There are certain folders in Windows 2012 R2\8.1 where the contents are not writable - one example is Program Files\WindowsApps (which stores apps downloaded from the Windows Store). Obviously this is by design - to prevent people from modifying code that should not be end user accessible - but what specific mechanism is it that stops this? As an exercise I tried various means to circumvent it - but even having taken ownership of the directory, given my user full control permission to it and ensured that no read only flags are set - I still get permission denied trying to write a new file to this area. I even tried doing this from a command prompt running as 'System' (via sysinternals psexec) but I get the same error.
I thought for a while this might be something to do with mandatory access control and integrity levels - but it doesn't seem to be because my process is at a high integrity level - and although mandatory access control is on on this directory - it is set to Low. Effective Access says I have full control. Whatever it is is an OS level control though because mounting the filesystem in Linux the files are perfectly writable.
The reason for the question btw is that I am writing a presentation on the security of Windows Store Apps and I know that someone is going to ask me what is stopping end users from going in there and modifying them. Any pointers to specific documentation on this point from MS would be great if anyone has ever seen such a thing (I have looked extensively but can't find anything). Apologies if this question seems a bit client related - but I see it has already been asked on SuperUser a few times and no one seems to know the answer. Many thanks for any help.