[MSIX Bucket] Launch issues caused by bad permissions on WindowsApps, and others #12972

Open
opened 2026-01-31 03:30:21 +00:00 by claunia · 12 comments
Owner

Originally created by @DHowett on GitHub (Mar 11, 2021).

There is a class of issues whose root cause seems to be bad permissions on C:\Program Files\WindowsApps.

  • wt.exe can launch the "wrong" copy of Terminal without user settings
    • DIFFERENTIAL DIAGNOSTIC The version number switches between (example) 1.7.1991 and 1.7.210451004-release1.7
  • error 0xc0000022 on launch (#9399)

REPORTERS: If you have one of these issues, can you share the output of icacls "C:\Program Files\WindowsApps" (from an admin shell?)

Correct WindowsApps permissions
\Program Files\WindowsApps NT SERVICE\TrustedInstaller:(F)
                           NT SERVICE\TrustedInstaller:(OI)(CI)(IO)(F)
                           S-1-15-3-1024-3635283841-2530182609-996808640-1887759898-3848208603-3313616867-983405619-2501854204:(RX)
                           S-1-15-3-1024-3635283841-2530182609-996808640-1887759898-3848208603-3313616867-983405619-2501854204:(OI)(CI)(IO)(GR,GE)
                           NT AUTHORITY\SYSTEM:(F)
                           NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
                           BUILTIN\Administrators:(CI)(RX)
                           NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(RX)
                           NT AUTHORITY\NETWORK SERVICE:(OI)(CI)(RX)
                           NT AUTHORITY\RESTRICTED:(OI)(CI)(RX)
                           BUILTIN\Users:(Rc,S,RD,REA,X,RA)

zadjii-msft notes circa 2023-09-06:

There's a collection of "crash on startup" issues which started around 1.16. They're all in the neighborhood of Cannot_create_instance_of_type__Microsoft.UI.Xaml.Controls.XamlControlsResources or winrt::impl::consume_Windows_ApplicationModel_IPackageStatics_winrt::Windows::ApplicationModel::IPackageStatics_::Current, depending on how the exception was handled. More notes in:

Originally created by @DHowett on GitHub (Mar 11, 2021). There is a class of issues whose root cause _seems_ to be bad permissions on `C:\Program Files\WindowsApps`. * `wt.exe` can launch the "wrong" copy of Terminal without user settings * **DIFFERENTIAL DIAGNOSTIC** The version number switches between (example) `1.7.1991` and `1.7.210451004-release1.7` * error `0xc0000022` on launch (#9399) **REPORTERS**: If you have one of these issues, can you share the output of `icacls "C:\Program Files\WindowsApps"` (from an admin shell?) <details> <summary>Correct WindowsApps permissions</summary> ``` \Program Files\WindowsApps NT SERVICE\TrustedInstaller:(F) NT SERVICE\TrustedInstaller:(OI)(CI)(IO)(F) S-1-15-3-1024-3635283841-2530182609-996808640-1887759898-3848208603-3313616867-983405619-2501854204:(RX) S-1-15-3-1024-3635283841-2530182609-996808640-1887759898-3848208603-3313616867-983405619-2501854204:(OI)(CI)(IO)(GR,GE) NT AUTHORITY\SYSTEM:(F) NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) BUILTIN\Administrators:(CI)(RX) NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(RX) NT AUTHORITY\NETWORK SERVICE:(OI)(CI)(RX) NT AUTHORITY\RESTRICTED:(OI)(CI)(RX) BUILTIN\Users:(Rc,S,RD,REA,X,RA) ``` </details> ---- zadjii-msft notes circa 2023-09-06: There's a collection of "crash on startup" issues which started around 1.16. They're all in the neighborhood of `Cannot_create_instance_of_type__Microsoft.UI.Xaml.Controls.XamlControlsResources` or `winrt::impl::consume_Windows_ApplicationModel_IPackageStatics_winrt::Windows::ApplicationModel::IPackageStatics_::Current`, depending on how the exception was handled. More notes in: * https://github.com/microsoft/terminal/issues/15583#issuecomment-1708760392 (collected notes, resolution steps) * https://github.com/microsoft/terminal/issues/15583#issuecomment-1708641554 (x-links a bunch of bugs) * https://github.com/microsoft/terminal/issues/15526#issuecomment-1708635865 (another couple dupes) * https://github.com/microsoft/terminal/issues/14961#issuecomment-1461141118 (an early analysis)
Author
Owner

@alancnet commented on GitHub (Mar 13, 2021):

@DHowett here is the output of that command, but inheritance is not enabled for vcruntime140.dll.

