Contents<\/h4>\n\n- Taking ownership of a file using takeown.exe<\/a><\/li>\n
- Assign file permissions using icacls.exe<\/a><\/li>\n
- Taking ownership of a folder using takeown.exe<\/a><\/li>\n
- Assign folder permissions using icacls.exe<\/a><\/li>\n
- Take Ownership & Assign Permissions via Right-click Menu [Script\/Tweak]<\/a><\/li>\n<\/ul>\n
Additional Info<\/h4>\n\n- INFO: icacls.exe can also change ownership<\/a><\/li>\n
- Revert the Ownership to TrustedInstaller<\/a><\/li>\n
- ERROR: icacls.exe \/setowner “Access is Denied”<\/a><\/li>\n
- Using SetACL.exe to take ownership and assign permissions <\/a>[3rd Party freeware]<\/a><\/li>\n<\/ul>\n<\/div>\n
Windows includes a command-line tool named Takeown.exe,<\/b> which can be used from an admin Command Prompt<\/a> to quickly change the ownership of a file or folder. Here is how to take ownership of a file or folder<\/strong> and then assign permissions for an account using the command-line.<\/p>\n![\"Take](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2008\/05\/takeown-cmd.png\")
<\/p>\n
<\/a>Taking ownership of a file<\/h3>\nOpen an elevated Command Prompt<\/a> window. Use the following syntax to take ownership of a file:<\/p>\ntakeown \/f <filename><\/i><\/pre>\nReplace <\/i><filename><\/i><\/b> with the actual file name with the full path.<\/i><\/p>\n
The currently logged on user is now the owner of the file.<\/em><\/p>\nTo set Administrators<\/code> group the owner of the file, use the \/A<\/code> switch in addition:<\/p>\ntakeown \/f <filename> \/a<\/i><\/pre>\n\n\/A<\/code> Gives ownership to the Administrators group instead of the current user. If \/A<\/code> is not specified, file ownership will be given to the currently logged-on user. This parameter is not<\/strong> case-sensitive.<\/li>\n<\/ul>\nIf the operation was successful, you should see the following message:<\/p>\n
“SUCCESS: The file (or folder): “filename” now owned by user “Computer Name\\User name”.”<\/i><\/p>\n
or<\/p>\n
SUCCESS: The file (or folder): “filename” now owned by the administrators group.<\/p><\/blockquote>\n
<\/a>Assign File Permissions<\/h3>\nThen to grant Administrators<\/b> Full Control permissions for the file, use ICACLS<\/b>. Here is the syntax:<\/p>\nicacls <filename><\/i> \/grant administrators:F<\/pre>\n\nNote: On non-English Windows installations, the error “No mapping between account names and security IDs was done” occurs when running the above command because the built-in admininstrator account name may be different in non-English versions. In that case, you can use the SID instead of the account name.<\/p>\nRun:<\/p>\n
icacls <filename><\/i> \/grant *S-1-5-32-544:F<\/pre>\nThe command works in English as well as non-English Windows OS.<\/p>\n<\/div>\n
Example 2: To assign Full Control permissions for the currently logged on user, use this command:<\/p>\n
icacls <filename><\/i> \/grant %username%:F<\/pre>\n%username%<\/b> represents the account name of the currently logged-on user. ICacls accepts this variable directly.<\/i><\/p>\n
Example 3: To assign Full Control permissions for the user named John<\/code>, use this command:<\/p>\nICACLS <filename><\/i> \/grant John:F<\/pre>\n
\n<\/a>Taking ownership of a folder<\/h3>\nUse the following syntax:<\/p>\n
takeown \/f <foldername><\/i><\/pre>\n(or)<\/p>\n
takeown \/f <foldername> \/a<\/i><\/pre>\n\n\/a<\/code> Gives ownership to the Administrators group instead of the current user. If \/a<\/code> is not specified, ownership will be given to the currently logged-on user. This parameter is not<\/strong> case-sensitive.<\/li>\n<\/ul>\nYou’ll see the following output:<\/p>\n
SUCCESS: The file (or folder): “folder_name” now owned by by user “computername\\username”<\/p>\n
(or)<\/p>\n
SUCCESS: The file (or folder): “folder_name” now owned by the administrators group.<\/p><\/blockquote>\n
Change ownership recursively:<\/h4>\n
To change the ownership of a folder, its subfolders, and files in each subfolder, use this syntax:<\/p>\n
takeown \/f <foldername><\/i> \/r \/d y<\/pre>\nThe currently logged on user is now the owner of the folder.<\/em><\/p>\nTo set Administrators<\/code> group the owner of the folder, its subfolders, and files recursively, use the \/A<\/code> switch in addition:<\/p>\ntakeown \/f <foldername> \/a \/r \/d y<\/i><\/pre>\n\n\/R<\/code> Recurse: instructs the tool to operate on files in the specified directory and all subdirectories.<\/li>\n\/D<\/code> prompt Default answer used when the current user does not have the “list folder” permission on a directory. This occurs while operating recursively (\/R) on sub-directories. Valid values “Y” to take ownership or “N” to skip.<\/li>\n<\/ul>\n<\/a>Assign Folder Permissions<\/h3>\nThen to assign the Administrators<\/b> group Full Control Permissions for the folder, use this syntax:<\/p>\nicacls <foldername><\/i> \/grant administrators:F \/T<\/pre>\n\nNote: On non-English Windows installations, the error “No mapping between account names and security IDs was done” occurs when running the above command because the built-in admininstrator account name may be different in non-English versions. In that case, you can use the SID instead of the account name.<\/p>\nRun:<\/p>\n
