Solved How to return a local drive C:\ to "TrustedInstaller" as Owner

Hello, I need advice

I have been attacked by a ransomware and being desperate I have changed the owner by default of the local disk C: to my local user,

selecting right click properties on local drive C: with file explorer,
Properties > Security > Advanced > Change

before I had TrustedInstaller in C: and now once the folder and file renaming problem has been solved,
I don't know how to switch back to TrustedInstaller,

I ask for advice to know if it is possible to leave it like this with my local user account or change to TrustedInstaller again,

tell me how I should act to change to TrustedInstaller or it is not necessary,

whether TrustedInstaller is important for system security or is indifferent,

Windows 11 Home 22H2 22621.1413 x64

Thank you very much in advance
Ricard

Have you taken a backup of your system lately? Any chance you can save any updated files, revert to your backup and put your new files back??

pparks1 said:

Have you taken a backup of your system lately? Any chance you can save any updated files, revert to your backup and put your new files back??

Click to expand...

Yes, I had a restore point created before I changed Owner to the local drive C:\
and that saved my life, the system worked fine again,

but the Owner is still Local User,
no longer TrustedInstaller on local drive C:\ as it was originally

I don't know if this is important, return it to TrustedInstaller,
I await your advice and procedure,
in case of security vulnerability or system instability

Ricard301 said:

I don't know if this is important, return it to TrustedInstaller

Click to expand...

I would return it to TrustedInstaller, mainly for stability reasons.





Scroll down to this paragraph... Restore TrustedInstaller as the Owner of a File, Folder, or Registry Key
...and just follow the directions.




This is the same method, but may be simpler...

Ghot said:

I would return it to TrustedInstaller, mainly for stability reasons.

How to Restore the Owner of a File, Folder, or Registry Key to TrustedInstaller on Windows

If you've taken ownership of a protected file, folder, or registry key, you should change it back to the default TrustedInstaller owner after making changes.

www.groovypost.com

Scroll down to this paragraph... Restore TrustedInstaller as the Owner of a File, Folder, or Registry Key
...and just follow the directions.




This is the same method, but may be simpler...

Restore TrustedInstaller as Owner and its Permissions to default in Windows 11/10

Did you change system file permissions? Use this guide to restore TrustedInstaller as the default owner & set all file/folder permissions to default.

www.thewindowsclub.com

Click to expand...

I'm going to explore the thread to follow the procedure of returning C:\ drive to TrustedInstaller, I hope I'm lucky, I'll leave my results in a comment

Reading this brings up a question for me. IMO, If he returns the entire C drive back to trusted installer, he will not have access to any of his own files afterward because trusted installer will have ownership thereby preventing this user from accessing them.

He's going to run into permission problems big time.

glasskuter said:

Reading this brings up a question for me. IMO, If he returns the entire C drive back to trusted installer, he will not have access to any of his own files afterward because trusted installer will have ownership thereby preventing this user from accessing them.

He's going to run into permission problems big time.

Click to expand...

By default, TurstedInstaller already has ownership of the C:\ drive.
Ownership and permissions are not the same things.


Right click your C:\ drive and select Properties > Security... and in the top window select Users (XXXX\Users), and then Administrators (XXXX\Administrators), and you'll see they have their own permissions aside from the ones TrustedInstaller has. And that's while SYSTEM already has full control.

Like.... by default, SYSTEM "owns" the C:\Users folder, even though the Users can do "almost" anything they want.
But if SYSTEM wants to do A and the User wants to do not-A... SYSTEM will win the argument.
Then, if the User still wants to do not-A, despite what SYSTEM says, they have to take ownership of the folder in question.

That's about as far as I've "bothered" to understand it.



It's like a parent with 4 kids, who's going to visit the neighbors.
They tell the oldest...
Ok you're in charge, let them do what they want... but don't let them kill each other or burn the house down.
Then they tell the others... OK you can do what you want, etc., but overall, you listen to your older brother.

With permissions, I think MS is trying to cover all bases, just like the fictitious parent in the example.

hi
I have tried everything and the conclusion is to reinstall the OS from scratch,
now everything works like factory
It is very important not to forget to take note of the windows key before formatting the entire disk,
thanks for answering
problem solved!

Ricard301 said:

hi
I have tried everything and the conclusion is to reinstall the OS from scratch,
now everything works like factory
It is very important not to forget to take note of the windows key before formatting the entire disk,
thanks for answering
problem solved!

Click to expand...

Good that you're sorted. Personally I would have tried a repair install first. You don't need the Windows key for a fresh install as it's embedded in the motherboard but making a note of it won't hurt if it's the correct one.

Fabler2 said:

Good that you're sorted. Personally I would have tried a repair install first. You don't need the Windows key for a fresh install as it's embedded in the motherboard but making a note of it won't hurt if it's the correct one.

Click to expand...

I tried:
-. a previous restore point
-. a PC reset from configuration
-. some commands from CMD like: sfc /scannow
-. and others

and the only solution for me is to reinstall from scratch,
previously saving the most important data on local disk,

you are right, the windows key is activated automatically
It is not essential to take note, it is true,

ok, a happy ending for a structural problem
thanks for helping

Fabler2 said:

Good that you're sorted. Personally I would have tried a repair install first. You don't need the Windows key for a fresh install as it's embedded in the motherboard but making a note of it won't hurt if it's the correct one.

Click to expand...

I once did similar (stupidly error), and a repair upgrade did not sort it. However, I agree it is worth trying before nuking things.

You often find people mess around with permissions to delete files or add file, the trusted installer will refuse to allow.

I just boot from Macrium Reflect into WinPE mode, and do these outside of windows.

You did the right thing. I would never have attempted to salvage it in the first place. My opinion is and has always been, if one is infected with true ransomware, cut your losses and wipe that sucker clean ASAP. I never attach such infected systems to my network either as the sophisticated ransomwares can get into every device on a network and lay in wait to attack those computers as well at some time in the future..
This is why we preach the importance of keeping recent images on hand (NOT RESTORE POINTS) and having these images separate from your computer.