Software Deployment

To handle different program dependencies on start up we are using VBscripts to launch the programs.
If a program need HKCU settings these are added using a launch.vbs before starting the program.

The company I work for has configured all computers not to run VBS files, so as a workaround they have made their own extension and related this to VBscript files, and to run them they have to run wscript.exe with the file as argument.
All users are local adminstrators on their computer.

For the organizations core applications I want to set permissions on the shortcuts.
I want to set the permissions to for local administrator and Domain Users to Read\Browse\Execute and Full for Domain Admins.

I have tried to sett this on the Components for the shortcuts inside my MSI, but with the result that the permissions was also added to C:\ ? This made the installation fail since they no longer could copy files to [ProgramFilesFolder].

I have also looked at the possibility to use MMC and create a security template inf file, but this only set permissions on the actual file running ([SystemFolder]\wscript.exe) and not the .lnk.

I have thougt of making a vbscript and run it as a custom action.

An other thing about shortcuts running wscript.exe with arguments is that this is a preexisting file, and I cannot set it Advertised, how can I do this?


Anyone have any idea what would be the best approach for these issues?

Thanks in advance.