Every file or folder in an NTFS volume has an owner. Certain system files are owned by TrustedInstaller, some by SYSTEM account, and others by the “Administrators” group. If a user creates a file or folder, that user is usually the owner of the file or folder. The owner is the one who can assign permissions (Allow or Deny) to other users for that object.
If a user is not the owner of a file or folder or has no permissions to access the file, he gets the “access is denied” error when accessing the object. If that user is an administrator, he can take ownership of the object using the file or folder’s Properties – Security tab. Then he can assign himself the required permissions.
This post tells you how to take ownership of a file or folder, and assign required permissions for it using the command-line instead of GUI.
Contents
- Taking ownership of a file using takeown.exe
- Assign file permissions using icacls.exe
- Taking ownership of a folder using takeown.exe
- Assign folder permissions using icacls.exe
- Take Ownership & Assign Permissions via Right-click Menu [Script/Tweak]
Additional Info
Windows includes a command-line tool named Takeown.exe, which can be used from an admin Command Prompt to quickly change the ownership of a file or folder. Here is how to take ownership of a file or folder and then assign permissions for an account using the command-line.
Taking ownership of a file
Open an elevated Command Prompt window. Use the following syntax to take ownership of a file:
TAKEOWN /F <filename>
Replace <filename> with the actual file name with the full path.
The currently logged on user is now the owner of the file.
To set Administrators
group the owner of the file, use the /A
switch in addition:
TAKEOWN /F <filename> /A
/A
Gives ownership to the Administrators group instead of the current user. If/A
is not specified, file ownership will be given to the currently logged-on user. This parameter is not case-sensitive.
If the operation was successful, you should see the following message:
“SUCCESS: The file (or folder): “filename” now owned by user “Computer Name\User name”.”
or
SUCCESS: The file (or folder): “filename” now owned by the administrators group.
Assign File Permissions
Then to grant Administrators Full Control permissions for the file, use ICACLS. Here is the syntax:
ICACLS <filename> /grant administrators:F
Example 2: To assign Full Control permissions for the currently logged on user, use this command:
ICACLS <filename> /grant %username%:F
%username% represents the account name of the currently logged-on user. ICacls accepts this variable directly.
Example 3: To assign Full Control permissions for the user named John
, use this command:
ICACLS <filename> /grant John:F
Taking ownership of a folder
Use the following syntax:
takeown /f <foldername>
(or)
takeown /f <foldername> /a
/a
Gives ownership to the Administrators group instead of the current user. If/a
is not specified, ownership will be given to the currently logged-on user. This parameter is not case-sensitive.
You’ll see the following output:
SUCCESS: The file (or folder): “folder_name” now owned by by user “computername\username”
(or)
SUCCESS: The file (or folder): “folder_name” now owned by the administrators group.
Change ownership recursively:
To change the ownership of a folder, its subfolders, and files in each subfolder, use this syntax:
takeown /f <foldername> /r /d y
The currently logged on user is now the owner of the folder.
To set Administrators
group the owner of the folder, its subfolders, and files recursively, use the /A
switch in addition:
TAKEOWN /F <foldername> /a /r /d y
/R
Recurse: instructs the tool to operate on files in the specified directory and all subdirectories./D
prompt Default answer used when the current user does not have the “list folder” permission on a directory. This occurs while operating recursively (/R) on sub-directories. Valid values “Y” to take ownership or “N” to skip.
Assign Folder Permissions
Then to assign the Administrators group Full Control Permissions for the folder, use this syntax:
icacls <foldername> /grant administrators:F /T
The /T parameter is added so that the operation is carried out through all the sub-directories and files within that folder.
Command-line help:
To know the complete usage information for Takeown.exe and ICacls.exe, run these commands from a Command Prompt window.
takeown /?
icacls /?
Easier Methods for Taking Ownership
Command Script
To further simplify the process of taking ownership, Tim Sneath of Microsoft provides a .CMD file (Windows Command Script) which takes ownership and assigns Full Control Permissions to Administrators for the directory. For more information, read Tim’s post, titled Secret #11: Deleting the Undeletable.
Add the “Take Ownership” command to the right-click menu
This again uses the special runas verb in Windows Vista and higher, which I’ve covered earlier (REF RunAs).
via WinMatrix.com
Download takeown_context.reg and save to Desktop. Right-click on the file and choose Merge. Click Yes when asked for confirmation. This adds an extended command named Take Ownership in the context menu for files and directories. To access the command, you need to press and hold the SHIFT key and then right-click on a file or folder.
(You can read more about the tweak in the article Take Ownership of File or Folder via Right-click Context Menu in Windows.)
Additional Information
The above section covers most of the stuff you need. Read below if you need more tips on this topic.
icacls.exe also can change ownership of a file or folder!
Takeown.exe and Icacls.exe are the two built-in console tools in Windows, that lets you change file or folder ownership and assign access control permissions, respectively. Takeown.exe sets the currently logged-in user account as the owner of an object (file or folder).
However, with Takeown.exe, you can’t make another account as the owner of an object.
Did you know that the icacls.exe tool can also be used to change ownership?
To change the ownership to a third-party account (i.e., the account that’s not currently logged in) or group, you may use icacls.exe with the /setowner
command-line argument, instead of takeown.exe.
Change ownership of a file or folder using icacls.exe
We saw how to change the ownership using icacls.exe in the last part of the article Take Ownership of a File or Folder Using Command-Line in Windows. Here are some more examples:
The following is the command-line syntax to change the ownership of a file or folder using icacls.exe:
icacls "file_or_folder_name" /setowner "NT Service\TrustedInstaller"
Examples: Set #1: Change ownership of a single file or folder
icacls "D:\Annual Reports\2020\November" /setowner "John"
icacls "D:\Tax Audit\November.xlsx" /setowner "John"
icacls "D:\Tax Audit\November.xlsx" /setowner "Administrators"
If the operation was successful, you’ll see the following message:
processed file: file_or_folder_name Successfully processed 1 files; Failed processing 0 files
Example #2: Change ownership for a folder (subfolder, and files) recursively
To change the ownership of a folder, its subfolders, and all the files in all subfolders recursively, use the /T
switch (traverse) in addition:
icacls "folder_name" /setowner "Administrators" /T
/T
indicates that this operation is performed on all matching files/directories below the directories specified in the name.
The above command sets TrustedInstaller as the owner of the folder, its subfolders, and all the files in all the subfolders.
Revert the Ownership back to TrustedInstaller
Sometimes, to fix an issue, you may need to alter a data file such as XML or a registry key owned by TrustedInstaller. For that, you first need to take ownership of the file, folder, or registry key.
After modifying the files or settings, you need to revert the ownership back to TrustedInstaller, if TrustedInstaller was the previous or original owner. To set the ownership back to TrustedInstaller, use these steps:
The Windows Modules Installer service or TrustedInstaller enables the installation, modification, and removal of Windows updates and optional components. By default, TrustedInstaller is also the owner of many critical registry keys and system files.
- Right-click on a file or registry key, and click Permissions.
- Click Advanced to open the Advanced Security Settings dialog.
- Near “Owner:”, click Change.
- In the Select User or Group dialog, type “
NT SERVICE\TrustedInstaller
” and press ENTER.
- Click Apply, OK.
This changes the object’s ownership (file, folder, or registry key) to TrustedInstaller or Windows Modules Installer.
Using icacls.exe command to set TrustedInstaller as the owner of a file
From an admin Command Prompt window, use the following command-line syntax:
icacls "path\filename" /setowner "NT Service\TrustedInstaller"
Example:
icacls "C:\Windows\PolicyDefinitions\WindowsStore.admx" /setowner "NT Service\TrustedInstaller"
TrustedInstaller now owns the file WindowsStore.admx.
icacls /setowner access denied?
Sometimes, the icacls.exe /setowner
command-line can encounter the following error:
filename: Access is denied. Successfully processed 0 files; Failed processing 1 files
This can happen when it encounters an NTFS hard link. The error usually pops up when you attempt to change ownership of protected files in the Windows directory — e.g., C:\Windows\Notepad.exe
. A hard link is the file system representation of a file by which more than one path references a single file in the same volume.
