Fix: “Failed to Enumerate Objects in the Container” Error

When you try to open a folder, you may see the message “You don’t currently have permission to access this folder. Click Continue to permanently get access to this folder.”

Clicking on the Continue shows the message “You have been denied permission to access this folder. To gain access to this folder you will need to use the security tab.”

Visiting the Security tab shows a blank tab with the message “You must have Read permissions to view the properties of this object. Click Advanced to continue.”

And, the Advanced tab is empty with the message “You must have Read permissions to view the properties of this object. Click Continue to attempt the operation with administrative permissions.”

Clicking on the Continue button is again a vain attempt. Now the advanced permissions dialog shows the message “You do not have permission to view this object’s security properties, even as an administrative user. To try taking ownership of the object, which includes permission to view its properties, click Change above.”

The current owner can’t be determined as the dialog says “Unable to display current owner“.

After you change ownership of a folder and add permissions to the folder and sub-folders using the Advanced Security dialog, you may see the failed to enumerate objects in the container error:

Cause

The above symptoms occur if your account or the Administrators group don’t have Permissions to access the folder or file. In some strange situations, the default permission entries may get removed perhaps by a rogue program. By default, for most folders, administrators have full control permissions, and the Users or Authenticated Users group have Read permissions, at the least. If those default permissions are removed, the errors occur.

Sometimes a non-existent user account may be exclusively owning the file or folder since some point of time, and the obsolete permission entries remain.

It could also be possible that an administrator or system-level process or service running in the background has the file or folder locked. This may be preventing the user from accessing the folder and changing file/folder permissions.

Solution

In case the issue is caused due to missing permissions, you can take ownership of the folder recursively and then add necessary permissions.

Take ownership of the file or folder and assign permissions

From the Advanced Security Settings dialog, click on Change next to the Owner: field.

Type Administrators in the object name field, and click OK.

Select Replace owner on subcontainers and objects, and click Apply.

You’ll see the message If you have just taken ownership of this object, you will need to close and reopen this object’s properties before you can view or change permissions..

Close the Advanced security dialog and reopen. You should be able to add necessary permissions entries now.

Once done, assign additional/necessary permissions for users or groups. e.g., SYSTEM → Full Control | Users → Read & Execute and so on.

takeown /f "D:\Test\Stubborn" /a /r /d y
icacls "D:\Test\Stubborn" /t /c /grant administrators:F

What causes the “Failed to enumerate objects in the container” error?

When adding permissions to the folder and sub-folders, you may see the following errors:

The above errors occur if you have changed the ownership only for the current folder only and not for sub-folders and files. You need to own the sub-folders before you can apply the permissions on them.

The Failed to enumerate objects in the container error simply means that you don’t have the ownership or permission to view or modify the NTFS access control lists (ACLs) for one or more sub-folders of the current folder.

To fix the problem, re-do the procedure of changing the ownership as explained earlier. Make sure this time that you need to select Replace owner on subcontainers and objects, and click Apply so that the ownership is applied recursively.

As a side note, the above takeown.exe command-line does change the ownership recursively (sub-folders and files), as the /r parameter is included. Also, the icacls.exe command-line above applies the permissions recursively, thanks to the /t switch (Traverse option performs the operation on all matching files/directories below the directories specified.)

Cannot change ownership or permissions? File or Folder may have been locked

In some cases, a background program or service may have an exclusive lock on a file or folder, causing Access is denied error when running the takeown.exe command-line above.

Using Process Explorer you can find out the name of the process or service that is having a lock on the file system object. Once you find it, all you need to do is exit the process or stop the service to release the handle.

• How to Use Resource Monitor to Find Which Process Has Locked a File?
• Find Which Process Has Locked a File Without 3rd Party Tools
• How to Delete a Stubborn Undeletable File or Folder in Windows?

Start Windows 10 in Safe mode

Another route is to start Windows in Safe mode where third-party services and programs don’t run and the file/folder lock issue wouldn’t happen. From Safe mode, you should be able to access the folder or change its ownership or permissions accordingly.

1. On the sign-in screen, hold the SHIFT key down while you click the Power icon, and click Restart.
2. Your computer restarts to the “Choose an option” screen.
3. Select Troubleshoot → Advanced options → Startup Settings → Restart.

   After your computer restarts, you’ll see a list of startup options.

4. Select 4 or F4 to start your PC in Safe Mode, or select 5 or F5 for Safe Mode with Networking.
5. Log in to Safe mode and carry out the administration tasks — e.g., creating a new administrator account, fixing registry or file system permissions, etc.

Run Chkdsk

If you get access denied errors with both the takeown.exe and icacls.exe commands even when in Safe mode, then this could indicate a file system corruption. Running Chkdsk on the affected partition should help.

To run Chkdsk on the C:\ drive, run the following command from the administrator Command Prompt:

CHKDSK /R C:\

Chkdsk will run at the next boot, and that should do the trick!