View Single Post
  #10  
Old 02-21-2020, 18:51
DavidXanatos DavidXanatos is offline
Family
 
Join Date: Jun 2018
Posts: 179
Rept. Given: 2
Rept. Rcvd 46 Times in 32 Posts
Thanks Given: 58
Thanks Rcvd at 350 Times in 116 Posts
DavidXanatos Reputation: 46
After some more investigation it seams that what sets this extra protection is IRP_MJ_SET_SECURITY with (Cbd->Iopb->Parameters.SetSecurity.SecurityInformation == PROCESS_TRUST_LABEL_SECURITY_INFORMATION)

About PROCESS_TRUST_LABEL_SECURITY_INFORMATION Microsoft's documentation says only Reserved.
it seams this sets a ACL's entry S-1-19-512-4096I)(RX,D,WDAC,WO,WA) which is not being shown in the file properties security tab and can not easily be removed.

With this information google starts finally being usefully and one of the results is: https://docs.microsoft.com/en-us/archive/blogs/winsdk/why-cant-i-restore-files-even-when-i-have-backuprestore-privileges-enabled
Which lists the C:\Program Files\WindowsApps and displays details about this new Security Flag.
Reply With Quote
The Following 3 Users Say Thank You to DavidXanatos For This Useful Post:
chants (02-23-2020), niculaita (02-22-2020), Stingered (02-22-2020)