Hello LAM SHIU,
To resolve this immediately across your enterprise without touching every user profile, the most robust engineering solution is to disable the MSI Rollback feature via Group Policy or Registry. Since the application is already successfully installed and this is merely a user-level self-healing event, the rollback functionality is redundant and causing the failure. Open the Registry Editor on your golden image or push this via GPO: navigate to HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer. If the Installer key does not exist, create it. Inside, create a new DWORD (32-bit) Value named DisableRollback and set its value to 1. This directive forces the Windows Installer service to skip creating the problematic .rbf files in D:\Config.Msi entirely, thereby bypassing the security descriptor failure.
If your security policy strictly forbids disabling rollback globally, you must manually pre-create the D:\Config.Msi folder and strictly enforce the ownership and attributes that the MSI service expects, though this is less reliable. You would need to ensure the folder is hidden and identified as a system folder (attrib +h +s D:\Config.Msi), set the Owner to the Administrators group (not the user), and ensure CREATOR OWNER has Full Control in the Advanced Security settings. However, given the "Could not set file security" error, the DisableRollback registry modification is the definitive fix for 21H2 LTSC environments utilizing ProfilesDirectory redirection.
I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!
VP