Reset default ACLs for C:\Program Files\WindowsApps

Question

I had to take ownership of the special folder C:\Program Files\WindowsApps to fix a problem with icons. The issue is now resolved, so I'd like to reset the permissions to the way they were before I took ownership of the folder.

I reverted NT SERVICE\TrustedInstaller to the owner and removed my account's permission entries:

But I still have full control of the folder and can browse the folder in Explorer without getting the usual warning that I would have to take ownership:

Is it possible to restore the default permissions of this folder?

score 22 · Answer 1 · edited Jul 19 '23 at 14:13

UPDATE: based on the comments, don't use this command anymore. Use the voted answer or the tool provided by: Agentrev -> https://github.com/AgentRev/WindowsAppsUnfukker

(Btw, never hat a Problem with the /reset on my windows 10 PC, but there were a ton of changed in UWP)

Resetting permissions works in most cases, but you need SYSTEM permissions to run the command.

The easiest solution is to use PsExec (from Sysinternals).

Open an elevated Command Prompt or PowerShell and run psexec to get a SYSTEM shell.

psexec.exe -s -i cmd

In that Command Prompt, run the reset permission command:

icacls "C:\Program Files\WindowsApps" /reset /t /c /q

score 13 · Accepted Answer · answered Jul 05 '22 at 16:10

I struggled with this issues A LOT.

First of all DO NOT USE icacls "C:\Program Files\WindowsApps" /reset /t /c /q. It will remove special conditional permissions from folder and give it windows default and inherited ACLs which is should not be done to WindowsApps.

Here is answer I found that worked for me (Win10 and Win11 21H2) and didn't cause any troubles (at least troubles i know about)

Firstly open the Command Prompt with Administrative Privileges
Ensure that you have ownership of WindowsApps folder by running next command

takeown /f "%ProgramFiles%\WindowsApps"

Restore innitial permissions to that folder by running this

cacls "%programfiles%\WindowsApps" /s:"D:PAI(A;;FA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;OICIIO;GA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;;0x1200a9;;;S-1-15-3-1024-3635283841-2530182609-996808640-1887759898-3848208603-3313616867-983405619-2501854204)(A;OICIIO;GXGR;;;S-1-15-3-1024-3635283841-2530182609-996808640-1887759898-3848208603-3313616867-983405619-2501854204)(A;;FA;;;SY)(A;OICIIO;GA;;;SY)(A;CI;0x1200a9;;;BA)(A;OICI;0x1200a9;;;LS)(A;OICI;0x1200a9;;;NS)(A;OICI;0x1200a9;;;RC)(XA;;0x1200a9;;;BU;(Exists WIN://SYSAPPID))"

OR if cacls is not accesible, use icacls. To do so create temp.txt file with next content and save it somewhere, for example to c:\

windowsapps
D:PAI(A;;FA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;OICIIO;GA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;;0x1200a9;;;S-1-15-3-1024-3635283841-2530182609-996808640-1887759898-3848208603-3313616867-983405619-2501854204)(A;OICIIO;GXGR;;;S-1-15-3-1024-3635283841-2530182609-996808640-1887759898-3848208603-3313616867-983405619-2501854204)(A;;FA;;;SY)(A;OICIIO;GA;;;SY)(A;CI;0x1200a9;;;BA)(A;OICI;0x1200a9;;;LS)(A;OICI;0x1200a9;;;NS)(A;OICI;0x1200a9;;;RC)(XA;;0x1200a9;;;BU;(Exists WIN://SYSAPPID))

and then run

icacls "%programfiles%" /restore c:\temp.txt

give ownership of WindowsApps back to trustedinstaller

icacls "%programfiles%\WindowsApps" /setowner "nt service\trustedinstaller"

if it doesn't work from cmd - right click on WindowsApps folder in explorer, open properties and go to security tab, click Advanced and click Change button against Owner. There enter NT Service\TrustedInstaller (with space between NT and Service and without quotes) and click Check Names button. Click OK and finnaly apply changes.

