Just a note to self, when typing in TrustedInstaller into security dialogs in Vista/Windows 2008, be sure to prefix with:

    NT SERVICE\TrustedInstaller

C:\Windows>icacls c:\windows\winsxs
c:\windows\winsxs

                  NT SERVICE\TrustedInstaller:(OI)(CI)(F)
                  BUILTIN\Administrators:(OI)(CI)(RX)
                  NT AUTHORITY\SYSTEM:(OI)(CI)(RX)
                  BUILTIN\Users:(OI)(CI)(RX)

 

The security UI dialogs do not recognize TrustedInstaller just by itself (don't know why).