Then I guess your problem is not related to security Descriptors.
I haven't sequenced the application but maybe you should try packaging it on a x64 sequencer.
You can troubleshoot and search where the file comes from, maybe you can specify its location somewhere in the software.
Possibly use ACT to fix it like Nicke addresses on his blog very nicely: http://www.applepie.se/cmcmarkets-and-horrible-java
But this requires a permanent change to your clients but a much better one than adding the user to the local admin group.