3

regarding this question: Cannot write on WindowsApps directories and restore files

After hitting to wall trying to restore some files inside this directory c:\Program Files\WindowsApps\ on windows 10 I hit over this undocumented SID

S-1-19-512-4096

Files using icacls give this results

S-1-19-512-4096:(I)(RX,D,WDAC,WO,WA)

and no one have permissions to restore them, change them, rename them delete them.

I have Google it and found only two results, I bealive this question will be the third one.

Is there any information's about that and how to disabled or change it or take over it, because is not let me restore files after have been deleted.

1

I'm aware that this is an old question, but I came across this same SID dealing with my own machine's problems. According to "Windows Internals Seventh Edition", Yosifovich et. al., this SID corresponds to the WinTCB signer (i.e. the Windows trusted computing base).

It may be possible to interact with these files while running as NTAUTHORITY\SYSTEM.

2
  • its an old question, but is still active - the main issue here is that the computer can take the control from you and you can not do anything... – Aristos Apr 14 '20 at 1:31
  • @Aristos The whole point of the WinTCB is that code is signed and a non-human role account handles administration. If you really need to interact with a directory owned by one of the system SIDs, use a tool that lets you run a program as NTAUTHORITY\SYSTEM i.e. S-1-5-18. – nanofarad Apr 14 '20 at 3:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.