Struggling with permissions issues for the AllUsers settings on Windows

[moorepants]

Checklist

• [X] I added a descriptive title
• [X] I searched open reports and couldn't find a duplicate

What happened?

We build a constructor Windows installer annually and install for AllUsers in silent mode. This year many/most of the installed scripts in <install-directory>/Scripts/ have permissions that prevent execution. For example, opening the Anaconda prompt and typing Jupyter lab gives Error executing Jupyter command 'lab': [WinError 5] Access is denied. Similar errors are produced when trying to launch lab from the Anaconda Navigator. Running spyder from the prompt or Navigator works. We tried building the new installer with the constructor version (3.4.5) we used last year but still get the permission errors. We have many details of our trial and error in this issue: https://gitlab.ewi.tudelft.nl/bhmgerritsen/anaconda-dee-config/-/issues/64 but I'll summarize below.

Constructor setup:

• Channel: conda-forge (with anaconda-navigator, console_shortcut, menuinst, powershell_shortcut using defaults:: notation and with conda channel priority set to "strict". The idea was to install everything form conda-forge except for these few anaconda specific packages.
• We install with silent mode like tudelft-anaconda-v2024.01-Windows-x86_64.exe /InstallationType=AllUsers /RegisterPython=1 /S /D=C:\Programs\tudelft-anaconda (but also have tried graphical installs)
• construct.yaml is here: https://gitlab.ewi.tudelft.nl/bhmgerritsen/anaconda-dee-config/-/blob/master/construct.yaml
• Our latest installer is here: https://gitlab.ewi.tudelft.nl/bhmgerritsen/anaconda-dee-config/-/releases

If we download the latest official Anaconda windows installer and run it in silent mode the permissions are correct. But our installer leaves many files with restricted permissions.

Changes from last year:

• The approach was have channel priority with defaults then conda-forge and install the anaconda package and then add various extra packages on top of anaconda from conda-forge.
• We set the channel_priority=strict this year and didn't last year.
• We hard pin the versions of all packages this year.
• Our constructor files from last year's release are here: https://gitlab.ewi.tudelft.nl/bhmgerritsen/anaconda-dee-config/-/tree/62d723fbbfabe495a0bb38c408b51a40dd1a8adc

We have run out of ideas as to what causes the permissions errors. Do you have any suggestions for what we may be doing wrong?

Conda Info

NA

Conda Config

NA

Conda list

NA

Additional Context

No response