After some more investigation it seams that what sets this extra protection is IRP_MJ_SET_SECURITY with (Cbd->Iopb->Parameters.SetSecurity.SecurityInformation == PROCESS_TRUST_LABEL_SECURITY_INFORMATION)
About PROCESS_TRUST_LABEL_SECURITY_INFORMATION Microsoft's documentation says only Reserved.
it seams this sets a ACL's entry S-1-19-512-4096
I)(RX,D,WDAC,WO,WA) which is not being shown in the file properties security tab and can not easily be removed.
With this information google starts finally being usefully and one of the results is: https://docs.microsoft.com/en-us/archive/blogs/winsdk/why-cant-i-restore-files-even-when-i-have-backuprestore-privileges-enabled
Which lists the C:\Program Files\WindowsApps and displays details about this new Security Flag.
02-21-2020, 18:51
Similar Threads
Threaded Mode