How to add a Deny ACE for TrustedInstaller?

Solution 1:

You have to use NT Service\TrustedInstaller as entry to select TrustedInstaller permissions.