TrustedInstaller
Just a note to self, when typing in TrustedInstaller into security dialogs in Vista/Windows 2008, be sure to prefix with:
NT SERVICE\TrustedInstaller
C:\Windows>icacls c:\windows\winsxs
c:\windows\winsxs
NT SERVICE\TrustedInstaller:(OI)(CI)(F)
BUILTIN\Administrators:(OI)(CI)(RX)
NT AUTHORITY\SYSTEM:(OI)(CI)(RX)
BUILTIN\Users:(OI)(CI)(RX)
The security UI dialogs do not recognize TrustedInstaller just by itself (don't know why).