3

regarding this question: Cannot write on WindowsApps directories and restore files

After hitting to wall trying to restore some files inside this directory c:\Program Files\WindowsApps\ on windows 10 I hit over this undocumented SID

S-1-19-512-4096

Files using icacls give this results

S-1-19-512-4096:(I)(RX,D,WDAC,WO,WA)

and no one have permissions to restore them, change them, rename them delete them.

I have Google it and found only two results, I bealive this question will be the third one.

Is there any information's about that and how to disabled or change it or take over it, because is not let me restore files after have been deleted.

Community
  • 1
Aristos
  • 552
  • 8
  • 17

1 Answers1

1

I'm aware that this is an old question, but I came across this same SID dealing with my own machine's problems. According to "Windows Internals Seventh Edition", Yosifovich et. al., this SID corresponds to the WinTCB signer (i.e. the Windows trusted computing base).

It may be possible to interact with these files while running as NTAUTHORITY\SYSTEM.

nanofarad
  • 719
  • 1
  • 9
  • 23