icacls <foldername><\/i> \/grant *S-1-5-32-544:F \/T<\/pre>\nThe command works in English as well as non-English Windows OS.<\/p>\n<\/div>\n
The \/T<\/b> parameter is added so that the operation is carried out through all the sub-directories and files within that folder.<\/p>\nCommand-line help:<\/h4>\n
To know the complete usage information for Takeown.exe and ICacls.exe, run these commands from a Command Prompt window.<\/p>\n
takeown \/?<\/b><\/pre>\nicacls \/?<\/b><\/pre>\n
\n<\/a>Easier Methods for Taking Ownership<\/h3>\nCommand Script<\/h4>\n
To further simplify the process of taking ownership, Tim Sneath<\/a> of Microsoft provides a .CMD file (Windows Command Script) which takes ownership and assigns Full Control Permissions to Administrators for the directory. For more information, read Tim’s post, titled Secret #11: Deleting the Undeletable<\/a>.<\/p>\nAdd the “Take Ownership” command to the right-click menu<\/h4>\n
This again uses the special runas<\/b><\/i> verb in Windows Vista and higher, which I’ve covered earlier (REF<\/b> RunAs<\/a><\/i>).<\/p>\nvia WinMatrix.com<\/a><\/p>\n![](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/takeown.gif\")
Download takeown_context.reg<\/a><\/b> and save to Desktop. Right-click on the file and choose Merge<\/b>. Click Yes<\/b> when asked for confirmation. This adds an extended command named Take Ownership<\/b> in the context menu for files and directories. To access the command, you need to press and hold the SHIFT<\/b> key and then right-click on a file or folder.<\/p>\n(You can read more about the tweak in the article Take Ownership of File or Folder via Right-click Context Menu in Windows<\/a><\/em>.)<\/p>\n
\nAdditional Information<\/h2>\n
The above section covers most of the stuff you need. Read below if you need more tips on this topic.<\/p>\n
<\/a>icacls.exe also can change ownership of a file or folder!<\/h3>\nTakeown.exe and Icacls.exe are the two built-in console tools in Windows, that lets you change file or folder ownership and assign access control permissions, respectively. Takeown.exe sets the currently logged-in user account as the owner of an object (file or folder).<\/p>\n
However, with Takeown.exe, you can’t make another account as the owner of an object.<\/p>\n
Did you know that the icacls.exe tool can also be used to change ownership?<\/em><\/p>\nTo change the ownership to a third-party account (i.e., the account that’s not currently logged in) or group, you may use icacls.exe with the \/setowner<\/code> command-line argument, instead of takeown.exe.<\/p>\nChange ownership of a file or folder using icacls.exe<\/h3>\n
We saw how to change the ownership using icacls.exe in the last part of the article Take Ownership of a File or Folder Using Command-Line in Windows<\/a>. Here are some more examples:<\/p>\nThe following is the command-line syntax to change the ownership of a file or folder using icacls.exe:<\/p>\n
icacls \"file_or_folder_name\" \/setowner \"NT Service\\TrustedInstaller\"<\/pre>\nExamples: Set #1: Change ownership of a single file or folder<\/h4>\nicacls \"D:\\Annual Reports\\2020\\November\" \/setowner \"John\"<\/pre>\nicacls \"D:\\Tax Audit\\November.xlsx\" \/setowner \"John\"<\/pre>\nicacls \"D:\\Tax Audit\\November.xlsx\" \/setowner \"Administrators\"<\/pre>\nIf the operation was successful, you’ll see the following message:<\/p>\n
processed file: file_or_folder_name<\/em>\nSuccessfully processed 1 files; Failed processing 0 files<\/pre>\nExample #2: Change ownership for a folder (subfolder, and files) recursively<\/h4>\n
To change the ownership of a folder, its subfolders, and all the files in all subfolders recursively, use the \/T<\/code> switch (traverse) in addition:<\/p>\nicacls \"folder_name\" \/setowner \"Administrators\" \/T<\/pre>\n
\n\/T<\/code> indicates that this operation is performed on all matching files\/directories below the directories specified in the name.<\/li>\n<\/ul>\nThe above command sets TrustedInstaller as the owner of the folder, its subfolders, and all the files in all the subfolders.<\/p>\n
\n<\/a>Revert the Ownership back to TrustedInstaller<\/h3>\nSometimes, to fix an issue, you may need to alter a data file<\/a> such as XML or a registry key<\/a> owned by TrustedInstaller. For that, you first need to take ownership of the file, folder, or registry key<\/a>.<\/p>\nAfter modifying the files or settings, you need to revert the ownership back to TrustedInstaller<\/strong>, if TrustedInstaller was the previous or original owner. To set the ownership back to TrustedInstaller, use these steps:<\/p>\nThe Windows Modules Installer service or TrustedInstaller enables the installation, modification, and removal of Windows updates and optional components. By default, TrustedInstaller is also the owner of many critical registry keys and system files.<\/em><\/p>\n\n- Right-click on a file or registry key, and click Permissions.<\/li>\n
- Click Advanced to open the Advanced Security Settings dialog.<\/li>\n
- Near “Owner:”, click Change.<\/li>\n
- In the Select User or Group dialog, type “
NT SERVICE\\TrustedInstaller<\/code>” and press ENTER.
