If it is that simple to reproduce, why not try running Process Monitor as I suggested some days ago? If you filter on just this exact folder name it will record all filesystem operations on the folder. You can then see if Rex is right and all the API calls by TCC are identical. If so, and if no other process touches the folder itself, then you will have proved it is a Windows bug. And if you see a 'set attributes' call by some other process, you will have found the culprit. Process Monitor can be daunting if you let it rip on everything, but with a single specific target it will just show you what touches that target.