diff --git a/DW2Net6Win/Isolation/Windows.cs b/DW2Net6Win/Isolation/Windows.cs
index ce99e3c..8826c5e 100644
--- a/DW2Net6Win/Isolation/Windows.cs
+++ b/DW2Net6Win/Isolation/Windows.cs
@@ -234,12 +234,51 @@ private static void AllowFileAccess(AppContainerProfile container, string path,
                 }
             }
 
-            foreach (var file in Directory.EnumerateFiles(path, "*", SearchOption.TopDirectoryOnly))
+            foreach (var directory in Directory.EnumerateDirectories(path, "*", SearchOption.AllDirectories))
+            {
+                var di = new DirectoryInfo(directory);
+                var fs = di.GetAccessControl(AccessControlSections.Access);
+                if (!fs.AreAccessRulesProtected) continue;
+
+                var existing2 = fs.GetAccessRules(true, false, typeof(SecurityIdentifier))
+                    .Cast<FileSystemAccessRule>()
+                    .ToArray();
+                foreach (var rule in existing2)
+                {
+                    if (rule.FileSystemRights == dirRights && rule.IdentityReference == sid)
+                    {
+                        fs.RemoveAccessRule(rule);
+                    }
+                }
+
+                fs.SetAccessRuleProtection(false, false);
+                try
+                {
+                    di.SetAccessControl(fs);
+                }
+                catch (Exception ex)
+                {
+                    throw new SecurityException($"Unable to apply AppContainer restrictions to {directory}", ex);
+                }
+            }
+
+            foreach (var file in Directory.EnumerateFiles(path, "*", SearchOption.AllDirectories))
             {
                 var fi = new FileInfo(file);
                 var fs = fi.GetAccessControl(AccessControlSections.Access);
                 if (!fs.AreAccessRulesProtected) continue;
-                fs.PurgeAccessRules(sid);
+
+                var existing2 = fs.GetAccessRules(true, false, typeof(SecurityIdentifier))
+                    .Cast<FileSystemAccessRule>()
+                    .ToArray();
+                foreach (var rule in existing2)
+                {
+                    if(rule.FileSystemRights == dirRights && rule.IdentityReference == sid)
+                    {
+                        fs.RemoveAccessRule(rule);
+                    }
+                }
+
                 fs.SetAccessRuleProtection(false, false);
                 try
                 {