14

I had to take ownership of the special folder C:\Program Files\WindowsApps to fix a problem with icons. The issue is now resolved, so I'd like to reset the permissions to the way they were before I took ownership of the folder.

I reverted NT SERVICE\TrustedInstaller to the owner and removed my account's permission entries:

enter image description here

But I still have full control of the folder and can browse the folder in Explorer without getting the usual warning that I would have to take ownership:

enter image description here

Is it possible to restore the default permissions of this folder?

1
12

Resetting permissions works in most cases, but you need SYSTEM permissions to run the command.

Easiest solution is to use psexec (from sysinternals).

Open an elevated command prompt or powershell an run psexec to get an SYSTEM-shell.

psexec.exe -s -i cmd

In that command prompt run the reset permission command

icacls "C:\Program Files\WindowsApps" /reset /t /c /q

1
  • 3
    Or psexec.exe -s icacls "C:\Program Files\WindowsApps" /reset /t /c /q for even shorter – antak Jun 30 '20 at 3:15
10

Like this to reset permission on this folder:

icacls "C:\Program Files\*" /q /c /t /reset

The things was:

/reset - Replaces ACLs with default inherited ACLs for all matching files.
/t     - Performs the operation on all specified files in the current
         directory and its subdirectories.
0
8

I found this answer when searching Google, and it led me to a solution.

ISSUE: Windows apps (such as Mail and Calendar) will not open. Start Menu will not open. Can't right-click taskbar icons.

  • Microsoft Store reported issues updating these applications.
  • Uninstall/reinstall failed.
  • In-place Windows Upgrade ("repair") did not fix the issues.
  • Inspecting permissions on the "WindowsApps" directory showed corrupted permissions.
  • Error codes 0x80246013, 0x80070005

FIX: Run the reset ACLs command Kattee posted from a Windows Install USB boot disk, using the built-in command prompt for troubleshooting.

  1. Follow the instructions on this page to create Windows Installation Media: https://support.microsoft.com/en-us/help/15088/windows-create-installation-media.
  2. Boot from the USB/CD
  3. When you reach the "Install" button, click "Repair my computer" in the bottom left instead.
  4. Select "Troubleshoot"
  5. Select "Command Prompt"
  6. Locate your system drive
    • The command prompt won't start on your system drive. It will be on "X:\" which is where the USB/CD is mounted
    • You will need to navigate to each drive letter and type "dir" to find the right one, starting with C:
    • Note that this command prompt doesn't use "cd" to change drives (only directories). Simply type the drive letter to switch to that drive (e.g. "D:\")
  7. Once you've located the correct drive letter, and switched to it, enter a slightly modified version of Kattee's command, using the drive letter you just found (mine was D:):
    • icacls "D:\Program Files\WindowsApps" /q /c /t /reset
  8. Wait for the operation to complete, and check the final output line for any failures.
  9. Reboot!

That's what got me working again. Everything is fine after rebooting. No apps even needed to be reinstalled. Everything "just works."

6
  • This is the only solution that works for me. – yuxhuang Dec 28 '19 at 5:31
  • 1
    Note that this command prompt doesn't use "cd" to change drives (only directories). Simply type the drive letter to switch to that drive (e.g. "D:\"): You should be able to use the /D switch to do this. Ex: cd /D D:\Program Files\WindowsApps should put you in the correct folder on the "D" drive. – Arvo Bowen Jan 24 '20 at 4:14
  • 2
    To skip a few steps, At #3, instead, use Shift+F10 to open a command prompt. Then skip to #6. – Arvo Bowen Jan 24 '20 at 4:33
  • 1
    I'd love to say this works, unfortunately, it does not. Every file passes successfully, but the error related with it (in my case Win32BridgeServer.exe, which resides in WindowsApps) still raises an "Invalid parameter error". Also, just as a heads up: enabling inheritiance of ACL-rights from the tier above (C.\Program Files) might not be the correct troubleshooting process at all, since afaik, WIndowsApps-folder has far more restrictive ACLs set by default. – Yannik Z. Jul 9 '20 at 8:54
  • @YannikZ."Invalid Parameter Error" doesn't sound like what this is meant to fix. This solution is specifically for permission-related errors ("access denied", etc). Additionally, /t flag says to set the ACLs for all objects in the directory, not the directory itself. I've verified this locally on my system (where I've performed this operation before). – neatchee Jul 10 '20 at 19:05
5

