Rubberduck: Inno Setup: Discrepancy between expected and actual PowerUser's privileges

[Inarion]

Issue: Under certain circumstances, InnoSetup does not provide the correct options for the unprivileged user. In my case, I only got offered "Install for all users" with "Only install for me" being greyed out. This happened regardless of me executing the installer regularly or "As Administrator". The interesting part: I am no administrator and lack all related privileges. Nonetheless, the installer never raised an privilege elevation prompt when I chose to "run as admin".

As it turns out, the radio button activation criteria comes from the function IsElevated.

function IsElevated: Boolean;
begin
  Result := IsAdminLoggedOn or IsPowerUserLoggedOn;
end;

I can with certainty say that I'm no admin and that IsAdminLoggedOn should always return false for me. Some more research revealed (chat log for reference) that in our domain, every domain user is automatically mapped to a user group that corresponds to the "PowerUser" group (just with a localized name, thanks Microsoft!). The trouble here is that our local PowerUsers do not have any administrative privileges, as opposed to what the Microsoft's original intention with PowerUsers was.
So, in conclusion: InnoSetup correctly determines that I am a PowerUser (by group association), but then fails to identify my lack of privileges. Thus it prevents me from doing a single user installation and in consequence fails to write every single registry entry (as they all go to HKLM, which I lack the privilege to write to).

---

PowerUser or PowerLessUser?
The PowerUser group is a remains from the days before Windows Vista was born. Every Windows after that only included the group for backwards compatibility. This article by Raymond Chen has some insight as to why our domain admins stripped down our SuperUser's privileges:

• "Power users are admins who have not made themselves admins yet."
• The group still exists, though, for backward compatibility. Don’t fool yourself into thinking the Power Users group is a step below an administrator. It’s pretty much the same thing.
• Starting in Windows Vista, the permissions granted to the Power Users group were stripped down tremendously, making them little more than regular users with a fancy title.

---

To finally conclude: There is a significant discrepancy between what a PowerUser was originally intended to be and what it means in modern Windows. The current implementation of the InnoSetup build script seems to be assuming the old PowerUser.
The system requirements to run RD as stated in the wiki

Microsoft Windows Vista or higher

combined with the statement that

Starting in Windows Vista, the permissions granted to the Power Users group were stripped down tremendously, [...]

from above mentioned article directly clashes with that assumption of a PowerUser's privileges.

[Inarion]

Any ETA on the merge of this PR? I'm eager to get my duck back. :)
(And sorry if I sound pushy; I don't mean to. It seems like a simple change without many - any? - side effects, but I the end I don't have any real insight into the process, so I'd not be surprised to see my assumption go 180° off the mark.)

[Vogel612]

@Inarion You can test the result for the PullRequest from here. Do tell if it worked :)

[Inarion]

@Vogel612 Awesome, that works perfectly! (Meaning I was able to select "You only" during installation. And now The Duck is back! Thanks!)

[bclothier]

Thanks for the confirmation! Issues with installers can be very hard to replicate, so it's very helpful to know this worked out for you.