Help allowing users to install plugins
-
I’m one of the Intune admins for my company, and I’m trying to determine if there’s a way to allow my users to install plugins. I’ve seen several posts that have pieces of the answer, but I haven’t found one that’s satisfactory (to me) yet.
I’m currently distributing Notepad++ using the exe installer with a /S; this works fine for install, but it turns out users can’t install plugins because they live in Program Files.
It’s my understanding that Program Files should hold the static program files, and ProgramData is where user settings and files (like plugins) should go. Program Files is restricted to admins, but ProgramData can be accessed by users. It appears Notepad++ by default uses Program Files for both (with some things in the users %AppData%). A few posts have mentioned installing Notepad++ to ProgramData instead as a workaround, but I’d rather not put installs in there.
I also am not a fan of portable installations; they’re much more difficult to manage (for both installs and reporting) as a sysadmin than system-wide applications.
Other posts have mentioned a config.model.xml, where the plugin folder could be managed at deployment time, but I haven’t found the setting that moves the plugin folder. It sounds like that config.model.xml can be created by copying a config.xml from a user profile that is set up the way you want, but I can’t find how to set the plugin folder in the Notepad++ settings GUI, either. It’s also not clear if I have to copy that file over (as part of a script), and if so to where (Program Files or AppData), or if by having it in the same folder with the installer makes the installer use it automatically? And it sounds like previous posts are saying that config.model.xml file hasn’t been documented; any chance that’s been rectified?
I’ve tried installing manually so I could select the “Don’t use AppData” setting that was mentioned in a few posts, that would make Notepad++ use a different folder for plugins, but it was greyed out. I’ve also tried creating a blank “doLocalConfig.xml” in c:\program files\notepad++, which other posts led me to believe is what that checkbox would do, but when I do that, restart Notepad++, and tell it to open the plugin folder, it still opens Program Files.
Is there anything that I’ve missed? Is there any recently updated info that addresses any of this? Or is what I’ve found still the current best info regarding this?
-
@John-Moe This is my basic understanding, hoping others can weigh in if it’s mistaken
I believe there’s currently no way to detach the plugins folder from the main program folder. So If you want users without local admin to be able to install plugins, the program installation has to happen in a folder which is not protected by the operating system, only editable by admins. This means Program Files etc can’t be used.
Would it be possible for intune to deploy ino c:\LocalApps\Notepad++ or similar?
-
When the developer was revamping the plugin system a few years back, he briefly experimented with ProgramData for plugins. Unfortunately, there were some technical difficulties, plus a lot of disagreement over whether the plugins should go there or not: a lot of admins did not want plugins to ever be able to go there, because they did not want their users installing their own plugins. There is no setting to change the location of the Plugins, because that would allow users on such systems to circumvent the desires of their IT admins.
There was a time when plugin DLLs could be put in AppData, but that was turned off long ago – I forget whether it was with the great v7.6.x Plugin Migration , or whether that was turned of before then… but either way, it’s been years since that worked, and I don’t believe there is any official documentation that still references using Notepad++'s AppData folder for anything but settings. The “Don’t use AppData” setting in the installer is just to determine whether config files will be in AppData or stay local with the application. The “Don’t use AppData” option in the installer creates the
DoLocalConf.xml, which tells Notepad++ to be in portable mode; that config file is documented in the User Manual in the Config Files section. But all the existance of that DoLocalConf.xml does is influence where Notepad++ looks for configuration files; plugin DLLs are not configuration files, and there is no setting to change where Notepad++ looks for plugin DLLs.If you want end-users to be able to install their own plugins, the best idea, as @Snabel42 suggested, is to change the installation directory to someplace outside of the Program Files hierarchy. This is not the same as a portable copy, because it still uses the installer executable and still uses
%AppData%\Notepad++for housing configuration files. To specify a different installation folder using the installer’s command line options, you can use the /D option alongside the /S option to set a specific directory: something like/S /D=c:\LocalApps\Notepad++, as described in the User Manual.(I had tried recently, when I got a new laptop at work, to try an embedded solution, where Program Files\Notepad++ was still protected by UAC, but I set the permissions on Program Files\Notepad++\Plugins to give me full write permission, hoping that it wouldn’t bring up the UAC prompt to install plugins… but because it’s part of Program Files hierarchy, it prompts me for UAC despite the permissions. Fortunately for me, my IT department recently made it easier for me to respond to UAC. But that will likely not work for your needs. So using the /D to install into a non-Program-Files directory might be the best compromise for you.)
-
@John-Moe I have the same issue, although we are still using Microsoft App-V. As said, a few versions earlier it was possible to install plugins in %appdata% by creating a dummy xml file in the program files folder. That gave also the possibility to make installing plugins user dependant. Because in some way (or for some users) it is a security risk.
However, there is still a way to seperate the plugins from the program files. This can be done by replacing the plugins folder with a symbolic link to a writeable location.
E.g. ‘mklink /D c:\Program Files\Notepad++\Plugins C:\Progamdata\Notepad++\Plugins’
In this configuration the plugins must be placed manually in linked plugins folder. Because the plugins admin (GPU.exe) requires elevated rights. I did not get that work, even with the app compatibility flag ‘RunAsInvoker’.
-
@AppManPeter said in Help allowing users to install plugins:
there is still a way to seperate the plugins from the program files. This can be done by replacing the plugins folder with a symbolic link to a writeable location. In this configuration the plugins must be placed manually in linked plugins folder.
You state this and it sounds like you got it to work. Then you state:
Because the plugins admin (GPU.exe) requires elevated rights. I did not get that work
So rather than providing a solution, you are merely postulating a possible solution that logically broke down for you in implementing it, and you are asking for help in getting around that?
Or something else?
-
@Alan-Kilborn It works the same as in the old situation where it was possible to place a dummy xml in de program folder. Users have to download and place their plugins manually in the linked folder. And then it is found and loaded by Notepad++.
Regarding the plugins admin. I do not deploy this feature to our users. It does not work in a non-admin environment, due to its elevation requirement. I am 95% sure of that. But I leave that 5% open. Maybe someone else knows a trick.
-
@AppManPeter said in Help allowing users to install plugins:
Regarding the plugins admin. I do not deploy this feature to our users. It does not work in a non-admin environment, due to its elevation requirement. I am 95% sure of that. But I leave that 5% open. Maybe someone else knows a trick.
The reason Plugin Admin requires elevation is because the plugin folder is inside a system controlled directory and path, like Program Files.
It’s my belief (hope?) that if the application is installed outside of such folders, inside say “C:\LocalApps\Notepad++” then the Plugin Admin would not require elevated admin rights to install plugins.
-
@Snabel42 said in [Help allowing users to install plugins]
The reason Plugin Admin requires elevation is because the plugin folder is inside a system controlled directory and path, like Program Files.
It’s my belief (hope?) that if the application is installed outside of such folders, inside say “C:\LocalApps\Notepad++” then the Plugin Admin would not require elevated admin rights to install plugins.
The Plugins link folder will inherit permissions from the parent Notepad++ folder even though the target folder may have users permissions. So you still face the same permissions issue.
Try using Icacls as admin to change permissions:
icacls "C:\Program Files\Notepad++\Plugins" /grant users:F /LThat should grant members of the
usersgroupFull permissions on the/Link folder. -
@mpheath said in Help allowing users to install plugins:
That should grant members of the
usersgroupFull permissions on the/Link folder.That does indeed sound interesting. I’m not sure if I’ll be able to test it, but I’ll report back here if/when I do
