 210 and w8.1)

Thanks.

you can install plugins directly by using plugins > plugins admin from the top menu of notepad++

In an secure enterprise environment User should never be allowed to change or install plugins.
In an secure enterprise environment User should never be allowed to do updates on the software itself.
In an secure environment no code will ever be executed stored in an Userprofile!
In an multiuser terminalserver environment most parts of profile will be deleted after logoff to prevent long logontimes or exploding roaming profile shares. So using Appdate to install software is a no go.
You need an easy way to make a central configuration for the software and distribute it over thousands of machines or an multiuser machines like terminalservers. Even little changes need to be distributed without destryoing the other user configurations.
In an secure environment no code will ever be executed stored in an Userprofile!
Administrators need an easy way to distribute plugins to all his machines. No way to do this per user!!! Computers are owned by company and admin. Users should use them as is and shut up.
Most discussion here are only around home and hobby users. But i need the central total control one click for 100.00 Users all the same without any error solution.

@donho said:

@ldlx said:

will the Notepad++ installer change the NTFS right so that only users with administrator priviligues are allowed to install plugins/updates?

Yes, you are right about it. The right to add files of this folder should be Admin only, and this feature will be in the next release.

@ldlx The right of %PROGRAMDATA%\Notepad++\plugins\ has been modified by installer here:
https://notepad-plus-plus.org/temp/npp.7.6.1.Installer.exe

Could you test it and confirm me it’s what you expected?

Just tried (Win10 1809x64)… didn’t work. Inheritance is still active.

I had to run
icacls “c:\ProgramData\Notepad++\plugins” /inheritance:d
to disable inheritance (with copying the ACL, /r to remove inherited ACLs)
-> running icacls as part of the installer should not be the favoured approach imho.

Wouldn’t it be possible to store plugins in another folder inside %programfiles%, e. g. “%programfiles%\Notepad++ Plugins”, or “%commonprogramfiles%\Notepad++” ?

@ldlx said:

will the Notepad++ installer change the NTFS right so that only users with administrator priviligues are allowed to install plugins/updates?

Yes, you are right about it. The right to add files of this folder should be Admin only, and this feature will be in the next release.

@ldlx The right of %PROGRAMDATA%\Notepad++\plugins\ has been modified by installer here:
https://notepad-plus-plus.org/temp/npp.7.6.1.Installer.exe

Could you test it and confirm me it’s what you expected?

Only in case you aren’t aware of that - I’m not involved in development of Notepad++, I’m a volunteer that tries to help people coming to this forum.

In the following I will give you a workaround which takes some effort but it is a scriptable solution. @donho , the developer of Notepad++, decided to simplify the way plugins are loaded. The hybrid installation scenario you used in the past isn’t supported anymore. Nevertheless you are right to demand this feature.

You could create a directory for unpacking the portable version’s ZIP file, e.g. C:\Apps\Notepad++. Set ownership of this directory to the Administrators users group. Configure its ACL to prohibit write access by normal users. Add the files needed to get Plugin Admin. Remove access rights inheritance of the directory C:\Apps\Notepad++\plugins and configure access rights in a way that normal users can write to it and its subfolders.

Updating Notepad++ means to unzip the latest version’s ZIP package to C:\Apps\Notepad++. It should be possible to automate that as well.

Yes we prefer to install the application once on every computer by our sw managing tool (silent in the background). With this approach, we have always the same version installed on all computers and make updates of the application as needed e.g. if there are security updates available.

The users e.g. students should be able to install the plugins they need. This is unfortunately not possible anymore.

@Shamu35-NPP

Well, if the switch to the new plugin hosting model and Plugin Admin would be complete, I would say you can use portable versions of Notepad++ for your students. But unfortunately currently there is the limitation that there is no Plugin Admin in portable versions.

But there is still a possible solution, have a look at this posting and the following ones. But this implies some oddities you will recognize by yourself.

Maybe it isn’t possible or managable that there’s a copy of Notepad++ in every user profile on a number of different computers. Maybe running executables in unsafe locations (everything except %programfiles% or %systemroot%) is forbidden.