For example, the Notepad.exe files have two hard-linked files, which you can see using the following command:
fsutil.exe hardlink list C:\Windows\notepad.exe
You can see that Notepad.exe is hard-linked to the following files:
C:\Windows\System32\Notepad.exe C:\\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.488_none_4cea9379ceedab35\notepad.exe
The icacls.exe /setowner
command encounters the ACCESS_DENIED
error when processing these hard links.
Note that the icacls.exe documentation says, “This option does not force a change of ownership; use the takeown.exe utility for that purpose.”
If you encounter “Access is Denied” errors when setting ownership using Icacls, you may have to rely on Takeown.exe, SubInACL, or the third-party SetACL.exe (see next paragraph) command-line utility.
Using SetACL.exe to take ownership and assign permissions
SetACL.exe is a 3rd party command-line tool (from HelgeKlein.com) which we’ve covered before.
SetACL: Command-line arguments
Before proceeding, let’s see the command-line syntax for changing file/registry ownership and permissions using SetACL.
SetACL -on objectname -ot objecttype -actn action
-on
: Specify the path to the object SetACL should operate on (e.g., file, registry key, network share, service, or printer).-ot
: Specify the object type. To change ownership or permissions for a file or folder, use the object typefile
. For registry keys, use the object typereg
-actn
: Specify the action as to what should SetACL do against the object specified. For taking ownership, set the action assetowner
. To change permissions, set the action asace
.-ownr
: Specify Name or SID of a trustee (a user or group) in this format — e.g.,"n:Administrators"
(See SetACL documentation for the full list of objects, types, and supported actions.)
To change ownership and grant full control permission, here are some examples:
Examples: Change ownership of a single file or folder:
setacl.exe -on c:\windows\notepad.exe -ot file -actn setowner -ownr "n:NT Service\TrustedInstaller" setacl.exe -on c:\windows\notepad.exe -ot file -actn setowner -ownr "n:Administrators" setacl.exe -on c:\windows\notepad.exe -ot file -actn setowner -ownr "n:John" setacl.exe -on "d:\test" -ot file -actn setowner -ownr "n:NT Service\TrustedInstaller" setacl.exe -on "d:\test" -ot file -actn setowner -ownr "n:Administrators" setacl.exe -on "d:\test" -ot file -actn setowner -ownr "n:John"
Examples: Change ownership recursively:
Option 1: To set ownership of a folder and its subfolders (not for files) recursively, use one of these examples:
setacl.exe -on d:\test -ot file -actn setowner -ownr "n:NT Service\TrustedInstaller" -rec cont setacl.exe -on d:\test -ot file -actn setowner -ownr "n:Administrators" -rec cont setacl.exe -on d:\test -ot file -actn setowner -ownr "n:Ramesh" -rec cont
-rec
– recursion is enabled.cont
– Recurse, and process directories only.
Option 2: To set ownership of files in a folder and its subfolders (not folders) recursively, use one of these examples:
setacl.exe -on d:\test -ot file -actn setowner -ownr "n:NT Service\TrustedInstaller" -rec obj setacl.exe -on d:\test -ot file -actn setowner -ownr "n:Administrators" -rec obj setacl.exe -on d:\test -ot file -actn setowner -ownr "n:Ramesh" -rec obj
-rec
– recursion is enabled.obj
– Recurse, and process files only.
Option 3: To set ownership of a folder, its subfolders, and the files recursively, use one of these examples:
setacl.exe -on d:\test -ot file -actn setowner -ownr "n:NT Service\TrustedInstaller" -rec cont_obj setacl.exe -on d:\test -ot file -actn setowner -ownr "n:Administrators" -rec cont_obj setacl.exe -on d:\test -ot file -actn setowner -ownr "n:Ramesh" -rec cont_obj
-rec
– recursion is enabled.cont_obj
– Recurse, and process directories and files.
Examples: Assign the required permissions for a file or folder:
Once you have the ownership, you can assign the required permissions for an object. Here are some examples:
To assign the permissions for a single file or folder, use one of these examples:
setacl.exe -on "d:\test\sample.xlsx" -ot file -actn ace -ace "n:Administrators;p:full" setacl.exe -on "d:\test\sample.xlsx" -ot file -actn ace -ace "n:John;p:full" setacl.exe -on "d:\test" -ot file -actn ace -ace "n:Administrators;p:full" setacl.exe -on "d:\test" -ot file -actn ace -ace "n:John;p:full"
Examples: Assign the required permissions recursively:
Option 1: For a folder and subfolders (not files) recursively, use one of these examples:
setacl.exe -on "d:\test" -ot file -actn ace -ace "n:Administrators;p:full" -rec cont setacl.exe -on "d:\test" -ot file -actn ace -ace "n:John;p:full" -rec cont
-rec
– recursion is enabled.cont
– Recurse, and process directories only.
Option 2: For files in a folder and subfolders (not folders) recursively, use one of these examples:
setacl.exe -on "d:\test" -ot file -actn ace -ace "n:Administrators;p:full" -rec obj setacl.exe -on "d:\test" -ot file -actn ace -ace "n:John;p:full" -rec obj
-rec
– recursion is enabled.obj
– Recurse, and process files only.
Option 3: For a folder, its subfolders, and the files recursively, use one of these examples:
setacl.exe -on "d:\test" -ot file -actn ace -ace "n:Administrators;p:full" -rec cont_obj setacl.exe -on "d:\test" -ot file -actn ace -ace "n:John;p:full" -rec cont_obj
-rec
– recursion is enabled.cont_obj
– Recurse, and process directories and files.
You may check out SetACL official documentation to know about its full capabilities. However, to set file and folder ownership & permissions, takeown.exe and icacls.exe would be more than sufficient for most users.
One small request: If you liked this post, please share this?
One "tiny" share from you would seriously help a lot with the growth of this blog. Some great suggestions:- Pin it!
- Share it to your favorite blog + Facebook, Reddit
- Tweet it!
I just right clicked and took ownership of C:\windows 🙂
This is maybe the best solution; complete, well-written and accurate. Thanks for sharing 🙂
Sweet.
Thanks!
Maybe it was a German, who developed this tool:
If you use /f folder /r /d j (for german: JA), then there`s no error!
At least in my german win7 it works … 😉
It’s not a German tool but all system tolls and some other applications as well expect an answer in what is called the country-specific default language. If you change Windows to English as the default language, it’ll expect y|Y, if the language is set to German, it’s j|J.
Only with programs that do their own key examination internally, are not affected by this.
I believe J in German is for “yes” because the German “yes” is spelled Ja which is pronounced “YAH” That ‘s my guess.
I have at least one file for which this doesn’t work.
“Take ownership” pretends that all is OK, but it is not possible to rename or delete file.
Stupid question, but does the command-line method for Win7 grant permanent access to the file/folder? Or will that ownership be lost upon restart? Just curious, and also if that ownership can be reversed via similar syntax?
-Thanks in advance
If you took ownership and still can’t do anything to the file.. it is because you don’t have any permissions on it yet. It sounds stupid.. but you need to take ownership and also grant permissions using the ICACLS functions I used this method to recover files on a HDD from a crashed PC that had some corrupted OS files and thus was not bootable, this method was a life saver as setting permissions via mouse click forms was a huge pain in the ass spread across 1000 some files. I even had issues with permissions not rolling down the directories making me have to click on each file to change permissions.
so thanks for posting this
Thanks mate… worked perfect…
just a note to everyone else… u dont need to assign to Admin, it can be any username
Needed access to pictures on hdd from dead laptop, connected via usb/hdd. Tried the above, but couldn’t get access, until I added /a to the command.
Great tip otherwise
2020/08/10 – what command did you add the /a to? I used the right-click-takeownership registry “hack” and it seemed to do just fine but still have no access to the files. Thanks.
Thanks Ramesh!
You just saved me from a very newbie user who screwed up things badly, this was part of the solution to get things back on track 🙂
Thanks a lot..was searching for a long time to get this kind of solution
Superb Article !!!
not working in windows 7 32 bit… 🙁
This seemd to work but I still get access denied on our SBS 2008 for some folders. I don’t know if this is because I am working over a remote link?
