Having a program that can only can go past the rights of the user
seems to me to be overkill.  It would prevent a whole line of
applications from being written.  Granted, I shouldn't be able to
write a program that any user can access that can modify files on the
system.  But at the same token, some legitimate acceptions to that do
occur.  Some programs need to have stronger access rights.  

Web browsers,  for example, obviously needs to be able to save files
to the hard drive for it's temporary internet cache...and surprisingly
enough, they can.  A newsreader program needs to save files on the
hard drive so that the user can reread those files at a later time.
Mail programs are similar.   And these programs usually have settings,
as well, for the users.

If I have a limited account, these programs obviously are storing
these files somewhere. The question is where and how.

Along these lines, if I end up having to have custom configurations
per user,  is there a standard config file to hold these.  This
definitely, in my opinion, limits some of the uses for the app.config
file.  

Although I haven't looked yet, I'm sure there are ways to get the
environmental variables holding the current user's identity, as well
as the directory in which they store their files.  I just don't know
what those variables are, or which configuration file to use to access
these files.  

One idea.  Is it possible to programmatically setup a union of
permissions durring the installation.  Since only an admin can
install, this would ensure that these settings would be done
legitimately.I don't know the specifics, but I would probably want to
setup the permissions based on the strong name of the application.

I would also probably want to remove the permission during uninstall.

During install, I could use the target path as the base class for the
file io permissions.  Then, within the app, I could test for
permissions against the current directory at startup of the
application.