C:\Windows\system32>icacls "C:\Program Files\WindowsApps"
C:\Program Files\WindowsApps NT SERVICE\TrustedInstaller:(I)(F)
                             NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
                             NT AUTHORITY\SYSTEM:(I)(F)
                             NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
                             BUILTIN\Administrators:(I)(F)
                             BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
                             BUILTIN\Users:(I)(RX)
                             BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
                             CREATOR OWNER:(I)(OI)(CI)(IO)(F)
                             APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
                             APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)
                             APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(RX)
                             APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)

Successfully processed 1 files; Failed processing 0 files

In process monitor, I am getting ACCESS_DENIED on a CreateFile operation. I don't know why it would be attempting to create the file when WindowsTerminal is already installed:
image

icacls for that file is:

C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe>icacls vcruntime140.dll
vcruntime140.dll APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX)
                 NT AUTHORITY\SYSTEM:(F)
                 APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX)
                 NT AUTHORITY\LOCAL SERVICE:(RX)
                 NT AUTHORITY\NETWORK SERVICE:(RX)
                 NT SERVICE\TrustedInstaller:(F)
                 S-1-15-3-1024-3635283841-2530182609-996808640-1887759898-3848208603-3313616867-983405619-2501854204:(RX)
                 BUILTIN\Users:(R)
                 BUILTIN\Users:(Rc,S,RD,REA,X,RA)
                 BUILTIN\Users:(Rc,S,RD,REA,X,RA)
                 BUILTIN\Users:(Rc,S,RD,REA,X,RA)
                 NT AUTHORITY\RESTRICTED:(RX)
                 S-1-19-512-4096:(I)(RX,D,WDAC,WO,WA)

Successfully processed 1 files; Failed processing 0 files

A workaround for me is to enable inheritance on this file:

image

Cheers!

@alancnet commented on GitHub (Mar 13, 2021): @DHowett here is the output of that command, but **inheritance is not enabled** for vcruntime140.dll. ``` C:\Windows\system32>icacls "C:\Program Files\WindowsApps" C:\Program Files\WindowsApps NT SERVICE\TrustedInstaller:(I)(F) NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F) NT AUTHORITY\SYSTEM:(I)(F) NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F) BUILTIN\Administrators:(I)(F) BUILTIN\Administrators:(I)(OI)(CI)(IO)(F) BUILTIN\Users:(I)(RX) BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE) CREATOR OWNER:(I)(OI)(CI)(IO)(F) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(RX) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE) Successfully processed 1 files; Failed processing 0 files ``` In process monitor, I am getting `ACCESS_DENIED` on a `CreateFile` operation. I don't know why it would be attempting to _create_ the file when WindowsTerminal is already installed: ![image](https://user-images.githubusercontent.com/2042102/111034781-0ecfd280-83cc-11eb-8e44-127a4e08a03a.png) icacls for that file is: ``` C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe>icacls vcruntime140.dll vcruntime140.dll APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) NT AUTHORITY\SYSTEM:(F) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) NT AUTHORITY\LOCAL SERVICE:(RX) NT AUTHORITY\NETWORK SERVICE:(RX) NT SERVICE\TrustedInstaller:(F) S-1-15-3-1024-3635283841-2530182609-996808640-1887759898-3848208603-3313616867-983405619-2501854204:(RX) BUILTIN\Users:(R) BUILTIN\Users:(Rc,S,RD,REA,X,RA) BUILTIN\Users:(Rc,S,RD,REA,X,RA) BUILTIN\Users:(Rc,S,RD,REA,X,RA) NT AUTHORITY\RESTRICTED:(RX) S-1-19-512-4096:(I)(RX,D,WDAC,WO,WA) Successfully processed 1 files; Failed processing 0 files ``` A workaround for me is to enable inheritance on this file: ![image](https://user-images.githubusercontent.com/2042102/111035149-ed6fe600-83cd-11eb-8d32-8fef3459a2a7.png) Cheers!
Author
Owner

@DHowett commented on GitHub (Mar 13, 2021):

I am specifically interested in the ACLs on WindowsApps, the root for all store-installed applications. 😄

sorry: misread your message. Thanks!

@DHowett commented on GitHub (Mar 13, 2021): I am specifically interested in the ACLs on WindowsApps, the root for all store-installed applications. 😄 sorry: misread your message. Thanks!
Author
Owner

@DHowett commented on GitHub (Mar 13, 2021):

So, CreateFile is the Win32 API for open and creat. That part isn’t strange. I’ll have to look at the permissions on my machine!

