Posted on by lallouslab

Resetting NTFS files security and permission in Windows

UPDATE:

I have released a new graphical user interface utility to reset the files permissions.

Try it out!

I was running Vista with two NTFS partitions (C: and D:), then formatted C: partition and installed Windows 7. The second partition (D:) had some files security set on files and folders.

After Windows 7 was installed, some files on drive D: were not accessible anymore and I was getting “Access Denied”. I tried to right-click/properties on the folders that were not accessible and changed their owner and changed permissions but still some folders were still inaccessible not matter what I did.

After some research, it turned out the tool “cacls” that allows one to display or change ACLs (access control lists) can help to reset ACLs. In Windows 7 it is called “icalcs”.

To reset files permissions, follow these easy 3 steps:

Step 1: Run “cmd” as Administrator.

Note: In MS Windows 8 and above, press the Win+X keys, then choose “Command Prompt (Admin)”.

Step 2: Go to the drive or folder in question, for example:

CD /D D:

Step 3: To reset all the files permissions, type:

icacls * /T /Q /C /RESET

That’s it! After that, the files permissions were reset and I could access them back again.

Very Important note:

Step 3 is irreversible. Make sure you backup the permissions before you proceed!

It is possible that “icacls” might fail. For that try to take ownership of the files first. Just before Step (3), please type the following command:

takeown /R /F *

flower separator

Download the graphical utility instead!

flower separator
batchography-good-resDo you want to master Batch Files programming? Look no further, the Batchography is the right book for you.

Available in print or e-book editions from Amazon.
flower separator

You might also like:

154 Replies to “Resetting NTFS files security and permission in Windows”

    1. Before running this command, do the following:

      1. Right click on the folder in question then choose Properties
      2. Select the Security tab.
      3. Click the Advanced button.
      4. Select the Owner tab.
      5. Click Edit
      6. Select your user name and check the box marked Replace owner on subcontainers and objects.
      7. Click OK

      Now you should be able to run the command mentioned in this article successfully.

      Reply

      2. Dude! Awesome! This is what finally worked for me. I have spent hours over days trying to fix this and only by doing your method did it work for me. Gracias…

      3. yes!! it finally worked after hours of web searching. that was immensely helpful and did the trick. thank you!

      8. I had this problem with a client’s Vista laptop hard drive that would not boot at all and had no restore point to recover from. None of the usual tricks to make Windows work again would coax it back to boot – even in safe mode. Curiously, the hard drive itself passed ALL diagnostics with Linux tools such as Parted Magic and Knoppix as being a happy home for data. It’s purely a Windows thing.

        After losing most of the rest of my very short hair and somewhat sane mind, I did a lot of research on forums such as this and found a trick that worked. Boot into safe mode and the drive is accessible. None of the dreaded Access is Denied foolishness. (Of note, the drive is mounted in a USB to SATA external enclosure.) Files can easily be copied to a flash drive or even the primary hard drive Windows has booted from.

        Here’s something to note. If the volume is not accessible in regular Windows mode but has a drive letter, try to use a system level tool such as antivirus app, malware bytes, etc. and see if it will scan it. If it will, you’ll be able to see the files listed as the tool does its thing.

        If you don’t fancy using Safe Mode to access the volume, it is possible to right click on the drive letter, choose Properites, then the Tools tab and use Windows Backup to backup selected folders to another drive. Then reverse the process and restore the backup to a different destination. It’s time consuming to do it this way and requires a little more know how and careful attention than booting into safe mode, but it does work.

        Hope this helps save someone.

        By the way, the Takeown command “worked” in that it granted access to every file and folder on the stubborn drive, but it didn’t help because the Access is Denied message wouldn’t permit the drive to be mounted in the first place.

      10. Even when I go to change the ownership of the objects thru Properties> Advance> Security option, it says ‘Access Denied’ (even when mine is a fully admin account).

        I’m unable to take ownership or change permissions to main windows folders in C drive.

  3. Likewise, even running from safe mode cmd prompt as administrator I got access denied on all files and folders even though I know I’m owner with full permissions on many of the folders I tried. Any thoughts?

    Reply

  7. Hey I just wanna say thanks a lot for this fix it helped me after I tried to restrict access to the Guest account and messed up the permissions. This system is so convoluted!

