Windows Resource Protection prevents the replacement of critical system files, registry keys and folders.
[citation needed] Windows Resource Protection (WRP) works by registering for notification of file changes in Winlogon.
Permission for full access to modify WRP-protected resources is restricted to the processes using the Windows Modules Installer service (TrustedInstaller.exe).
Administrators no longer have full rights to system files; they have to use the SetupAPI or take ownership of the resource and add the appropriate Access Control Entries (ACEs) to modify or replace it.
WRP copies only those files that are needed to restart Windows to the cache directory located at %WinDir%\WinSxS\Backup.