On 08/10/2022 17:56, Achim Gratz wrote:
> I think that setup was essentially treating the install as "for this
> user only" since it was created and maintained by a script that can't
> affect that option and the fact it was also in group Adminsitroators
> didn't actually register until now.

Yeah, that seems possible, since some of these changes fix what are 
arguably bugs in how that works (i.e. I suspect that previously, even 
when elevated, if only the registry key 
HKEY_CURRENT_USER\\Software\\Cygwin\\setup\rootdir exists (and not the 
same key under HKLM), we're going to install for "Just Me", irrespective 
of what the UI says)

> The DACL on the server install changed from conferring access to "Everyone" to
> just the install user and SYSTEM IIRC.  It doesn't do that on the
> (non-domain) build machine at home that runs Win10 Pro.

That makes less sense to me.  We should always creating an entry in the 
DACL for 'Everyone' to hold the POSIX permissions for 'other' users.

(See win32.cc:NTSecurity::GetPosixPerms() which translates a file mode 
to a SD)

 >> As long as there's an option to force it to keep the former behaviour
 >> things should be OK, but I haven't really checked if and how this is
 >> possible.
 >
 > Unfortunately, there is no such option.

I wrote some code for this option (attached), but I have a hard time 
seeing how it's functionally different from using '-B/'--no-admin'.

So, I guess a question is, does running with that option work as 
expected in your problematic instance?