The process of replacing ehres.dll required me to take ownership of the bad file and its folder and give myself full permissions. After the file copy I was able to back off my user permissions, and then restore ownership to TrustedInstaller.
Convoluted but it worked.
For the manifest file I can restore ownership of file & folder to TrustedInstaller (it show an error but still works), and I can back off my permissions on the folder, but not on the file itself.
What differs is that ehres.dll had its own folder, but the manifests all share a common folder C:\Windows\winsxs\Manifests. Also I see that afterwards the group/user
names for the new file all have inherited properties, but the other manifest files all show <not inherited> for group/user properties.
Probably not a big deal, but is there an easy way to fix this?