    Reply

  8. Likewise, even running from safe mode cmd prompt as administrator I got access denied on all files and folders even though I know I’m owner with full permissions on many of the folders I tried

    Reply

  9. I want to change the permissions on the users folder in windows 7 back to the defualts. When I try this however, it gives access denied and also that “the system cannot find the path specified”. I am the owner and have administrator rights.

    I have played around with the permissions and think I messed something up. Now my backup program, syncback, runs into the infinite application data loop on the defualt folder in the users folder.

    Reply

  10. thanks alot for this. its been a week ive had problem with my flash drive and even no one responded to my problem at MSFN.org forum. until i came across this tutorial.
    thank you

    Reply

  14. Thanks for this remarkable command. Everyone should bookmark this page and copy the command. I just got back my Outlook 2007! It started goofing off after a backup recovery. These are my files, it’s ridiculous.

    Reply

  17. Thanks very much for this post.
    To make this work, I had to boot into recovery mode by pressing F8 after the BIOS screen. It wouldn’t work inside Windows. B also made a system image of my hard drive, in case Windows stopped working.
    Like “GCG”, I had tried to restrict access to my files from the Guest account (not that I had anything to hide). Although I still could access the files, my virus scanner didn’t scan them, saying “Locked file. Not tested”, so I wanted to reset the permissions. Now I have resetted them and the virus scanner is now able to scan them.
    Once again, thanks very much.

    Reply

  26. Thank you !!!!
    thanks a lot.. you just saved my precious memories of last 5 years…

    god bless you !!

    Reply

  28. install things as standard user… the app cant write to the programs folder :/
    install things as admin… app works
    re-log into standard user and no access to the app
    re-log into admin and give permisions..
    re-log into standard user user runn app… works for a bit
    the app trys to update or makes update and now updated parts are inaccessable to standard user :/

    give ownership of intire drive to everyone and everything works…

    sucks that windodos attempted to use linux/gnu security and search styles and didnt get it right…

    Reply

  30. Okay, I’m stumped.

    1. Run “cmd” as Administrator

    — This is fine.

    2. Go to the drive or folder in question, for example:
    CD /D D:

    — This is done. The folder is open.

    3. To reset all the files permissions, type: icacls * /T /Q /C /RESET

    — This is where I’m having a problem. I want to change permissions on My Music, My Pictures, and My Documents on my OS hard drive. Apparantly, I’m not seeing the correlation between the folder in question and the command prompt to use. Can someone clarify this for me, since I fail at command prompting?

    Reply

      1. Argh!!! Apparantly, dealing with mortgages all day every day has made me stupid. Do I do it one folder at a time? If so, can you show the actual command as I need to type it (with the icacls etc.) for My Music? I promise I’m normally smarter than this and swear on my Bible that I will (endeavor) to get it this time.

    2. @xfphile: if you’re still having issues, simply download the .BAT file I created, put in whatever folder you wish to have modified, then run it ‘as administrator’.

      So, you’d put the file inside each of the three folders you listed and run them. Depending on how large each of those folders are, it could take a few seconds up to a few hours. I’ve had icacls running in my 1TB drive for about an hour now.

      My 1TB has been REALLY acting up after plugging it into Win7. Copying the locked folders takes about 4 hours for 200GB on USB 3.0. Why? Couldn’t tell ya. I also have no idea how or why Win7 locked my iPod and deleted all my music from it. The music is still on my HDD, but I can’t access my pod via iTunes. It says I need to restore it. However, I’m in Iraq (going back to the States soon, WOOHOO!) and the internet here SUCKS. The firmware required to restore the iPod is just over 1GB… it would literally takes weeks to download on this connection.

      Anyway, I hope you resolved your issue, and if not, give the .BAT I made a try 😉

      Best Regards,

      Sean Reeves
      SPC, USA
      Armorer NCO

      Reply

      1. Oh, forgot to mention that the .BAT is available from the link in my comment below. Haha, wouldn’t want you to get all discouraged since I didn’t leave the link in this comment.

  31. I am attempting to do this to a 1TB drive at the moment, I certainly hope it works. The (external) drive will allow me to copy the files with proper permissions, but shortly thereafter, the newly created files will be locked as well.

    I have created a .BAT file that automatically does this process. If you don’t trust it, simply right-click the .BAT and select ‘Edit’ and you will see that aside of text, only the code from this article is used. The file can be downloaded from http://www.enoctis.net/shared/Win7_File-Permissions.zip

    Note that the above URL isn’t supposed to have any spaces, just in case WordPress decides to throw any in there.

    Hope this helps! And even more so, I hope the code helps me–I am SICK of this permission crap.

    Best Regards,

    Sean Reeves

    Reply

    1. Download the .BAT that I created to do this for you. All you do is place the .BAT in the directory that you wish to reset, then run it as an administrator. You can download it from my site: http://www.enoctis.net/shared/Win7_File-Permissions.zip

      If you don’t trust me, that’s OK–I understand. Simply right-click on the file and select ‘Edit’ which will allow you to see the code. @echo means show text, @echo off means don’t show text… aside of the text I added, a couple of CLS (clear screen) calls and pauses, it’s only the code from this article. It works great!

      Best Regards,

      Sean Reeves

      Reply

  34. By the way, I used this for the ‘You do not have permission to access…’ error that is common on Win7 when opening files from XP/Vista. I can’t tell you how long it took because I went to sleep, but it was done when I awakened. I know it took longer than an hour on my 1TB external USB 3.0 drive.

    Again folks, if you’re having problems, use the .BAT file I made. You can’t go wrong!

    http://www.enoctis.net/shared/Win7_File-Permissions.zip

    I used it last night and my woes are gone. By the way, in the .BAT file I cited this blog since it’s where I got the method; hope you don’t mind.

    Reply

  36. Note to everyone, I’ve been informed by Microsoft that icalcs shouldn’t be used on the drive with the OS. I am still awaiting clarification about whether it’s not to be ran on the drive with the OS (at all) or simply not in system folders or directories containing system folders.

    I’ll post back whenever I obtain this information.

    Reply

  37. It’s a sad day for me. Logging on to my Win 7 system, I found I had no task bar icons, no desktop icons and no files in my start folders. Definitely not good!! Upon investigation, I found that the files and objects were there but hidden, and found that I could not unhide them. After many hours of attempted to repair, I chose to rebuild my system. In order to save my data, since I am the only user on this desktop I bought a new 1TB drive, formatted and partitioned it, and “rolled” off all my data to the new HDD.

    My problem is all the data on the new drive is in the same state, read only and hidden.

    Since we are talking about 100,000 files, mostly images, docx and xls files, is there a way, using takeown and icals to set these files back to “factory” ownership and permissions. Is it as simple as:

    icacls * /T /Q /C /RESET

    but what ARE those permissions and who would the owner be.
    Also what are the “standard” security characteristics.

    bob

    Reply

    1. Bob it sounds as if you have an infection on your computer. There are several worms out right now that mod your registry and hide your files. You’ll still need to change your permissions but you’ll have to get rid of the infections first. Also make sure you do not delete your temp files first or you will lose all of that.

      Reply

  38. As somebody suggested, execute this from the command prompt available in the list of repair options available at boot, upon selecting the F8 option.
    This was the only way I could get it to reset the majority of permissions without complaining. Sure, it complained about a few, but they were simply paths which couldn’t complete and terminate during the process, and weren’t essential paths which would cause general permission issues.

    Reply

  39. Just gotta say thanks! 🙂 I didn’t want to do all the searching for the answers myself this time and a google search brought your page right up. And now my problem is solved, much appreciated.

    Reply
  42. Pingback: Suddenly can’t access USB hard disk in Windows 7: how to fix (reset permissions) | Welcome to Andrewblock.net
  43. Pingback: Unable to Change Windows Vista Read-Only Folder Attribute

  45. I had a problem installing Microsoft Office 2010, so searching the web I found this site: http://social.technet.microsoft.com/Forums/en/office2010/thread/649fb828-e34e-4ca2-b283-2124e6a8783a
    Where they recommend typing these two commands:
    takeown /f C:\Windows
    cacls C:\Windows /G administrators:F

    Well, I did it and… now I can’t open almost ANY program (Chrome, Firefox, Windows Media Player, …). I have access to cmd and the Windows Explorer.

    Do you think the solution you propose could help me restoring my OS?
    Thanks

    Reply

  49. I already did everything, ran it as admin but it says access denied. Im getting crazy in here. what do i do? need help.

    Reply

    1. For those who are getting the access denied error, you need ownership. I found that the quickest and easiest way to get around this is just to go into the properties of the drive in question (for example, your C drive) and take ownership of the drive in its entirety. This will also give you ownership of everything in the drive, which will get rid of the access denied error.

      This would be risky, but since you’re resetting permissions and ownership anyway, this goes away once you finish.

      Reply

  54. Thanks you very much…..
    Thanks you very much…..
    Thanks you very much…..
    Thanks you very much…..
    Thanks you very much…..Thanks you very much…..Thanks you very much…..Thanks you very much………….

    Reply

  57. What can I say? THANKS! I’d completely screwed up my permissions in an attempt to write to a database via ASP. Eventually, my local computer server was FUBAR. Ran this script, now it’s back to default settings. So I now can play with it, and if I screw it up again, I know how to get back to neutral.

    Thanks guys.

    Reply

  59. Thanks, this saved me a ton of time as I had accidentally messed up my main/drive C: permissions while messing around under a dual-boot environment.

    Reply

    1. I accidently denied all permissions to E: drive.
      When access denied massage appeared I did undo those security permissions.
      Now though I can access E: drive but all the folders and subfolders show that denial message abd even if I undo the same security settings to each folder seperately still exe,zip, and other type of files cant be excessed.
      I am using Windows 7 ultimate please help….

      Reply
  61. Pingback: Windows 7 will not boot (Blank Screen)

  64. Hi there, Very interesting stuff. I’ve just tried to run the DOS command
    ” icacls * /T /Q/ C /RESET” (without the quotes), as administrator, in Windows 7, and it says …. “icacls* not recognised as an internal or external command operable program or batch file”.
    That is a * (star) there isn’t it? And I tried it both with and without spaces between each of these…. /T/Q/C.
    So my Windows 7 operating system doesn’t recognise this as a command – could you help please? Thanks, Li
    p.s. I also tried your bat file in one of my folders but it didn’t change any permissions for me? It would save me about two days work if either of these worked – but they don’t work on my PC?

    Reply

    1. Hi Li,

      Just type the following form an administrator command prompt:

      icacls SPACE * SPACE /T SPACE /Q SPACE /C SPACE /RESET

      Of course, remove the SPACE and put a space character by pressing the space bar on your keyboard.

      This should work if you are using Windows 7 and above.

      Reply

      1. I have Windows 7 64 bit and did this on my c drive. When the command prompt finished, it said, “Successfully processed 2411. Failed to process 12510.” Why didn’t it reset all of the other files?

  66. Heya i’m for the primary time here. I found this board and I to find It really useful & it helped me out much. I hope to offer one thing back and aid others like you helped me.

    Reply

  69. The solution does not what it claims to do. When I click on the desktop to make a new folder, the uac shield still comes up. This means that the security settings are still broken. The solution claims to fix this.

    Reply

  70. Hi,

    You said: ‘In Windows 7 it is called “icalcs”.’

    You meant: “icalcs”?

    Missed it by that much!!

    dRdoS7.

    PS. Worked for me.

    Reply
  71. Pingback: Resetting NTFS files security and permission in Windows 7 | ntanvinh144289
  72. Pingback: Flauschig Dev. Blog » Fixing NTFS Security Permissions (Win 7/8)

  73. Do you mind if I quote a couple of your articles as long
    as I provide credit and sources back to your site? My blog site is
    in the very same area of interest as yours and my visitors would definitely benefit from some of the information
    you provide here. Please let me know if this ok with you.
    Cheers!

    Reply

  74. i use this trick but still donot access!!!
    help me please

    “you don’t have the correct permission to access the file location”

    Reply

      2. Try to change ownership of the folder.

        I don’t know the steps by heart but this is a rough idea:

        1. right click on the folder
        2. properties
        3. security – tab
        4. advanced button
        5. Owner label -> “Change” to change the owner
        6. Add yourself as an owner and press Apply.

        Then try again with the instructions in the blog?

  75. icacls SPACE * SPACE /T SPACE /Q SPACE /C SPACE /RESET

    I run the above line in win 7 64 bit (as admin), and it does the scan, but shows …

    Successfully processed 3918 files … Failed processing 12863 files

    Can some one please offer advice on why this is happening??

    Reply

    1. Try to change ownership of the folder.

      I don’t know the steps by heart but this is a rough idea:

      1. right click on the folder
      2. properties
      3. security – tab
      4. advanced button
      5. Owner label -> “Change” to change the owner
      6. Add yourself as an owner and press Apply.

      Then try again with the instructions in the blog?

      Reply
  76. Pingback: Resetting NTFS files permission in Windows – Graphical Utility | lallous' lab

  77. Thanks for the command, worked like a charm…if you run Windows 8 and your start menu tiles disappear due to NTFS issues, use this command…brings everything back to the way it was.
    Big ups for the share!!

    Reply

  78. This is great, thanks for the tip. When joining an existing machine to a new domain all the file permissions seem to get messed up in Dropbox. This partially solved the problem and at least let me get access to the entire Dropbox directory again.

    Reply

  79. The last and final step is to go to the range and practice your swing for 30 minutes the go to thepractice green and putt
    for ne hour. These are designed to help golfers play shots through the rough
    or sand. Whisk in flour, 1-teaspoon salt, sugar, and a few
    grinds of black pepper.

    Reply
  80. Pingback: Намудрил с NTSF правами на папку | Dmitry-Bond

  81. My problem is i can’t run or open the Local Disk C. Because the Permission is Full Access (Deny.) How can i Unlock it? please help. thanks

    Reply

  83. i have the same problem but i cant use icacls or takeown, the file still denied.. i cant open safe mode, because all of my files is locking after i change the permission… i cant do anything, just open cmd..please help

    Reply

  85. You are a life saver! Thank you very much for these quick, clear directions. Just saved a notebook that stopped booting after a Windows Update. 🙂

    Reply

  86. Thanks a bunch. I was able to run this from a Command Prompt on a Recovery Disc to fix a Windows 7 installation that booted to a black screen. I knew the permissions were whacked but didn’t know how to fix them if I couldn’t even boot to a GUI. Worked like a charm. I did do a repair install afterwards just for good measure. Cheers!

    Reply

  87. Thank you very much lallousx86! This helped me a lot. If i didn’t have found this i will be losing all my 2094 files.
    Thank you very much!

    Reply

  88. I got “access denied” messages with both ICACLS and TAKEOWN commands. So Running CHKDSK /R C:\ (at the next boot) did the trick! Afterwards it sounds relevant that the file system ought to be corrupted if you cannot take ownership of a file or folder you would be authorized to. Especially if Windows cannot state who’s the owner of such a file or folder. Permissions have been clearly corrupted in such case. Many thanks for the tip! Cheers from France (Pierre de Grenoble)

    Reply
  90. Pingback: Resetting NTFS files security and permission in Windows | Yabfog

  91. This is the perfect site for anyone who wishes to understand
    this topic. You know so much its almost hard to argue with you (not that I personally would
    want to…HaHa). You definitely put a fresh spin on a topic which has been written about for ages.
    Great stuff, just wonderful!

    Reply

    2. Are you using Windows Vista , NT or 2000?
      Because icacls was called xcacls if I remember well.

      Anyway, try calling from full path:

      C:\Windows\System32\icacls.exe

      Reply

  94. Thanks for the utility, however, I would mention the commands it runs, as executed, follow links….

    I was restoring my system, and ran it against my old c:\users directory. It followed the links out, and broke permissions on the real (new) c:\users directory. (And c:\ProgramData)

    No real harm done, but I get to reinstall again. (Ya! Me!)

    I think there’s a couple of /L options that may be of use to change the link itself, instead of what it points at.

    Cheers

    David

    Reply

  95. I tried this, and even after the command line to take ownership, I still have access denied. The only way I could fix this is to do it via the gui. Right click drive c > properties > security > advanced > ownership, take ownership and include all child files and folders. Close it, re open it, go basically to the same place but the permissions tab, change permissions, add
    computername\administrators full control to everything
    SYSTEM full control to everything
    computername\users Read and execute to everything
    Authenticated Users special, subfolders and files only
    Authenticated users create folders / append folders, this folder only
    then after this is pushed down to everything go back to the ownership and change it to NT SERVICE\TrustedInstaller.
    Reboot.

    Computer should now be able to install programs again as windows search service and windows installer service can now start (no more access denied errors on many of the services in system event log)

    Reply

  96. Hi Lallou, this was a great help. I did still receive a number of “access denied” but thinking those might be System folders/files, some virtual files/folders from IE sandbox. I first did takeown from C:\ then icacls also from there. Afterward I ran them from C:\ProgramData.

    Now no startup errors appearing in Event Viewer and no crashes.

    Thank you – very helpful.

    Reply

  97. That worked perfectly!! And it’s recursive! No need to change them one by one. This page should be the first result in web engine!!

    Reply

  98. I had this problem in linux a few times. and the solution was to use rsync , so, i though maybe robocopy might do it too!, This worked for me to be able to delete the contents of the $windows.~bt folder that upgrades in windows 10 make.

    Open an elevated command prompt

    make a blank folder to “copy” eg
    c:
    cd \
    mkdir blankfolder

    cd to the dirrectory you can’t delete
    eg
    cd $widnows.~bt

    run icacls * /T /Q /C /RESET
    run takeown /R /F *
    run robocopy c:\blankfolder c:\$windows.~bt /mir

    the mirror option tells robocopy to mirror c:\blankfolder to $windows.~bt therfore deleting the files you dont want.

    Usually you are supposed to use the diskcleanup wizard to remove these files, but, the drive that had this folder was in a .wim file, and the OS was not running.

    Reply

  102. I have a Corrupted External Hard Drive.
    Plug in any computer it keep saying Access Denied. Is there any possible solution to recover without loosing any files?

    Reply

    1. I am not aware that you can change permissions via the network share. Normally, permissions apply to NTFS volumes on Windows. If there’s a way, let me know, then I can update my GUI.

      Reply
  106. Pingback: Installing and Configuring Windows 10, with an Eye Toward Security | Ray Woodcock's Latest

  107. I have a win7 and everything is always running smooth.
    I have made no changes and no new programs or new entries in startup.

    Today everything is UAC related.
    Everything gets the UAC prompt.
    I checked my UAC, setting still the same but prompts everything.
    I checked my gpedit and everything in the standard default settings.
    Driving me nuts.
    Please help and thank you soooooooooooooo much!!!

    Yes I ran three good quality antivirus.
    Nothing there.

    Reply
  108. Pingback: Windows 10 having major issues after being off for a couple of months - Boot Panic

  109. Hello everyone,

    I don’t know if you guys are still active, but I have a problem and I am sure it is easy for you to solve..
    OK so, yesterday, I was trying to get rid of 1 old pilote files in system32 that was avoiding me to turn the core isolation active again (yeah sound bad already).
    To do it so, I needed the permission to modify it, so I followed this video ( )and I change some access, not taking care at all of the message “be carefull the access migh be contradictory blabla the machine could not access everything” then I basicly took ownership (I think partially because I pressed cancel at the first error).
    Now I cant start the computer correctly, I get the famous C000021a, and the error is coming from… system32\Logfiles\Str\StrTrail.txt

    So my questions are :

    How to reset permission ? In order to start the computer and then :

    How to reset ownership ?

    If I decide to do a recovery, I wont lose my data but I will lose all my apps (no backup of course), but will it work again?

    Thanks everyone for your time and support, please help me!

    Tom

    PS : my level in coding doesnt exist.

    Reply

  110. OK, I screwed up I thought the file I wanted was selected and hit GO. It wasn’t, what was in the little window was my User Account in the root folder. If it stops running in the next few hours, I want to try and reset it back to the previous state. No, I didn’t back up the permissions either. So, I highlighted Pause in the little panel thinking that would pause everything and now there are two windows open running Success in the second one and the system cannot find the path specified in the original one. Can I run your three-steps of commands in an elevated CMD prompt window and reset it back to where it was? Unfortunately, the warning message didn’t pop up for me. Would sfc /scannow or DISM reset the permissions? Is there a regedit that will suffice, or do I need to do an update in place? All I was trying to do is find a way to get the preview in Explorer to show pdf & txt messages and I do not know if that’s a problem with the Windows 11 cloud (I did get it to finally show docx). Or, if it is a .NET Desktop 5.0.17 (x64) issue.
    I hope you actually get this.

    Reply

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.