I did not have to use the recovery disk option mentioned previously. I just had to run it from the command prompt in administrator mode:

icacls "C:\Program Files\WindowsApps" /reset /t /c /q

Parameter description:

  • /reset Replaces ACLs with default inherited ACLs for all matching files.
  • /t Performs the operation on all specified files in the current directory and its subdirectories.
  • /c Continues the operation despite any file errors. Error messages will still be displayed.
  • /q Suppresses success messages.

Reference: icacls command reference

I may have also restarted the computer but I don't think that is required.

4
  • I tried this, but got "Access is denied" for a number of entries. Successfully processed 3693 files; Failed processing 20879 files – Matty Brown Sep 12 '18 at 12:53
  • @Matty Brown: Does your administrator group have permission to read/write/open the directory? – Keplerian Sep 12 '18 at 22:45
  • I also got "Access is denied", but I fixed it: Right click WindowsApps > Properties > Security > Advanced > click Change in the upper Owner field > enter your user name > OK. This will give you permission to reset permissions back with the "icacls" command. – Stian Høiland May 30 '19 at 2:54
  • As others have pointed out, this cannot work unless you have already explicitly given Administrators (group) permissions to read/write or full access; the Administrators group is not given these by default on the latest update of Win 10 (not sure about previous versions). – Ryan Aug 14 '19 at 12:45
2

The following command will work in terms of fixing issues with WindowsApps not launching if that is your issue:

icacls "C:\Program Files\WindowsApps" /reset /t /c /q

The question however is how to "Reset default ACLs for C:\Program Files\WindowsApps" and there are two ways that I know of that actually reset permission to their defaults.

Option 1

Manually add the principals according this image:

The Defaults for WindowsApps folder

Option 2

If you happen to have a backup of Windows before the change, use that to restore the Program files/WindowsApps folder DO NOT overwrite existing folders/files restore it somewhere else then use the icacls commands:

  1. Open Command Prompt as Admin
  2. icacls "X:\PathToRestored\Program Files\WindowsApps" /save "X:\WhereToSave\WindowsApps.acl"
  3. icacls "%ProgramFiles%" /restore "X:\PathToSaved\WindowsApps.acl"
  4. icacls “%ProgramFiles%\WindowsApps” /setowner “NT Service\TrustedInstaller”
0

This post has been very helpful. Let me explain how I used the information in this post to fix the problem for myself.

I had to access the files in /Program Files/WindowsApps - which at first I needed to give myself ownership and subsequently permission to do. What I did not know is how this would affect me being able to download apps from Microsoft Store as well as the Xbox Beta PC App.

To change it back and restore my downloads, I followed the following steps:

1) While still being the owner of the folder in question, I opened Command Prompt with elevated privileges (right click > run as administrator) and typed in the following command:

icacls "C:\Program Files\WindowsApps" /reset /t /c /q

2) Pressed enter after entering this command, closing the Command Prompt window afterwards.

3) Went back into permissions for the folder (right click > properties > security tab > advanced) and clicked on "change" next to owner (at the top).

4) In the text box at the bottom of the next dialog, typed in the following and then clicked on "Check Names" box on the right hand side.

NT Service\TrustedInstaller

5) Clicked apply and ok on all dialog boxes, closing them all and restarting my machine.

There. Now you should have changed the permissions of the folder back to defaults, while being the owner. Then, you gave ownership back to the TrustedInstaller user which is used by Windows Update (and Microsoft Store / Xbox App) to install apps and games.

You should now be able to install things again.

If you still can't install things, make sure to follow the following steps:

1) Hold Windows Key and press R

2) Type "services.msc" and press enter.

3) Scroll down until you see "Windows Update" and right click, then select "Start".

Hope this helps!

1
  • 3
    This does not seem to differ significantly from the existing answers. If you found an answer helpful you should upvote it instead of submitting the same information from existing answer. – Ramhound May 26 '20 at 17:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.