Windows File explorer still asking for TrustedInstaller permission

[sudg6]

Cannot rename a folder, such as WinSxS folders, with TrustedInstaller permission.

[fafalone]

This is a known issue with Explorer itself; it reacts very poorly to being started with any kind of permissions beyond basic run and run as admin. If you start a process explorer what you're likely to find is that there's no NT AUTHORITY\SYSTEM instance of Explorer running at all: when it detects itself as being launched with elevated permissions, it terminates itself and starts a new, unelevated instance. Since the operation didn't technically fail, RunAsTI reports no error.

The best alternative is to run cmd.exe and perform the ops from there, or an alternative file explorer that's better behaved.

(PS- I have tried forcing explorer to run as SYSTEM using more exotic methods. it goes haywire; lots of crashing, lots of errors, many things missing... it hates it :) )

[Kobi-Blade]

I just tried with CMD and still says access denied, meaning this tool is not working on Windows 11 24H2.

Waiting...
Enabling privileges...
AdjustPrivileges::Got process token.
AdjustPrivileges::Enabled debug privilege.
AdjustPrivileges::Enabled impersonate privilege.
Impersonating system...
Got winlogon pid, opening process...
Got winlogon process handle, opening token...
Successfully impersonated system!
Service manager opened. Opening TrustedInstaller service...
Attempting to start TrustedInstaller service...
Service running, pid=4416
First thread id for pid=2764
NtImpersonateThread STATUS_SUCCESS. Opening current token...
OpenThreadToken success, return=0x1
Duplicating stolen TI token...
Token duplicated. Creating process...
LaunchAsTI return code=0x1 (SUCCESS)

[fafalone]

Access denied is a different error from the original post in this thread. If it's a generic access denied and not 'you need permission from TI...' then the issue is folder is in use (permissions irrelevant) or filter driver protected (tamper protection etc to be turned off first, tool does not do this automatically).

WinSxS appears to be filter driver protected as I don't get the 'need permission from TI' when I try to delete from a process started with this tool, but I do from the same process when not started from this.

I'm going to update the readme as there seems to be a lot of confusion about how this tool works. It does not disable Windows Defender and its associated tamper protection, real time protection, and Wdfilter.sys and other filter drivers. The filter drivers are a kernel level software that supercedes/overrides the regular permissions system. for access to some things you need to turn those off first (e.g. disable tamper/rt protection through settings then start regedit with this tool, change their start modes to disabled, and reboot), then you're just down to the normal permissions/ownership system this tool is meant for.

[Kobi-Blade]

This was run in a VM with a Windows System that does not have Microsoft Defender,

The folder is protected exclusively by TI, with no active processes running inside it. Access is denied is the generic message Command Prompt returns when attempting to delete files or folders protected by TI.

I managed to delete these folders using IObit Unlocker, but I'd prefer an alternative since it messes with ACLs.

[fafalone]

I can't replicate the access denied issue, non-TI cmd.exe says access denied, but it does seem TI cmd.exe isn't deleting them while other apps running as TI via this tool can once other protections are disabled.. TI cmd gives no error just doesn't do it. (25H2)