Fix: “Failed to Enumerate Objects in the Container” Error

When you try to open a folder, you may see the message “You don’t currently have permission to access this folder. Click Continue to permanently get access to this folder.

Failed to Enumerate Objects in the Container - cannot take ownership

Clicking on the Continue shows the message “You have been denied permission to access this folder. To gain access to this folder you will need to use the security tab.

Failed to Enumerate Objects in the Container - cannot take ownership

Visiting the Security tab shows a blank tab with the message “You must have Read permissions to view the properties of this object. Click Advanced to continue.

Failed to Enumerate Objects in the Container - cannot take ownership

And, the Advanced tab is empty with the message “You must have Read permissions to view the properties of this object. Click Continue to attempt the operation with administrative permissions.

Failed to Enumerate Objects in the Container - cannot take ownership

Clicking on the Continue button is again a vain attempt. Now the advanced permissions dialog shows the message “You do not have permission to view this object’s security properties, even as an administrative user. To try taking ownership of the object, which includes permission to view its properties, click Change above.

Failed to Enumerate Objects in the Container - cannot take ownership

The current owner can’t be determined as the dialog says “Unable to display current owner“.

After you change ownership of a folder and add permissions to the folder and sub-folders using the Advanced Security dialog, you may see the failed to enumerate objects in the container error:

Error Applying Security

An error occurred while applying security information to:

Failed to enumerate objects in the container. Access is denied

Unable to save permission changes on <folder name>.  Access is denied.

failed to enumerate container - cannot take ownership of a folder

Cause

The above symptoms occur if your account or the Administrators group don’t have Permissions to access the folder or file. In some strange situations, the default permission entries may get removed perhaps by a rogue program. By default, for most folders, administrators have full control permissions, and the Users or Authenticated Users group have Read permissions, at the least. If those default permissions are removed, the errors occur.

Sometimes a non-existent user account may be exclusively owning the file or folder since some point of time, and the obsolete permission entries remain.

It could also be possible that an administrator or system-level process or service running in the background has the file or folder locked. This may be preventing the user from accessing the folder and changing file/folder permissions.

Solution

In case the issue is caused due to missing permissions, you can take ownership of the folder recursively and then add necessary permissions.

Take ownership of the file or folder and assign permissions

From the Advanced Security Settings dialog, click on Change next to the Owner: field.

Failed to Enumerate Objects in the Container - cannot take ownership

Type Administrators in the object name field, and click OK.

Failed to Enumerate Objects in the Container - cannot take ownership

Select Replace owner on subcontainers and objects, and click Apply.

Failed to Enumerate Objects in the Container - cannot take ownership

You’ll see the message If you have just taken ownership of this object, you will need to close and reopen this object’s properties before you can view or change permissions..

Close the Advanced security dialog and reopen. You should be able to add necessary permissions entries now.

Once done, assign additional/necessary permissions for users or groups. e.g., SYSTEMFull Control | UsersRead & Execute and so on.



Using command-line

To do this via administrator Command Prompt, run:

takeown /f "D:\Test\Stubborn" /a /r /d y
icacls "D:\Test\Stubborn" /t /c /grant administrators:F

tips bulb iconWe’ve seen in detail how to change ownership via command-line in the article Take Ownership of a File or Folder Using Command-Line in Windows. Refer to the article for more information.

What causes the “Failed to enumerate objects in the container” error?

When adding permissions to the folder and sub-folders, you may see the following errors:

Error Applying Security

An error occurred while applying security information to:

Failed to enumerate objects in the container. Access is denied

Unable to save permission changes on <folder name>.  Access is denied.

failed to enumerate container - cannot take ownership of a folder

The above errors occur if you have changed the ownership only for the current folder only and not for sub-folders and files. You need to own the sub-folders before you can apply the permissions on them.

The Failed to enumerate objects in the container error simply means that you don’t have the ownership or permission to view or modify the NTFS access control lists (ACLs) for one or more sub-folders of the current folder.

To fix the problem, re-do the procedure of changing the ownership as explained earlier. Make sure this time that you need to select Replace owner on subcontainers and objects, and click Apply so that the ownership is applied recursively.

failed to enumerate objects in the container - change ownership recursively sub-folders

As a side note, the above takeown.exe command-line does change the ownership recursively (sub-folders and files), as the /r parameter is included. Also, the icacls.exe command-line above applies the permissions recursively, thanks to the /t switch (Traverse option performs the operation on all matching files/directories below the directories specified.)

Cannot change ownership or permissions? File or Folder may have been locked

In some cases, a background program or service may have an exclusive lock on a file or folder, causing Access is denied error when running the takeown.exe command-line above.

Using Process Explorer you can find out the name of the process or service that is having a lock on the file system object. Once you find it, all you need to do is exit the process or stop the service to release the handle.

cannot take ownership
[Example] Process Explorer Handle or DLL Search
To know which process is having a lock over a file or folder, you can use Microsoft Process Explorer or the built-in Resource Monitor. We’ve written about it in these articles:

Start Windows 10 in Safe mode

Another route is to start Windows in Safe mode where third-party services and programs don’t run and the file/folder lock issue wouldn’t happen. From Safe mode, you should be able to access the folder or change its ownership or permissions accordingly.

  1. When you get to the sign-in screen, hold the SHIFT key down while you select Power icon, and click Restart.
  2. Your computer restarts to the “Choose an option” screen.
  3. Select Troubleshoot → Advanced options → Startup Settings → Restart.

    failed to enumerate objects in the container - change ownership recursively sub-folders

    After your computer restarts, you’ll see a list of startup options.

  4. Select 4 or F4 to start your PC in Safe Mode, or select 5 or F5 for Safe Mode with Networking.
  5. Log in to Safe mode and carry out the administration tasks such as creating a new administrator account or fixing registry or file system permissions, etc.

Run Chkdsk

If you get access denied errors with both the takeown.exe and icacls.exe commands even when in Safe mode, then this could indicate a file system corruption. Running Chkdsk on the affected partition should help.

To run Chkdsk on the C:\ drive, run the following command from administrator Command Prompt:

CHKDSK /R C:\

Chkdsk will run at the next boot and that should do the trick!

About the author

Ramesh Srinivasan founded Winhelponline.com back in 2005. He is passionate about Microsoft technologies and he has been a Microsoft Most Valuable Professional (MVP) for 10 consecutive years from 2003 to 2012.

Leave a Comment