How to prevent a user from changing a file manually?

Answer 1

I'm going to presume that you are not trying to prevent the user from changing the file manually, you just want to prevent the extra step of specifically assigning rights to the file.

You are most likely writing to a file that is in a protected area (an area that became protected after UAC was introduced). To avoid this, write your file to one of the "approved" areas, such as %APPDATA%. Here is a list of a few more (assuming C is your boot drive):

C:\Users\username\Documents
C:\Users\username\AppData\Local
C:\Users\username\AppData\Roaming
C:\Users\Public\Documents
C:\ProgramData

This article has a whole bunch of info around that which you can cherry pick bits from.

Answer 2

Encrypt it, or digital sign it

Answer 3

This might be an overkill, but you could create a service that run's on a different user account, which can edit the file. Then your application would use that service to access the file.

This way you can prevent unwanted changes and/or log every change to the file.