@DHowett commented on GitHub (Mar 13, 2021): So, CreateFile is the Win32 API for `open` _and_ `creat`. That part isn’t strange. I’ll have to look at the permissions on my machine!
Author
Owner

@DHowett commented on GitHub (Mar 15, 2021):

That's very curious. I do have inheritance enabled on that file. If you reset inheritance and clear out all locally overridden permissions, does that resolve the issue?

@DHowett commented on GitHub (Mar 15, 2021): That's very curious. I _do_ have inheritance enabled on that file. If you reset inheritance and clear out all locally overridden permissions, does that resolve the issue?
Author
Owner

@alancnet commented on GitHub (Mar 19, 2021):

@DHowett Yes it does.

@alancnet commented on GitHub (Mar 19, 2021): @DHowett Yes it does.
Author
Owner

@alancnet commented on GitHub (Mar 20, 2021):

@DHowett Just going about my normal business, and the permissions have reset. Inheritance is no longer enabled. I don't know what was the catalyst. Is there any way I can provide more insight?

@alancnet commented on GitHub (Mar 20, 2021): @DHowett Just going about my normal business, and the permissions have reset. Inheritance is no longer enabled. I don't know what was the catalyst. Is there any way I can provide more insight?
Author
Owner

@DHowett commented on GitHub (Mar 20, 2021):

Might be worth running Process Monitor with the filter set to include filesystem events for that path. It’ll be noisy and may take a long time to reproduce, but it should definitely point to a culprit!

@DHowett commented on GitHub (Mar 20, 2021): Might be worth running Process Monitor with the filter set to include filesystem events for that path. It’ll be noisy and may take a long time to reproduce, but it should definitely point to a culprit!
Author
Owner

@nascar3000 commented on GitHub (Apr 5, 2021):

This issue happens time to time, finally I ve become mad and created a scheduled task running command to reset NTFS permissions to everyone;
Icacls "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\vcruntime140.dll" /Grant Everyone:(F)

@nascar3000 commented on GitHub (Apr 5, 2021): This issue happens time to time, finally I ve become mad and created a scheduled task running command to reset NTFS permissions to everyone; `Icacls "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\vcruntime140.dll" /Grant Everyone:(F) `
Author
Owner

@DHowett commented on GitHub (Apr 5, 2021):

@nascar3000 the request for a process explorer trace extends to you, as well. It would be very helpful in figuring out what’s going on!

@DHowett commented on GitHub (Apr 5, 2021): @nascar3000 the request for a process explorer trace extends to you, as well. It would be very helpful in figuring out what’s going on!
Author
Owner

@zadjii-msft commented on GitHub (Mar 22, 2022):

From a related thread:

ixcxaxxclxs "C:\Progxram Files\WindxowsApps" /reset /t /c /q

NEVER DO THIS, IT WILL BREAK YOUR ENTIRE APP CATALOG IRREVOCABLY

@zadjii-msft commented on GitHub (Mar 22, 2022): From a related thread: ``` ixcxaxxclxs "C:\Progxram Files\WindxowsApps" /reset /t /c /q ``` NEVER DO THIS, IT WILL BREAK YOUR ENTIRE APP CATALOG IRREVOCABLY
Author
Owner

@pizzacrystal commented on GitHub (Jun 25, 2023):

for those who are suffered to #15526 , here is my workable solution,

  1. please refer to #15526 for making sure you are in the same trouble
  2. I did take the ownership of 'WindowsApps' folder with my own account therefore I tried to restore its original permission setup by referring to this doc
  3. uninstall WT, reboot, and re-install it
  4. however, the first time of un- and re- install, the issue was there still, no idea why ...
  5. shutdown computer and restart, un- and re- install WT again
  6. start WT via Microsoft Store at the very first time (maybe this was the key ?)
  7. pin WT to taskbar

finally it came back

@pizzacrystal commented on GitHub (Jun 25, 2023): for those who are suffered to #15526 , here is my workable solution, 1. please refer to #15526 for making sure you are in the same trouble 2. I did take the ownership of 'WindowsApps' folder with my own account therefore I tried to restore its original permission setup by referring to [this doc](https://superuser.com/questions/1288014/reset-default-acls-for-c-program-files-windowsapps) 3. uninstall WT, reboot, and re-install it 4. however, the first time of un- and re- install, the issue was there still, no idea why ... 5. shutdown computer and restart, un- and re- install WT again 6. **start WT via Microsoft Store** at the very first time (maybe this was the key ?) 7. pin WT to taskbar finally it came back
Author
Owner

@thomas-berg commented on GitHub (Jan 31, 2024):

I encounter a Windows Terminal crash when trying to start Windows Terminal with Run as administrator. The UAC pops up with 'Unknown Program'. Windows Terminal launches normally when not starting with Run as administrator.