After this manipulations permissions on WindowsApps folder should be restored to default and all UWP apps should work fine (wt.exe for example)

P.S. Default ACLs for WindowsApps is

NT SERVICE\TrustedInstaller:(F)
NT SERVICE\TrustedInstaller:(OI)(CI)(IO)(F)
S-1-15-3-1024-3635283841-2530182609-996808640-1887759898-3848208603-3313616867-983405619-2501854204:(RX)
S-1-15-3-1024-3635283841-2530182609-996808640-1887759898-3848208603-3313616867-983405619-2501854204:(OI)(CI)(IO)(GR,GE)
NT AUTHORITY\SYSTEM:(F)
NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
BUILTIN\Administrators:(CI)(RX)
NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(RX)
NT AUTHORITY\NETWORK SERVICE:(OI)(CI)(RX)
NT AUTHORITY\RESTRICTED:(OI)(CI)(RX)
BUILTIN\Users:(Rc,S,RD,REA,X,RA)

and commands above is meant to set it so.

Most usefull info I took from winhelponline blog, so credit to it. I chose to write big answer and not to just give a link because I think it's better to keep useful info at many places and not just at one blog.

score 9 · Answer 3 · edited Oct 18 '18 at 06:47

9

Like this to reset permission on this folder:

icacls "C:\Program Files\*" /q /c /t /reset

The things was:

/reset - Replaces ACLs with default inherited ACLs for all matching files.
/t     - Performs the operation on all specified files in the current
         directory and its subdirectories.

edited Oct 18 '18 at 06:47

jww

12,722

answered Jan 23 '18 at 09:21

Kattee Lee

657

score 9 · Answer 4 · edited May 26 '20 at 18:01

I found this answer when searching Google, and it led me to a solution.

ISSUE: Windows apps (such as Mail and Calendar) will not open. Start Menu will not open. Can't right-click taskbar icons.

Microsoft Store reported issues updating these applications.
Uninstall/reinstall failed.
In-place Windows Upgrade ("repair") did not fix the issues.
Inspecting permissions on the "WindowsApps" directory showed corrupted permissions.
Error codes 0x80246013, 0x80070005

FIX: Run the reset ACLs command Kattee posted from a Windows Install USB boot disk, using the built-in command prompt for troubleshooting.

Follow the instructions on this page to create Windows Installation Media: https://support.microsoft.com/en-us/help/15088/windows-create-installation-media.
Boot from the USB/CD
When you reach the "Install" button, click "Repair my computer" in the bottom left instead.
Select "Troubleshoot"
Select "Command Prompt"
Locate your system drive
- The command prompt won't start on your system drive. It will be on "X:\" which is where the USB/CD is mounted
- You will need to navigate to each drive letter and type "dir" to find the right one, starting with C:
- Note that this command prompt doesn't use "cd" to change drives (only directories). Simply type the drive letter to switch to that drive (e.g. "D:\")
Once you've located the correct drive letter, and switched to it, enter a slightly modified version of Kattee's command, using the drive letter you just found (mine was D:):
- icacls "D:\Program Files\WindowsApps" /q /c /t /reset
Wait for the operation to complete, and check the final output line for any failures.
Reboot!

That's what got me working again. Everything is fine after rebooting. No apps even needed to be reinstalled. Everything "just works."

score 6 · Answer 5 · edited May 26 '20 at 18:01

I did not have to use the recovery disk option mentioned previously. I just had to run it from the command prompt in administrator mode:

icacls "C:\Program Files\WindowsApps" /reset /t /c /q

Parameter description:

/reset Replaces ACLs with default inherited ACLs for all matching files.
/t Performs the operation on all specified files in the current directory and its subdirectories.
/c Continues the operation despite any file errors. Error messages will still be displayed.
/q Suppresses success messages.

Reference: icacls command reference

I may have also restarted the computer but I don't think that is required.

franzbischoff · Answer 6 · 2024-01-18T17:00:05.847

Listen to @agentrev!!!

I lost 2 days of work until I got his script and fixed all again!

https://github.com/AgentRev/WindowsAppsUnfukker

edit:

If, for any reason, the main link disappears from this world, there is a snapshot of the script in webarchive here: link

For further reviewers, sometimes we cannot copy & paste the answer here. This script certainly saved hours of work for many people and has enough stars on github to be trusted.

score 3 · Answer 7 · edited Dec 06 '19 at 13:56

The following command will work in terms of fixing issues with WindowsApps not launching if that is your issue:

icacls "C:\Program Files\WindowsApps" /reset /t /c /q

The question however is how to "Reset default ACLs for C:\Program Files\WindowsApps" and there are two ways that I know of that actually reset permission to their defaults.

