I'll also assume JBoss installs its services as SYSTEM, instead of creating limited-permission accounts. Microsoft historically hasn't done a good job of makin

I'll also assume JBoss installs its services as SYSTEM, instead of creating limited-permission accounts. Microsoft historically hasn't done a good job of making it easy (and the default) to set things up this way though they take it a lot more seriously now. NTFS supports permission execute on ACLs and the system enforces them. I wish they had made a policy decision to default that to off and require you re-auth with admin credentials to set the bit. It would work more like +x/chmod/sudo does and prevent a decent number of such things.