Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to lock down my IIS and SQL servers. I have a checklist of items to check, but the checklist does not take into account the TrustedInstaller account, which seems to have file permissions to everything.

One problem I'm having is that I need to make a few registry/dll changes. Many of the registry entries I need to modify, as well as the entire System32 folder, are owned by the TrustedInstaller. To make the changes I need to make, I'm having to take ownership of the files/registry entries, and then grant myself additional access.

Another problem I'm having is in locking down certain folders, such as the IIS dlls in system32. I want to minimize the number of accounts that have access to this folder, and I'm noticing again that TrustedInstaller is owner and has full control over these files.

So, what exactly is TrustedInstaller used for, and does it need to be the owner of these files? If not the owner, does it require full controll over these files?

I am using Windows Server 2008 R2.

share|improve this question
up vote 1 down vote accepted

You don't need to change the permissions for security.

In the recent versions of Windows in the Windows Files like System32 only TrustedInstaller have modify permissions not even the System account.

Since Windows Vista and Windows Server 2008, Windows Services can be at the ACLs of a folder. And the TrustedInstaller account is the Service Windows Modules Installer which is used for change files when Windows is performing an update.

You do not need and should not change this default behavior.

share|improve this answer
+1 for "should not change this behavior". I took TrustedInstaller off the access control list and it caused alot of problems... – Slider345 Sep 14 '11 at 18:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.