/PROTECTED
       /NOPROTECTED (default)

    Installs the file as a known image that is protected from
    user-mode and supervisor-mode write access. You can write into
    the image only from executive or kernel mode. The /PROTECTED
    qualifier together with the /SHARE qualifier are used to
    implement user-written services, which become privileged
    shareable images.