How to Fix “This Access Control Entry is Corrupted” Error

When your Universal Windows or Microsoft Store Apps encounter certain issues, instructions on the internet may tell you to access this folder and make some changes. But it is not possible to go inside this folder by default due to restricted permissions.

Moreover, even when you check the security settings to change the permissions, you will see this error. In fact, it may not actually indicate an issue with the folder even though it comes out as an error message.

First, let’s take a look at why you see this message before going through what you can do to change the folder permissions.

What Does “Access Control Entry is Corrupt” Mean?

If you look at what this error message says, it shows that the ACL permissions of the folder do not have a stable configuration and are corrupt. But it may not actually be so.

By default, the WindowsApps folder only allows Read & Execute permissions for the “Users” user group, which includes all the user accounts on your computer. So, it’s impossible to change the contents of any files and folders inside this folder.

Normally, with Read permissions, you should be able to open the folder, but it also has a special permission condition, “Exists: WIN://SYSAPPID.” This condition makes it so that only processes that have the WIN://SYSAPPID attribute can read and execute the contents of this folder.

The Developers can only add such conditions using security description codes while programming. Moreover, the current command-line interfaces and graphical methods don’t fully support manipulating such conditions.

So, the User group’s Permission Entry window for this folder shows the error “This access control entry is corrupt. Delete it and create a new one” even when the entry does not have any issues.

How to Change Permissions When You Get This Error?

The Access Control List (ACL) in the NTFS file system of Windows introduces two levels of security for files and folders. One is the current owner and another is the user access permissions. 

Only the owner can change the permission settings. So you need to make the Users account, which also includes your current account the owner of the folder first.

However, doing so actually compromises the security of your system as the default ACL settings are there to prevent undesirable access to the folder contents. So, you should revert any permission and ownership changes you make as soon as possible. But it is not that important if the folder showing this error is a user-level folder (non-system) that doesn’t contain vital data.

Here, we only consider the WindowsApps folder with the default owner TrustedInstaller while providing the steps. If you are experiencing this issue in any other folder, replace the folder and the current owner appropriately.

1. First, log in with an admin account.
2. Then close all the Microsoft Store apps from Task Manager.
   • Press Ctrl + Shift + Esc to open the Task Manager.
   • Look for any store applications under Apps or Background Processes.
   • Select them and click End Task.
     
3. Open the File Explorer and go to C:\Program Files
4. Right-click on the WindowsApps folder and select Properties.
5. Go to the Security tab and click Advanced.
   
6. Click on Continue.
   
7. Select Change next to Owner: TrustedInstaller.
   
8. Type Users and then click Check Names> OK.
   
9. Check Replace owners on subcontainers and objects.
10. Click Apply and then OK.
    
11. Close the Properties and open it again.
12. Go to Security > Advanced.
    
13. Click on Add and then Select a principal.
    
14. Go to Advanced and choose Find Now.
15. Here, look for your user account, not the Users group, and select it.
    
16. Click OK > OK.
17. Check Full control and click OK > OK > OK.
    

Now make all the changes that you wished to make in the first place inside this folder. After doing so and confirming that these changes resolved the original issue, you need to revert back the modifications to the permission and owner.

1. Open WindowsApp’s Properties and go to the Security tab.
2. Click on Advanced.
3. Select your user account that you added earlier and click Remove and then Apply.
4. Select Change next to Owner.
5. Type NT Service\TrustedInstaller and click on Check Names. The NT Service\TrustedInstaller should change to an underlined TrustedInstaller.
   
6. Click OK.
7. Check Replace owners on subcontainers and objects and click Apply.
8. Keep clicking OK to close Properties while applying the changes.