Unable to write (or delete) files from Windows 11 protected folders

[somecomputing.com]

When attempting to sync specific subfolders in the C:\Program Files folder I get the following errors:
"Cannot write file "C:\Program Files\<Folder Name>\sync.ffs_db". ERROR_ACCESS_DENIED: Access is denied. [CreateFile]. This seems to be the correct response because files should not be able to be written to important system folders like C:\Program Files; although, FreeFileSync would have been able to write to this folder in order to get installed originally.

I do not want to backup all of the folders under C:\Program Files, only a few of them where the software developers stores changed configuration parameters, etc. in C:\Program Files instead of under the user's appdata folder. Therefore, the sync.ffs_db file needs to be written to the subfolder under C:\Program Files (which it is unable to do).

So, I'm looking for a solution that doesn't involve compromising Windows 11 permissions on these folder, but still backs up the folders I need to backup.

[somecomputing.com]

I found my own solution, which might help other people having various [Create Files] issues. I was able to bypass this error by opening FreeFileSync as administrators. As they say on Youtube or Facebook, "Easy!"

[John1234]

If you would rather be more secure instead of running the software as administrator just grant yourself The Limited permissions necessary to create a file in one folder.

[somecomputing.com]

I am definitely not inclined to change the system permissions on system folders in Windows. Opening FreeFileSync as administrator solves the problem. I would be curious to know your views on why changing the file permissions would be more secure.

[John1234]

Hi @somecomputing.com

When FreeFileSync runs elevated, it can modify anything the SYSTEM account can touch:

C:\Windows
C:\Program Files
Service directories
Driver folders
A misconfigured sync job or wrong-side copy can nuke files Windows depends on.

As yourself: Windows blocks most of these operations
As admin: Nothing stops it.

I am an administrator in IT for a global organization. I'm responsible for protecting corporate systems while also allowing people to do their jobs safely.

This is the same pattern used by sysadmins who sync into protected directories.

I did a little research and found a way for you to run an elevated free file sync job rather than running the entire app as administrator. This way the only files that can be touched are those specifically indicated in that elevated job.

Here is my research/notes on the subject:



Key Risks of Running FreeFileSync as Administrator

Running an elevated sync job using Freefilesync

Granting write permissions to a single system folder Windows 11

[somecomputing.com]

Hi John1234,
That is excellent information. Even though I am only synchronizing from right folders to backup folders on a different system, external drives, etc. I understand your (or the articles') caution on running FreeFileSync as administrator and I will not do that going forward (even though it worked marvelously). I think I'll use the method outlined in the "Granting write permissions to a single system folder Windows 11" method. It seems the simplest solution (KISS) for my purposes. I have bookmarked all of your links and will refer to them in the future. It is very good information and I thank you.

[John1234]

Hi @somecomputing.com

Glad to hear you found my research useful.

I've been programming and managing computers and networks since I was in high school and now in my 60s!

I rely on apps like Joplin and obsidian to collect and organize everything. I can publish my research to the web and then use the software to update and make changes as necessary going forward.

I volunteer tech support for several open source projects as a way of giving back to the free community.

Whenever I do research or figure out a solution I document and publish it. That way if somebody comes along 6 months or a year from now with a similar question I can refer back to the notes I've already published.

Chat gpt and most of the other AI engines output their data in a format called markdown.

Joplin and obsidian use markdown format as their standard note format so when I copy and paste output it looks very clean.

I think you made a very sensible and wise choice.

Take care.