Windows 10: Why Does CBS.log Say Directory Is Owned Twice or Has Its Security Set Twice?

Question

On my system, C:\Windows\Logs\CBS\CBS.log contains these lines:

2019-10-08 02:00:48, Info                  CSI    0000008e Warning: Overlap: Directory \??\C:\WINDOWS\System32\drivers\en-US\ is owned twice or has its security set twice
   Original owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.18362.1, arch amd64, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
   New owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.18362.1, arch amd64, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}

These lines are puzzling because the owner seems to be the same in both cases. I assume the owner specified in these lines is longspeak for TrustedInstaller, which is the owner specified at File Explorer > right-click on that directory (i.e., C:\WINDOWS\System32\drivers\en-US) > Properties > Security tab > Advanced. I've added an image of that Advanced dialog (below).

My question is why CBS.log says this. Ideally, the answer will point toward a way to fix it.

Answer 1

I haven't a clue how these files get owned multiple times, but it is a common occurrence after a Windows Update.

SFC /SCANNOW generally repairs the security descriptors that were changed during the last update causing the warning. Here's log of the command I just did to repair the issue.

Had this NOT worked to fix the issue, DISM is the next step. If you have upgraded from one version of Windows to another, e.g., 20H1 to 21H2, you will at some point need to download the latest standalone installer to use with DISM because you need the install files to rebuild the corrupt files on your boot disk. Done right, this is not a reinstall, but a refresh of what is already there - google the process - it isn't easy, but it also isn't very hard.

> C:\WINDOWS\system32>sfc /scannow
> 
> Beginning system scan.  This process will take some time.
> 
> Beginning verification phase of system scan. Verification 100%
> complete.
> 
> Windows Resource Protection found corrupt files and successfully
> repaired them. For online repairs, details are included in the CBS log
> file located at windir\Logs\CBS\CBS.log. For example
> C:\Windows\Logs\CBS\CBS.log. For offline repairs, details are included
> in the log file provided by the /OFFLOGFILE flag.

Answer 2

Update for Windows 10, version 20H2, build 19042.746

In the CBS log, SFC shows the owned twice... warning for the following directories:

• C:\WINDOWS\System32\drivers\en-US\
• C:\WINDOWS\System32\wbem\en-US\ C:\WINDOWS\help\mui\0409\
• C:\ProgramData\Microsoft\Windows\Start Menu\
• C:\ProgramData\Microsoft\Windows\Start Menu\Programs\
• C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
• C:\WINDOWS\SysWOW64\drivers\en-US\ C:\WINDOWS\SysWOW64\wbem\en-US\
• C:\WINDOWS\help\mui\0409\ C:\Program Files (x86)\
• C:\ProgramData\Microsoft\Windows\Start Menu\
• C:\ProgramData\Microsoft\Windows\Start Menu\Programs\
• C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\

These can be safely ignored as SFC reports the final result of the scan as 'no integrity violations found'.