[irvingouj@Devolutions (irvingoujAtDevolution)]

The installer gave BUILTIN\Users read access to %ProgramData%\Devolutions\Gateway, and everything in it inherits that, including recordings and server.key. Only SYSTEM, admins and the service account need it, so this drops the Users entry from PROGRAM_DATA_SDDL_TEMPLATE.

Existing installs get fixed on upgrade: install/upgrade/repair already reset the DACL of the folder and everything below it.

Heads-up: non-admins can't read gateway.json or the logs anymore.

Tested

• New DataFolderTests.OnlySystemAdministratorsAndTheServiceAccountCanReadTheData (red before, green after), full installer unit tests pass.
• Lab: upgraded a 26.3.0 Gateway with this MSI. A non-admin local user lost read access to existing and new recordings and server.key. The service still writes recordings and serves them through /jet/jrec/pull, and admins can still read/write.

Issue: DGW-504

🤖 Generated with Claude Code

[github-actions]

Let maintainers know that an action is required on their side

• Add the label release-required Please cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module) when you request a maintainer to cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module)

• Add the label release-blocker Follow-up is required before cutting a new release if a follow-up is required before cutting a new release

• Add the label publish-required Please publish libraries (`Devolutions.Gateway.Utils`, OpenAPI clients, etc) when you request a maintainer to publish libraries (Devolutions.Gateway.Utils, OpenAPI clients, etc.)

• Add the label publish-blocker Follow-up is required before publishing libraries if a follow-up is required before publishing libraries

[Copilot]

🟢 Approval recommended

No active review issues remain for the data-folder access restriction and its associated regression coverage.

No open issues 🎉

What changed in this PR

Restricts access to Gateway’s data folder to SYSTEM, administrators, and the service account, protecting recordings and private keys from non-admin users.

Changes:

• Removes the BUILTIN\Users read-access entry from the data-folder security template and updates its documentation.
• Adds regression coverage checking allowed readers for the data-folder and users-database templates.

File	Description
package/​WindowsManaged/​Resources/​Includes.cs	Removes Users read access and documents the restricted permissions.
package/​WindowsManaged.UnitTests/​DataFolderTests.cs	Verifies that only SYSTEM, administrators, and the service account receive read access.

_{Review effort: Balanced}