Three Questions for Each Record
| Question | What to check |
|---|---|
| Which file? | The original local EXE and its file identity, not just its display name. |
| Which account? | The Windows account using the manager. Other accounts are outside that restriction. |
| Which state? | The actual inspected permissions, including any changes made elsewhere. |
What Remains Unchanged
The manager does not rewrite the executable or its embedded Authenticode signature. It changes NTFS access permissions. Closing the manager leaves Windows enforcing those permissions; no continuous monitoring service is required.
Where the Boundary Ends
A local administrator can alter Windows security settings. The lock does not encrypt app data, restrict another copy or guarantee that every route into an application is covered. It is not the equivalent of organization-wide application-control rules or a separate user account.
Files That Are Refused
The safety checks can reject system and security software, the manager’s own files and recovery locations, network storage, reparse points, hard links and unsuitable permissions. Administrative elevation can help with ordinary access rights to some installation folders, but it does not make an unsuitable target safe.
When the Observed State Changes
A moved, replaced or externally modified file needs a fresh review. Refresh the list, keep recovery information and read the exact result. Do not use a stale record as permission to overwrite security settings on a different file.