[aariel]

While that is good advice, unfortunately I did try that and had the exact same problem. I don’t believe UAC is involved in this particular problem. winsxs is heavily protected with the TrustedInstaller group/service.

I suspect the fix is either changing the “Administrator” group’s permission to Full Control on the winsxs ACL–which would violate the whole purpose of the atypical setup so MS probably worked pretty hard to stop this. Or add the “Administrator” group to the “TrustedInstaller” group. However neither of these steps can be accomplished through normal means. There is possibly some reg setting to allow one or the other, but I’m at a loss to discover what it is.

Normally the ACL for winsxs is read-only for “Administrators”. If you stop “trustinstaller.exe” via the task manager, it makes the ACL editable; however, when you attempt to Apply changes to it, you get an “Access Denied” error message. So it looks like MS worked pretty hard block this type of thing.

It’s sad that they decided to have the OS trust itself more than members of the “Administrators” group. It would be like trying to admin linux/UNIX without a root account. I guess it’s just indicates how bad many Windows Admins are that MS feels it’s best to have the OS not trust them to know what they’re doing.

[Author]

Posts