While an Administrator has "Full Control" permissions over many objects, they are not the . In Windows, an owner has the implicit right to change the object's permissions. Because Administrators are not the owners of system files, they cannot modify the ACLs or delete these files without first forcibly taking ownership.
When Windows Update runs, the Windows Modules Installer service starts. This service runs under the identity of TrustedInstaller . Because the service is TrustedInstaller, it matches the identity in the file's ACL and is granted permission to modify, replace, or delete protected files. trustedinstaller permissions
Before modifying any TrustedInstaller-protected file, run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth – often they repair the file without you needing to manually replace it. While an Administrator has "Full Control" permissions over
A common misconception is that the SYSTEM account has unrestricted access. When Windows Update runs, the Windows Modules Installer