I'm trying to lock down my IIS and SQL servers. I have a checklist of items to check, but the checklist does not take into account the TrustedInstaller account, which seems to have file permissions to everything.

One problem I'm having is that I need to make a few registry/dll changes. Many of the registry entries I need to modify, as well as the entire System32 folder, are owned by the TrustedInstaller. To make the changes I need to make, I'm having to take ownership of the files/registry entries, and then grant myself additional access.

Another problem I'm having is in locking down certain folders, such as the IIS dlls in system32. I want to minimize the number of accounts that have access to this folder, and I'm noticing again that TrustedInstaller is owner and has full control over these files.

So, what exactly is TrustedInstaller used for, and does it need to be the owner of these files? If not the owner, does it require full controll over these files?

I am using Windows Server 2008 R2.

1 Answer 1


You don't need to change the permissions for security.

In the recent versions of Windows in the Windows Files like System32 only TrustedInstaller have modify permissions not even the System account.

Since Windows Vista and Windows Server 2008, Windows Services can be at the ACLs of a folder. And the TrustedInstaller account is the Service Windows Modules Installer which is used for change files when Windows is performing an update.

You do not need and should not change this default behavior.

  • +1 for "should not change this behavior". I took TrustedInstaller off the access control list and it caused alot of problems...
    – Slider345
    Sep 14, 2011 at 18:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .