diff --git a/certbot/compat/filesystem.py b/certbot/compat/filesystem.py
index 45aa80277..0ce010f70 100644
--- a/certbot/compat/filesystem.py
+++ b/certbot/compat/filesystem.py
@@ -119,7 +119,10 @@ def _generate_windows_flags(rights_desc):
         flag = flag | (ntsecuritycon.FILE_ALL_ACCESS
                        ^ ntsecuritycon.FILE_GENERIC_READ
                        ^ ntsecuritycon.FILE_GENERIC_EXECUTE
-                       ^ 512)  # This bit is never set with file/directory objects
+                       # Following bit is never set for file/directory objects using the
+                       # ntsecuritycon.FILE_* flags, but is effectively present when
+                       # the "Full Permissions" are applied from Windows UI.
+                       ^ 512)
     if rights_desc['execute']:
         flag = flag | ntsecuritycon.FILE_GENERIC_EXECUTE