To fix this issue, install security update CVE-2017-0295 | Windows Default Folder Tampering Vulnerability.
This update partially fixes this issue by correcting the permissions on the Startup folder (C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup).
The CVE bulletin describes this fix:
“The security update addresses the vulnerability by correcting permissions on folders inside the DEFAULT folder structure.”
However, after the update is installed, the other folders inside C:\Windows\Default retain the incorrect permissions.
If necessary, use one of the following two (2) workarounds to manually correct the other permissions.
Important
You must run the resolution steps and workaround steps (if you use them) on all affected computers. To manage these permissions, consider following these steps:
- Update your base Windows 10 Version 1607 images, and remove the permissions from the base image so that all future installations of Windows 10 don't have the permissions.
- Push the permissions changes to the computers that already have Windows 10 Version 1607 deployed, by using Group Policy, Scripting, or another Automation solution.
For more information, see the "Configuring Permissions for a File System Directory" section of the Step-by-Step Guide to Using the Security Configuration Tool Set.
Remove the permissions for the BUILTIN\Users group
Removing the permissions for the BUILTIN\Users group prevents users who have minimal permissions from gaining access to objects in this folder. To remove the current permissions for BUILTIN\Users on the Default folder, open a Command Prompt window and run the following command:
icacls C:\Users\Default /Q /C /T /remove:g BUILTIN\Users
After you run this command, children of C:\Users\Default inherit the appropriate permissions.
Replace the permissions for the BUILTIN\Users group
This approach removes the permissions for the BUILTIN\Users group, and then sets new read-only permissions.The command first sets the permissions for BUILTIN\Users to read-only. To remove the permissions, open a Command Prompt window and run the following commands:
icacls C:\Users\Default /Q /C /T /remove:g BUILTIN\Users
icacls C:\Users\Default /Q /C /T /grant:r BUILTIN\Users:r
After you run these commands, children of C:\Users\Default inherit the appropriate permissions. This approach sets the permissions to those used in newer operating systems, and users can read the folder contents.