icacls output:
C:\WINDOWS\system32>icacls "c:\Program Files\WindowsApps"
c:\Program Files\WindowsApps NT SERVICE\TrustedInstaller:(F)
NT SERVICE\TrustedInstaller:(OI)(CI)(IO)(F)
S-1-15-3-1024-3635283841-2530182609-996808640-1887759898-3848208603-3313616867-983405619-2501854204:(RX)
S-1-15-3-1024-3635283841-2530182609-996808640-1887759898-3848208603-3313616867-983405619-2501854204:(OI)(CI)(IO)(GR,GE)
NT AUTHORITY\SYSTEM:(F)
NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
BUILTIN\Administrators:(CI)(RX)
NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(RX)
NT AUTHORITY\NETWORK SERVICE:(OI)(CI)(RX)
NT AUTHORITY\RESTRICTED:(OI)(CI)(RX)
BUILTIN\Users:(Rc,S,RD,REA,X,RA)

Successfully processed 1 files; Failed processing 0 files

Event logs:
Faulting application name: WindowsTerminal.exe, version: 1.18.2311.14001, time stamp: 0x6553b19e
Faulting module name: KERNELBASE.dll, version: 10.0.19041.1387, time stamp: 0x0b9a844a
Exception code: 0xc000027b
Fault offset: 0x000000000010b302
Faulting process ID: 0x2c64
Faulting application start time: 0x01da5424779c9f1c
Faulting application path: C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.3181.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe
Faulting module path: C:\WINDOWS\System32\KERNELBASE.dll
Report ID: 1663eff1-8a3f-4d4d-bd23-addf6bd506b4
Faulting package full name: Microsoft.WindowsTerminal_1.18.3181.0_x64__8wekyb3d8bbwe
Faulting package-relative application ID: App

Fault bucket 1805946374774718074, type 5
Event Name: MoAppCrash
Response: Not available
Cab Id: 0

Problem signature:
P1: Microsoft.WindowsTerminal_1.18.3181.0_x64__8wekyb3d8bbwe
P2: praid:App
P3: 1.18.2311.14001
P4: 6553b19e
P5: combase.dll
P6: 10.0.19041.1348
P7: baf10630
P8: 802b000a
P9: 00000000000862a6
P10:

Can I provide any more info?

@thomas-berg commented on GitHub (Jan 31, 2024): I encounter a Windows Terminal crash when trying to start Windows Terminal with Run as administrator. The UAC pops up with 'Unknown Program'. Windows Terminal launches normally when not starting with Run as administrator. icacls output: C:\WINDOWS\system32>icacls "c:\Program Files\WindowsApps" c:\Program Files\WindowsApps NT SERVICE\TrustedInstaller:(F) NT SERVICE\TrustedInstaller:(OI)(CI)(IO)(F) S-1-15-3-1024-3635283841-2530182609-996808640-1887759898-3848208603-3313616867-983405619-2501854204:(RX) S-1-15-3-1024-3635283841-2530182609-996808640-1887759898-3848208603-3313616867-983405619-2501854204:(OI)(CI)(IO)(GR,GE) NT AUTHORITY\SYSTEM:(F) NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) BUILTIN\Administrators:(CI)(RX) NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(RX) NT AUTHORITY\NETWORK SERVICE:(OI)(CI)(RX) NT AUTHORITY\RESTRICTED:(OI)(CI)(RX) BUILTIN\Users:(Rc,S,RD,REA,X,RA) Successfully processed 1 files; Failed processing 0 files Event logs: Faulting application name: WindowsTerminal.exe, version: 1.18.2311.14001, time stamp: 0x6553b19e Faulting module name: KERNELBASE.dll, version: 10.0.19041.1387, time stamp: 0x0b9a844a Exception code: 0xc000027b Fault offset: 0x000000000010b302 Faulting process ID: 0x2c64 Faulting application start time: 0x01da5424779c9f1c Faulting application path: C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.3181.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe Faulting module path: C:\WINDOWS\System32\KERNELBASE.dll Report ID: 1663eff1-8a3f-4d4d-bd23-addf6bd506b4 Faulting package full name: Microsoft.WindowsTerminal_1.18.3181.0_x64__8wekyb3d8bbwe Faulting package-relative application ID: App Fault bucket 1805946374774718074, type 5 Event Name: MoAppCrash Response: Not available Cab Id: 0 Problem signature: P1: Microsoft.WindowsTerminal_1.18.3181.0_x64__8wekyb3d8bbwe P2: praid:App P3: 1.18.2311.14001 P4: 6553b19e P5: combase.dll P6: 10.0.19041.1348 P7: baf10630 P8: 802b000a P9: 00000000000862a6 P10: Can I provide any more info?
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/terminal#12972