locked
TrustedInstaller.exe RRS feed

  • Question

  • Hello, I don't know what happened to my thread but I have a question in regards to TrustedInstaller,

    Does it protect and prevent you from doing the following?:

    • Renaming the folder or sub folders that contain the files inside of them
    • Right Clicking on the folder and clickong on the "Cut" option
    • Making a new folder in any of the folders that are owned by TrustedInstaller
    • Renaming any of the sub folders inside
    • Renaming any of the files inside that folder which again are owned by TrustedInstaller
    • Moving any folders, subfolders, and files inside of those particular folders to the desktop of the computer

    Please Note: I am not trying nor attempting to destroy my computer in any way shape or form, I am only asking this question for informational purposes only. I'm curious to know as to what TrustedInstaller.exe does in terms of security, protection, and if it prevents me or any user who uses this machine to do the following that I've mentioned above as well as any additional ones that weren't mentioned earlier. I'm not trying to tamper with anything, again I just want to know what roles TrustedInstaller plays in terms of protection

    If you could please let me know if the methods I've mentioned above are correct and list or clarify any additional methods in which TrustedInstaller prevents you from doing, it would be greatly appreciated.

    Thank you in advance for your help!

    Tuesday, March 12, 2019 3:06 AM

Answers

  • Hi Paparoachman20,

    TrustedInstaller.exe is Windows Module Installer service which is part of Windows Resource Protection.

    Windows Resource Protection (WRP) is a technology that prevents the replacement of essential system files, folders, and registry keys that are installed as part of the operating system. It became available starting with Windows Server 2008 and Windows Vista. Permission for full access to modify WRP-protected resources is restricted to TrustedInstaller.

     

    WRP prevents files with .dll, .exe, .ocx, and .sys file extensions from being modified or replaced. Protecting these key resources is important to overall system stability, and, as such, they can only be modified by the Windows Module Installer service (TrustedInstaller.exe). If someone with administrative rights attempts to modify or replace a file that is protected by WRP, he will be presented with the message "Access Denied".

    If you change TrustedInstaller settings, you put your system at risk and your system may not function properly. It’s not suggested to remove it.

     

    You can check following link of WRP for more details: https://docs.microsoft.com/en-us/windows/desktop/wfp/windows-resource-protection-portal

     

    If there is anything else we can do for you, please feel free to post in the forum. Thank you for choosing Microsoft.

     

    Best regards,

    Zoe Mo


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, March 12, 2019 9:23 AM

All replies

  • Hello, I have a question in regards to TrustedInstaller.exe

    In terms of security, does TrustedInstaller.exe protect and prevent you from doing the following:

    • Renaming the folder or sub folders that contain the files inside of them
    • Right Clicking on the folder and clicking on the "Cut" option
    • Making a new folder in any of the folders that are owned by TrustedInstaller
    • Renaming any of the sub folders inside
    • Renaming any of the files inside that folder which again are owned by TrustedInstaller
    • Moving any folders, subfolders, and files inside of those particular folders to the desktop of the computer

    Please Note: I am not trying nor attempting to destroy my computer in any way shape or form, I am only asking this question for informational purposes only. I'm curious to know as to what TrustedInstaller.exe does in terms of protection and if it prevents me or any user who's using this machine to do the following that I have mentioned above as well as any additional ones that weren't mentioned earlier. I'm not trying to tamper with anything, again I just want to know what roles TrustedInstaller plays in terms of protection.

    If you could please let me know if the methods I've mentioned above are correct, and list additional methods in which TrustedInstaller.exe prevents you from doing, it would be greatly appreciated.

    Thank you in advance for your help!

    Monday, March 11, 2019 10:58 PM
  • TrustedInstaller is not for protection, it is for installation:
    What is TrustedInstaller.exe in Windows 10/8/7
    Tuesday, March 12, 2019 6:25 AM
  • Hello,

    Certain Operating System Files and Folders are protected by limiting the modifications or deletions of those files through security rights.  The rights to modify or delete those files are limited to Trustedinstaller.

    Installation of updates to Windows OS files are limited to going through Trustedinstaller.


    Thanks, Darrell Gorter [MSFT] This posting is provided "AS IS" with no warranties, and confers no rights.

    Tuesday, March 12, 2019 7:09 AM
  • Hi Paparoachman20,

    TrustedInstaller.exe is Windows Module Installer service which is part of Windows Resource Protection.

    Windows Resource Protection (WRP) is a technology that prevents the replacement of essential system files, folders, and registry keys that are installed as part of the operating system. It became available starting with Windows Server 2008 and Windows Vista. Permission for full access to modify WRP-protected resources is restricted to TrustedInstaller.

