Editing/Creating files in C:\Program Files\WindowsApps

Lately, I've been quite annoyed at the fact that I can't edit files in C:\Program Files\WindowsApps folder. I've used the takedown command, in elevated CMD, and changed permissions, to allow admins to have full control (I am an admin), and changed owner to Administrators. I can delete files/folders, yet, whenever I try to edit files, or add files, I get the error message "Access is denied." How do I enable creating files and editing files in WindowsApps?

The WindowsApps folder is one of the most heavily protected folders in Windows 10. It contains all the Windows UWP apps, to which Microsoft zealously guards the access. The protections on this folder may change across Windows versions.

The usual methods of taking ownership and assigning permissions are not enough for this folder, but are still required as first step to gaining access. After executing them, accessing the folder is now possible for copying, but editing is still blocked. To edit, one needs to save the file elsewhere, and only then replace the original with the edited version.

A further note is that restoring the ownership of the folder to TrustedInstaller is possible without losing the extra permissions that were assigned, by using the command:

icacls "%ProgramFiles%\WindowsApps" /setowner "NT Service\TrustedInstaller" /t

If someone wishes to use an elevated Command Prompt for gaining access to the folder, then these are the commands :

    takeown /F "%ProgramFiles%\WindowsApps"
    takeown /F "%ProgramFiles%\WindowsApps" /r /d y
    icacls "%ProgramFiles%\WindowsApps" /grant Administrators:F
    icacls "%ProgramFiles%\WindowsApps" /grant Administrators:F /t

I also note that permission problems can be avoided by using the following commands before and after changing permissions to completely restore the original permissions :

icacls "%ProgramFiles%\WindowsApps" /save WindowsApps.acl
icacls "%ProgramFiles%" /restore WindowsApps.acl

To complement the poster's remark about restoring the original permissions on the folder while not having saved these permissions before starting, this is done by entering in an elevated Command Prompt (cmd) the command :

icacls "%ProgramFiles%\WindowsApps" /q /c /t /reset

If the command does not work, it needs to be redone from a Windows boot CD/USB, as explained in the post Reset default ACLs for C:\Program Files\WindowsApps:

1. Follow the instructions on this page to create the Windows Installation Media
2. Boot from the USB/CD, click "Repair my computer" upon reaching the Install button
3. Select Troubleshoot, then Command Prompt
4. Your current drive C: will be the boot media, with your Windows system disk likely in D:, so verify using dir D:, and if not, then search for the right drive-letter

5. Using the drive letter you just found (maybe D:\), issue the command:

   icacls "D:\Program Files\WindowsApps" /q /c /t /reset
   

6. Wait for the operation to complete, and check the output for errors

7. Reboot.

Level of difficulty [extremely advanced].

On Win 10 (almost latest version), I read Harry’s original post and chose to start with the backup:

1. Click Start

2. Type “cmd” and wait, don’t hit enter yet.

3. Click “run as administrator”

4. Type:

    cd \Progra~1 and hit enter
   

5. Backup permissions:

    icacls "%ProgramFiles%\WindowsApps" /save WindowsApps.acl
   

I then continued with Harry’s guidance:

[Still]...an elevated Command Prompt for gaining access to the folder (but for grant I started with just my App, which had special settings it wanted me to update for EyeTV 64-bit):

takeown /F "%ProgramFiles%\WindowsApps"
takeown /F "%ProgramFiles%\WindowsApps" /r /d y
icacls "%ProgramFiles%\WindowsApps\GENIA...<-your App name" /grant Administrators:F
icacls "%ProgramFiles%\WindowsApps\GENIA...<-your App name" /grant Administrators:F /t

I was conservative I changed view settings: Select View > Options > Change folder and search options. Select the View tab and, in Advanced settings, select Show hidden files, folders, and drives and OK.

I then followed Albin’s post above to get more control and remove inheritance (not completely, but make it individual) on WindowsApps:

![Albin’s post images]

I now right click WindowsApps folder in C:\Program Files and unhide and uncheck read only.
Also gave myself, Admin, Full Control see Albin for permissions, and Apply

Then at elevated cmd:

icacls "file" /setowner "NT Service\\TrustedInstaller" /T /C

I went to my Genia folder in WindowsApps and copied the file I wanted to desktop, edited it and copied it back to just the Program Files folder (with Administrator confirmation).

Back in elevated command prompt I deleted the old file I wanted to change: del “filename.ini”.
Then I got Linus Torvalds Git app for windows, from wikipedia I Installed git-bash, then ran that “right-click” as administrator.
Copied the file using that and got a 0 byte empty file and error, but it did not break my apps, and proved write capability.

I got Ubuntu 12 and used Rufus in Freedos/mbr mode to make a bootable USB from Ubuntu AMD 64 or 32 iso, and BIOS boot to my UEFI USB.
In test mode I used The folder icon > Win10 “whatever your disk is called” to mount my drive.
In logo icon (top left), search terminal, click and navigate via:

cd /media/Win10/Program\ Files > enter
cat filename.ini > WindowsApps/GENIA.../Transponders/filename.ini

I unmounted (ejected) Win10 back in folder view. Shutdown (top right button), reboot.
Wait for dots about ten times.
Remove USB when prompted, hit Enter.
Test it out in Windows.
My App now works right, with settings updated.

I tried elevated cmd prompt:

icalcs %ProgramFiles% /restore WindowsApps.acl

No success, so I did:

icacls "%ProgramFiles%\WindowsApps" /q /c /t /reset

I then followed Albin’s post above to remove control and inheritance on WindowsApps:

![Albin’s post images]

Even though it was there, Made myself owner again. I Added Administrators > check Names.
Added new user permission, check names;
Gave myself just read & execute, list folder contents, read on a second Administrator entry;
And deleted full control entry for me.
I changed owner back

NT Service\TrustedInstaller > check names
Becomes TrustedInstaller

I then hit apply and close out.
My apps still work.

I have solved this myself nonetheless:

From an administrator command prompt the following command will copy the WindowsApps package folder (or any folder within):

robocopy /B /E /COPY:DAT D:\WindowsApps\xxx D:\MyTargetDir

This will copy the WindowsApps\xxx package folder on D:\ to MyTargetDir folder on D:\. This works because the /B option tells Windows to use the Backup token which ignores any permissions or limitations / policies.

After that the files need to be decrypted:

cipher /D /S:D:\MyTargetDir

Then the files can be edited.

Remove the original folder (or rename it):

mv D:\WindowsApps\xxx D:\WindowsApps\xxx_

And then copy back the edited files:

robocopy /B /E /COPY:DAT D:\MyTargetDir D:\WindowsApps\xxx

HOWEVER: Note, I still haven't figured out how to make the edited app start, as for now Windows Store will return errors for the apps in these folders as soon as the permissions are changed. Changing them back won't work.