Option 1

Manually add the principals according this image:

The Defaults for WindowsApps folder

Option 2

If you happen to have a backup of Windows before the change, use that to restore the Program files/WindowsApps folder DO NOT overwrite existing folders/files restore it somewhere else then use the icacls commands:

Open Command Prompt as Admin
icacls "X:\PathToRestored\Program Files\WindowsApps" /save "X:\WhereToSave\WindowsApps.acl"
icacls "%ProgramFiles%" /restore "X:\PathToSaved\WindowsApps.acl"
icacls “%ProgramFiles%\WindowsApps” /setowner “NT Service\TrustedInstaller”

score 0 · Answer 8 · answered May 26 '20 at 16:37

This post has been very helpful. Let me explain how I used the information in this post to fix the problem for myself.

I had to access the files in /Program Files/WindowsApps - which at first I needed to give myself ownership and subsequently permission to do. What I did not know is how this would affect me being able to download apps from Microsoft Store as well as the Xbox Beta PC App.

To change it back and restore my downloads, I followed the following steps:

1) While still being the owner of the folder in question, I opened Command Prompt with elevated privileges (right click > run as administrator) and typed in the following command:

icacls "C:\Program Files\WindowsApps" /reset /t /c /q

2) Pressed enter after entering this command, closing the Command Prompt window afterwards.

3) Went back into permissions for the folder (right click > properties > security tab > advanced) and clicked on "change" next to owner (at the top).

4) In the text box at the bottom of the next dialog, typed in the following and then clicked on "Check Names" box on the right hand side.

NT Service\TrustedInstaller

5) Clicked apply and ok on all dialog boxes, closing them all and restarting my machine.

There. Now you should have changed the permissions of the folder back to defaults, while being the owner. Then, you gave ownership back to the TrustedInstaller user which is used by Windows Update (and Microsoft Store / Xbox App) to install apps and games.

You should now be able to install things again.

If you still can't install things, make sure to follow the following steps:

1) Hold Windows Key and press R

2) Type "services.msc" and press enter.

3) Scroll down until you see "Windows Update" and right click, then select "Start".

Hope this helps!

Derek Ziemba · Answer 9 · 2021-10-25T17:04:32.913

I got fed up with the permissions after Windows wouldn't let me extract a folder to Program Files due to permissions issue. So I added myself and THIS BROKE EVERYTHING.

I couldn't even start task manager. I'm using Win10 20H2. I almost did a system restore but that would take me back a full week. I did not want to do that.

I think I fixed it with:

WinKey, type "cmd", right click "cmd" and click "Run as Administrator"
Run takeown /SKIPSL /R /F "C:\Program Files"
- This took > 5 minutes. If you don't do it first then the next command won't achieve jack.
Run icacls "C:\Program Files" /reset /t /c /q
Restart the computer
All UWP apps will still be broken. Give up and do the system restore....

score 0 · Answer 10 · answered Jun 28 '23 at 03:42

0

I haven't enough reputation to add a comment
In Gidsik's answer:
To make icacls "%programfiles%" /restore c:\temp.txt work.
You may need UTF-16 encoding when create temp.txt

answered Jun 28 '23 at 03:42

Q.Z. Lin

1

score -1 · Answer 11 · answered Jun 22 '22 at 04:44

cacls "%programfiles%\WindowsApps" /s:"D:PAI(A;;FA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;OICIIO;GA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;;0x1200a9;;;S-1-15-3-1024-3635283841-2530182609-996808640-1887759898-3848208603-3313616867-983405619-2501854204)(A;OICIIO;GXGR;;;S-1-15-3-1024-3635283841-2530182609-996808640-1887759898-3848208603-3313616867-983405619-2501854204)(A;;FA;;;SY)(A;OICIIO;GA;;;SY)(A;CI;0x1200a9;;;BA)(A;OICI;0x1200a9;;;LS)(A;OICI;0x1200a9;;;NS)(A;OICI;0x1200a9;;;RC)(XA;;0x1200a9;;;BU;(Exists WIN://SYSAPPID))"

Run this as admin

Reset default ACLs for C:\Program Files\WindowsApps

11 Answers11

Linked

Related