THIS WAS PERFECT FOR ME!! >>WINDOWS 7 64 BIT<<
——————TO INSTALL—————
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\*\shell\runas]
@="Take Ownership"
"NoWorkingDirectory"=""
[HKEY_CLASSES_ROOT\*\shell\runas\command]
@="cmd.exe /c takeown /f \"%1\" && icacls \"%1\" /grant administrators:F"
"IsolatedCommand"="cmd.exe /c takeown /f \"%1\" && icacls \"%1\" /grant administrators:F"
[HKEY_CLASSES_ROOT\Directory\shell\runas]
@="Take Ownership"
"NoWorkingDirectory"=""
[HKEY_CLASSES_ROOT\Directory\shell\runas\command]
@="cmd.exe /c takeown /f \"%1\" /r /d y && icacls \"%1\" /grant administrators:F /t"
"IsolatedCommand"="cmd.exe /c takeown /f \"%1\" /r /d y && icacls \"%1\" /grant administrators:F /t"
—————TO UNINSTALL—————
Windows Registry Editor Version 5.00
[-HKEY_CLASSES_ROOT\*\shell\runas]
[-HKEY_CLASSES_ROOT\Directory\shell\runas]
awesome. Worked like a charm. Thanks so much!!
this is great and it work (Take Ownership), I was able to replace the bad DLL in SysWoW64.
What would be the reverse command for giving bacjk ownership? I would like to right-click on the directory and re-apply the same settings as before. For security reason.
thanks
Thanks so much! As part of recycling an old XP computer, I had backed it up with Acronis. I had then “wiped” the old XP drive. When I restored specific pictures from the old XP machine backup to a W7 attached USB hard drive, I did not have access. I thought I might have to resurrect the old XP machine. But the above “saved my bacon”!
it was a great help for me, thank you so much 🙂
I had converted to Windows 8 from 7. I backed up my files from Windows 8 manually. I then reinstalled Windows 8 (because I hated it), then when I went to copy files back from the backup drive, I couldn’t because I did not have access. Your info helped me straighten out ownership and I can access them normally. Thanks.
This has finally allowed me to delete Windows and other system files from my slave drive. Even after inputting all those commands myself by following other peoples’ guides and getting ownership, it would still ask for permission infinitely and never get deleted. I assume perhaps it’s the runas verb that did the trick (none of the other sites ever mentioned it.) Either way, thank you so much for this. I was about to resort to formatting the whole drive and go through tedious data transfers.
Great! Thank you very much!
Please could any one let me know the command to restore the owner ship to “Trusted installer” as a default owner. steps i performed is :
1- TAKEOWN /R /F “C:\Program files” (SUCCESS & now i could see owner is SYSTEM)
2 – cacls “c:\Program files” /T /E /G ProgFiles:W (ProgFiles is the local group) – SUCCESS
Now here i tried below to restore the ownership:
icacls “C:\Program files” /setowner “NT SERVICE\TrustedInstaller” /t /c
( It gave me message saying , successfully processed 897 files, failed processing 1134 files. (and still i could see SYSTEM as owner and not Trusted installed). PLEASE HELP ME
@san: icacls /setowner can sometimes fail (especially when processing files in your Windows directory, and reparse points). Please try SetACL from HelgeKlein.com instead.
Thank you so much! You’ve just help me to recover some files off my laptop’s fracked old hard drive! 🙂
Well, it seems very helpful, but for some reason it keeps saying “Access is denied” not sure how to get around this.
2020/08/10 – same issue here – it appeared to work just fine but still “access denied”
how do i change the owner of a drive, i am unable to access my d drive.
Could you add in a right click take ownership option that uses the “trustedinstaller” as the default? That takeownership command works the best on my system, and that’d be a big help. if so, could you make its shortcut name appear as “TakeOwnership TI”
@Stephen: thanks for the idea. Shall put up a script that does this.
2020/08/10 – This worked great but I still get access denied also
THANK YOU!!! Oof, stubborn folder. May name my next child icacls now.
SetACL still fails, Access is Denied, specifically:
SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Access is denied.