Restore TrustedInstaller Ownership in Windows

This guide shows you how to restore file or folder ownership back to TrustedInstaller (the Windows module responsible for system updates and core system files) after you’ve taken ownership to modify or delete a protected item. You’ll need to be logged in as an administrator, and you should only do this for files that originally belonged to TrustedInstaller—changing ownership on other files can cause system instability.

What You’ll Need

• An administrator account on the Windows PC
• The exact file or folder path you changed ownership on
• Patience—the process involves several dialog boxes

Step-by-Step

1. Locate the file or folder in File Explorer. Right-click it and select Properties.
2. Go to the Security tab, then click the Advanced button at the bottom.
3. At the top of the Advanced Security Settings window, you’ll see the current owner (likely your username or Administrators). Click the Change link next to it.
4. In the Select User or Group dialog, type NT SERVICE\TrustedInstaller into the “Enter the object name to select” box. If that doesn’t work, click Advanced > Find Now, scroll down the list, and select NT SERVICE\TrustedInstaller manually.
5. Click OK to close the Select User or Group dialog. The owner field should now show TrustedInstaller.
6. Important: Check the box that says Replace owner on subcontainers and objects if you’re restoring a folder that contains subfolders or files. Leave it unchecked for a single file.
7. Click OK on the Advanced Security Settings window. Windows will apply the ownership change—this can take a few seconds for large folders.
8. Now you need to restore the original permissions. Go back to the Security tab of the Properties window and click Advanced again.
9. At the bottom of the window, click Restore Defaults. This resets the permission entries to what Windows originally assigned for TrustedInstaller.
10. Click OK, then OK again to close all dialogs. The file or folder is now owned by TrustedInstaller with its original permissions restored.

Common Mistakes

• Typing the wrong name: The exact string is NT SERVICE\TrustedInstaller. Omitting the NT SERVICE\ prefix or adding spaces will cause a “not found” error.
• Skipping the permissions reset: Changing ownership alone leaves the old permission entries (like your admin account with Full Control) in place. You must click Restore Defaults to remove those and bring back the original TrustedInstaller permissions.
• Applying to the wrong item: If you only changed ownership on a subfolder but you’re restoring a parent folder, the parent’s permissions may not match. Always restore ownership on the exact same path you originally modified.
• Forgetting to check “Replace owner”: For folders, if you don’t check this, the top folder gets TrustedInstaller but all children remain owned by your account.

Tips

• Write down the original owner before you change it. Right-click > Properties > Security > Advanced > Owner shows you who it was. If you took ownership from TrustedInstaller, this guide applies. If it was something else (like SYSTEM or Administrators), you’ll need to restore to that instead.
• Use the command line for speed: open Command Prompt as Administrator and run takeown /f "C:\full\path\to\file" /a to take ownership, then icacls "C:\full\path\to\file" /setowner "NT SERVICE\TrustedInstaller" to give it back. This is faster for multiple files.
• If you’re restoring a system file (like one in C:\Windows), do it immediately after your modification and before running Windows Update. Leaving system files with non-standard ownership can cause update failures.
• Reboot after restoring ownership to system files. This ensures any cached security tokens are cleared.

Troubleshooting

• “Unable to set new owner” error: This usually means you don’t have administrator privileges. Right-click the file, go to Properties > Security > Advanced > Change, and if the button is greyed out, you need to take ownership first as an admin. Alternatively, launch File Explorer with “Run as administrator” before starting.
• TrustedInstaller doesn’t appear in the search results: Click Advanced > Find Now in the Select User or Group dialog, then scroll down to NT SERVICE entries. If it’s still missing, type the full name manually and click Check Names—it should resolve.
• After restoring, you get “Access Denied” when opening the file: This is actually correct behavior—TrustedInstaller owns it, and regular users (including admins) can’t open it. That’s the point. If you need to access it again, you’ll have to take ownership temporarily.
• Windows Update fails after restoring: Run sfc /scannow in an elevated Command Prompt. If it finds corrupted files, it will attempt to repair them. If that doesn’t fix it, check that you restored ownership on all files you changed, not just the one you remember.
• Restore Defaults button is greyed out: This happens when the current owner isn’t an administrator. Go back to the owner step, set the owner to TrustedInstaller first, then the button should become active.

Frequently Asked Questions

Q: What exactly is TrustedInstaller?
TrustedInstaller (full name: Windows Modules Installer) is a built-in Windows service that owns core system files to prevent malware and even administrators from accidentally modifying them. It’s the default owner of most files in C:\Windows.

Q: Can I just skip restoring ownership?
You can, but it’s risky. If the file is a system component, Windows Update may fail to patch it, and antivirus software might flag your account’s ownership as suspicious. For non-system files, it’s less critical, but still good practice.

Q: Does this work on Windows 10 and Windows 11?
Yes, the process is identical on both. The Advanced Security Settings dialog has remained the same since Windows Vista.

Q: What if I took ownership of a folder but only want to restore one file inside it?
You can restore just that file by following the steps on the file itself. The parent folder’s ownership doesn’t need to match its children, though it’s cleaner to restore the whole tree.

Q: Is there a way to restore ownership without the GUI?
Yes. Open Command Prompt as Administrator and run: icacls "C:\path\to\file" /setowner "NT SERVICE\TrustedInstaller" then icacls "C:\path\to\file" /reset to reset permissions to inherited defaults.

Q: Why does TrustedInstaller show as “Unknown” in the owner list?
This is a display quirk. The account name is long and sometimes truncated. Clicking Change and typing the full name will still work. It’s not a sign of corruption.

Related

• Voice Control Windows 10: Full How-To Guide
• How to Pin Windows in Windows 10
• Install Edge Extensions on Android: Step-by-Step