diff --git a/InstallerSource/inno-setup-natlink.iss b/InstallerSource/inno-setup-natlink.iss
index e22d336..19c5ce1 100644
--- a/InstallerSource/inno-setup-natlink.iss
+++ b/InstallerSource/inno-setup-natlink.iss
@@ -1,3 +1,6 @@
+;debugging tip
+;Run the setup.exe program with /LOG.  See inno setup docs.
+
 #define MyGUID "{{dd990001-bb89-11d2-b031-0060088dc929}"
 #define Bits "32bit"
 #define SitePackagesDir "{app}\site-packages"
@@ -5,11 +8,23 @@
 #define DistDir "{app}\dist"
 #define WheelPath "{#DistDir}\{#PythonWheelName}"
 
+;a well known SID for all users on a system.
+;on an english system, (Get-LocalGroup users).SID will return this SID 
+#define AllowedUsersSid "S-1-5-32-545"   
+
 ; It's important to look in the InstallPath subkey to check for installation
 #define PythonInstallKey "Software\Python\PythonCore\" + PythonVersion + \
                           "-32\InstallPath" 
 #define PythonPathMyAppNameKey "Software\Python\PythonCore\" + PythonVersion + \
                           "-32\PythonPath\" + MyAppName 
+[Dirs]
+;we would like all users to read and execute these folders.
+;note pip replaces with what it thinks the permissions should be
+;so we need an extra setp in [Run] to restore all users read and execute.
+Name:  {#CoreDir}; Permissions: users-readexec
+Name:  {#SitePackagesDir}; Permissions: users-readexec
+Name: {#DistDir}; Permissions: users-readexec
+
 
 [Setup]
 AppId={#MyGUID}
@@ -92,10 +107,16 @@ Root: HKLM; Subkey: "{#PythonPathMyAppNameKey}"; ValueType: string; ValueData: "
 Root: HKCU; Subkey: "{#PythonPathMyAppNameKey}"; ValueType: string; ValueData: "{#SitePackagesDir}"; Flags: uninsdeletekey noerror
 
 [Run]
+;debugging tip for this section:  Run the setup.exe program with /LOG.  See inno setup docs.
+
 ;register the pyd for corresponding version of Python
 Filename: "{#PythonInstallPath}\\Scripts\\pip.exe"; Parameters: "-m pip install --upgrade pip"; StatusMsg: "Upgrade pip..."
 Filename: "{#PythonInstallPath}\\Scripts\\pip.exe"; Parameters: "install --target ""{#SitePackagesDir}""  --upgrade ""{app}/dist/{#PythonWheelName}"" "; StatusMsg: "natlink {#PythonWheelName}"
 
+;pip changes the permissions on files and folders, so we have to redo them.  icacls is a built in windows program to change permissions.
+;users need read and execute  
+
+Filename: "icacls.exe";  Parameters: " ""{#SitePackagesDir}"" /t /grant *{#AllowedUsersSid}:RX "; StatusMsg: "icacls.exe"; 
 Filename: "regsvr32";  Parameters: "-s \""{#CoreDir}\{#NatlinkCorePyd}\""" ; StatusMsg: "regsvr32 {#NatlinkCorePyd}"
 Filename: "{#PythonInstallPath}\\Scripts\\pip.exe"; Parameters: "install --upgrade natlinkcore"; StatusMsg: "natlinkcore"