In Windows, the resources that a person can access, such as files and folders, are restricted by that person's user account and the groups that they're a member of. The same goes for running processes since they adopt the privileges of whichever user launched them or in the case of long-running, self-starting services, the user account they're configured to start under. On every file and folder, there's a list of exactly who can read, modify, and execute its contents.

To fit into this paradigm, WiX lets us update the accounts and group memberships of both new and existing users. This way, we can sync a user's permissions with those required by a resource. In this chapter, we'll cover several common scenarios involving users and groups.