     

    WRP prevents files with .dll, .exe, .ocx, and .sys file extensions from being modified or replaced. Protecting these key resources is important to overall system stability, and, as such, they can only be modified by the Windows Module Installer service (TrustedInstaller.exe). If someone with administrative rights attempts to modify or replace a file that is protected by WRP, he will be presented with the message "Access Denied".

    If you change TrustedInstaller settings, you put your system at risk and your system may not function properly. It’s not suggested to remove it.

     

    You can check following link of WRP for more details: https://docs.microsoft.com/en-us/windows/desktop/wfp/windows-resource-protection-portal

     

    If there is anything else we can do for you, please feel free to post in the forum. Thank you for choosing Microsoft.

     

    Best regards,

    Zoe Mo


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, March 12, 2019 9:23 AM
  • Hey Zoe thank you for taking the time to answer my question, I'll mark your reply as an answer to my question.  I also have other questions which I forgot to ask earlier,

    1. If a user with or without administrative rights tries to move a file or folder (that is protected by WRP) would the same message "Access Denied" pop up?

    2. Lastly, if you accidentally changed the TrustedInstaller settings, is it possible to change it back through the following methods:

    • System Restore
    • Under the "Security" tab and clicking where it says "Advanced"

    Again, thank you so much for your help. Your answer helped answer my question!

    Tuesday, March 12, 2019 9:38 AM
  • Hi Padlock455,

     

    I tested on my lab environment(Windows 10 1809), with/without administrative rights trying to move a folder, both got the pop up requiring permission of TrustedInstaller.

     

    I guess the “accidentally changed the TrustedInstaller settings” you’ve mentioned, should be about switching ownership between the TrustedInstaller and other accounts? The System Restore should certainly be available, but generally I guess we just need to switch the ownership back to TrustedInstaller. You can check following links of how to switch the ownership for reference:

     

    Change the ownership from TrustedInstaller to others https://www.drivereasy.com/knowledge/you-require-permission-from-trustedinstaller-error-fixing-guide/

    Restore the ownership back to TrustedInstaller https://www.windowscentral.com/how-restore-trustedinstaller-owner-system-files-windows-10

     

    Note: these are 3rd party links, we don't have any warranties on these websites. It's just for your convenience. If any other questions, please feel free to post back. Thank you for choosing Microsoft.

     

    Best regards,

    Zoe Mo


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, March 13, 2019 9:23 AM
  • Hello Zoe, my apologies for the late response. I didn't change the ownership of anything, that was just a question if you were assuming I was changing something, Sorry for the misunderstanding.

    My other question is in regards to what you said earlier about the "access denied" does it also applied to other options that you could do such as Hiding the folder?

    Again, Appreciate the help! :)


    Friday, March 15, 2019 4:31 AM
  • Hi Paparoachman20,

     

    I tested on my lab, hiding a folder also triggered this pop up.

     

    If there is anything else we can do for you, please feel free to post in the forum. Thank you for choosing Microsoft.

     

    Best regards,

    Zoe Mo



    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, March 15, 2019 9:48 AM
  • Hi Paparoachman20,

     

    I tested on my lab, hiding a folder also triggered this pop up.

     

    If there is anything else we can do for you, please feel free to post in the forum. Thank you for choosing Microsoft.

     

    Best regards,

    Zoe Mo



    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Hi Zoe! Thank you so much for taking the time to clarify the questions I have asked,

    I had a similar question like the last one, but I wanted to know if this also applies to adding a new folder, I assume the same applies with what you were saying earlier, however I could be wrong.


    Monday, March 18, 2019 4:57 AM
  • Hi Paparoachman20,

     

    Yes same apply with earlier, create a new folder or copy a folder in to there, both trigger this pop up.

     

    If there is anything else we can do for you, please feel free to post in the forum. Thank you for choosing Microsoft.

     

    Best regards,

    Zoe Mo


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, March 18, 2019 9:42 AM
  • Hi Paparoachman20,

     

    Yes same apply with earlier, create a new folder or copy a folder in to there, both trigger this pop up.

     

    If there is anything else we can do for you, please feel free to post in the forum. Thank you for choosing Microsoft.

     

    Best regards,

    Zoe Mo


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Hey Zoe, apologies for the late response. I had another question in regards to TrustedInstaller, not sure if I've asked this question earlier:

    If I accidentally changed the owner of a folder from TrustedInstaller to something else, will performing a system restore revert it back to TrustedInstaller.exe?

    I know you can go in there and change it back to TrustedInstaller, via properties I was just curious  if performing a system restore will do the same thing. Again, thank you so much for your help earlier and I'm sorry about the late response!

    Sunday, April 14, 2019 11:45 PM