The case of… breaking the WinSXS folder security rights

Just had this problem the other day when having to re-install Microsoft SQL Server 2008 R2 Express (x64) on a Windows 7  SP1 (x64), the setup was failing with the error message:

Microsoft SQL Server 2008 R2 Setup
----------------------------------
An error occurred during the installation of assembly
'Microsoft.VC80.CRT,version="8.0.50727.42",type="win32",processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b"'.
Please refer to Help and Support for more information. 

Searching the web for similar it appeared to be failing at installing Microsoft Visual C++ 2005 Redistributable package. Downloading and running the package on its own was showing the same error. After spending a lot of time digging through similar problems on the web with suggested solutions ranging from removing the *vc80* files from %WINDIR%\WinSxS and re-installing the affected packages to running the System Update Readiness Tool for Windows 7, nothing seemed to fix it. Trying a few things myself, bringing some of the related files over from a similar working system (ATL, MFC etc) into %WINDIR%\WinSxS, without much luck; taking traces with ProcMon watching for missing files, nothing.

All until almost giving up, I thought it might be a permission issue – I did remember playing with WinSxX folder recently on that system (more about it below) so filtering again with ProcMon for msiexec.exe and ACCESS DENIED results, revealed this:

msiexec.exe running under SYSTEM account was denied access to %WINDIR%\WinSxS\InstallTemp! Comparing the security for that folder to a similar working system showed that SYSTEM requires full rights there. Manually fixing the rights on that folder the installer has worked fine once again, problem solved.

* * *

Now, to the not so pleasant part where it shows that all this was due to my own stupidity, and hopefully a meaningful lesson for others.

This was a VM with a somewhat limited amount of space and was trying to compress a few larger folders found with WinDirStat (tip: hide Treemap and File types from Options menu, you don’t need them), one of them being %WINDIR%\WinSxS. You can find a lot of forum posts where people complain about it growing to take a lot of space, and other people telling you to stay away from it. In my case, the folder was about 12.5 GB and compressing it reduced it down to ~8 GB, saving quite a bit of space.

How did I do it? TrustedInstaller is the owner of the folder and a local Administrator won’t have the rights to compress – trying to compress it will give you a lot of Access Denied errors and if you ignore them all it won't compress anything. So I came up with these steps:

• take ownership of the WinSxS folder in Windows Explorer > Properties > Security tab;
• add my user with full rights and propagate the rights to the child objects;
• compress folder (Windows Explorer > Properties > General > Advanced);
• remove my user from the security list;
• give ownership back to TrustedInstaller (NT Service\TrustedInstaller).

In short this is what happened – normally SYSTEM account has only read/list rights on the WinSxS folder, but on WinSxS\InstallerTemp it has full rights (not inherited). When adding my user and propagating the rights to subfolders, it changed those full rights to read only, making the module installer fail later.

The lesson I guess is, if you are not prepared to pay the price, stay away from that folder. Or maybe otherwise be persistent and experiment to understand what’s going on, but that might take a lot of time and effort, with sometimes very little gain - 4 GB of disk space for almost a day of frustrating trial & error.