Program files(x86) has wrong permissions

Dear Forum,

i am currently experiencing a security issue with my Program Files(86 that is a bit bothersome. Recently i reinstalled two machines with the help of MDT and updating goes via WSUS. All our current machines are domain joined and we are in the process of migrating to Windows Server 2019. We are currently on Windows Server 2K8R2.

I have had it with 1 user with an old configuration and 2 new freshly installed computer that from on day to the other my program files(86) folder rights and permissions are not correct. The Current owner is the Hostname\Administrators, i think thats the group, Integrity level is set on High Mandatory level, and the 3 Permissions entries that i see are, System, Administrators and Users.

I can not install 32 bit applications any more, i can't change the owner of the folder nor can i add new entries to the permissions list. I have tried to rebuild my ACL i have tried retaking ownership. but without any success.

We are deploying group policies within our organization but i am unaware that and if a group policy has the ability to rewrite and revoke folders that are protected by microsoft's Windows Resource Protection (WRP).

Any ideas for what could be causing this?. A laptop effected by this problem was reinstalled last Friday, and by today the permissions have been revoked.

Forgot to mention:

OS: Windows 10 Enterprise Version 1909 OS Build 18363.720

cbraafhart said:

i am currently experiencing a security issue with my Program Files(86 that is a bit bothersome... I can not install 32 bit applications any more, i can't change the owner of the folder nor can i add new entries to the permissions list. I have tried to rebuild my ACL i have tried retaking ownership. but without any success.

I can't say what has changed your permissions, but I think I can explain why you cannot install anything. TrustedInstaller should be the owner and have full control, in your case it has no permissions. This is how my permissions look.

Yes, that i have figured out Bree, and thats correct, what your permissions are mine were like that. something is changing the permission and i can't figure out what could be causing this problem. this started happening to precisely three computers but i am afraid that it would happen to all the machines being administered by me and the IT department.

I checked the logs, but really nothing out of the ordinary. from 7000 hits only 6 warnings. but none of them related to my current problem. i really don't understand whats currently happening. i had it happen to one test server i am currently using. one of my servers has received the same type of error. But luckily i have this backed up so i am going to do a restore on the OS drive and enable audit logging on the program files folder to see if i could retrieve and retrace when this occurs. because i checked on the Yesterday and i lost permissions but on the 24th they are still there. so as early/late that i could go is still 2 days ago. Luckily!