Oh, sorry: it needs to map the file for execution. That is the missing permission.

I can run it directly ... not the same?

Please re-read the part about how CreateProcess works to understand why you can "run it directly."

Do you mean it's using the app alias even when I give the fully-qualified name on a command line? Here, if I execute "WT" (TCC or Win+R) I get d:\wt\windowsterminal.exe.

Right now I have the store version, unzips of 1.21, 1.24, 1.25, and a canary version. I'm trying to figure out an unfortunate behavior where output slows down (but only for the first few chars/lines). I'll be back if I can't do anything about it.

I'm only talking about the store version, because it seemed like you were only talking about the store version, when you asked "Why does GetBinaryType() fail (ERROR_ACCESS_DENIED) on the store WindowsTerminal.exe" (emphasis mine).

If you try to execute the store-installed version of WindowsTerminal.exe from the WindowsApps directory or any symlink to that executable, CreateProcess internally fails with ERROR_ACCESS_DENIED and this triggers an internal retry after looking up which package identity is required to run it.

The ACL specifies this DACL:

D:AI(XA;ID;0x1200a9;;;BU;(WIN://SYSAPPID Contains "Microsoft.WindowsTerminal_8wekyb3d8bbwe"))

• AI - inherited
• XA - Execute Allow
• ID - inherited (also)
• 0x1200a9 - access rights
• BU - BUILTIN\Users group
• resource attribute WIN://SYSAPPID contains our package name

and this:

(A;ID;FR;;;BU)

which is BU (BUILTIN\Users) and FR (file read) with no execute bit.

Users are not allowed to execute it.

CreateProcess fails, and then sets WIN://SYSAPPID to the package and tries to re-execute it.