Software Deployment

Hello.
I'm in process of designing a fully automated way to advertise and deply applications for my employer (7000+ PC's organization)

I'm trying to lock Permissions on advertised shortcuts, but i cannot seem a way to do it, as the advertised shortcut is not displayed in file table.

Can somebody confirm or deny whether that is possible (i.e. assigning permissions to advertised shortcut within MSI, so it installs with correct permissions form the begining).

P.S. I do realize I could include some sort of custom action on the eng of msi sequence to run some custom tool to set advertised shortcut permissions on the end is msi install, but i'd prefer not to use it.

Thanks is advance.
Mops.