\n![\"take](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2008\/05\/trustedinstaller-owner-1.png\")
<\/li>\n- Click Apply, OK.
\n![\"take](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2008\/05\/trustedinstaller-owner-2.png\")
<\/li>\n<\/ol>\nThis changes the object’s ownership (file, folder, or registry key<\/a>) to TrustedInstaller or Windows Modules Installer.<\/p>\nRELATED:<\/strong> Take Ownership of a Registry Key & Assign Permissions Using Command-line<\/a><\/div>\nUsing icacls.exe command to set TrustedInstaller as the owner of a file<\/h4>\n
From an admin Command Prompt window, use the following command-line syntax:<\/p>\n
icacls \"path\\filename\" \/setowner \"NT Service\\TrustedInstaller\"<\/pre>\nExample:<\/p>\n
icacls \"C:\\Windows\\PolicyDefinitions\\WindowsStore.admx\" \/setowner \"NT Service\\TrustedInstaller\"<\/pre>\nTrustedInstaller now owns the file WindowsStore.admx.<\/p>\n
\n<\/a>icacls \/setowner access denied?<\/h3>\nSometimes, the icacls.exe \/setowner<\/code> command-line can encounter the following error:<\/p>\nfilename: Access is denied.\nSuccessfully processed 0 files; Failed processing 1 files<\/pre>\nThis can happen when it encounters an NTFS hard link. The error usually pops up when you attempt to change ownership of protected files in the Windows directory — e.g., C:\\Windows\\Notepad.exe<\/code>. A hard link<\/a> is the file system representation of a file by which more than one path references a single file in the same volume.<\/p>\nFor example, the Notepad.exe files have two hard-linked files, which you can see using the following command:<\/p>\n
fsutil.exe hardlink list C:\\Windows\\notepad.exe<\/pre>\n![\"fsutil](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2008\/05\/icacls-setowner-access-denied-hardlinks.png\")
<\/p>\n
You can see that Notepad.exe is hard-linked to the following files:<\/p>\n
C:\\Windows\\System32\\Notepad.exe\nC:\\\\Windows\\WinSxS\\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.488_none_4cea9379ceedab35\\notepad.exe<\/pre>\nThe icacls.exe \/setowner<\/code> command encounters the ACCESS_DENIED<\/code> error when processing these hard links.<\/p>\nNote that the icacls.exe documentation says, “This option does not force a change of ownership; use the takeown.exe utility for that purpose.”<\/em><\/p>\nIf you encounter “Access is Denied” errors when setting ownership using Icacls, you may have to rely on Takeown.exe, SubInACL, or the third-party SetACL.exe (see next paragraph) command-line utility.<\/p>\n
\n<\/a>Using SetACL.exe to take ownership and assign permissions<\/h3>\n
Additional Info<\/h4>\n\n- INFO: icacls.exe can also change ownership<\/a><\/li>\n
- Revert the Ownership to TrustedInstaller<\/a><\/li>\n
- ERROR: icacls.exe \/setowner “Access is Denied”<\/a><\/li>\n
- Using SetACL.exe to take ownership and assign permissions <\/a>[3rd Party freeware]<\/a><\/li>\n<\/ul>\n<\/div>\n
Windows includes a command-line tool named Takeown.exe,<\/b> which can be used from an admin Command Prompt<\/a> to quickly change the ownership of a file or folder. Here is how to take ownership of a file or folder<\/strong> and then assign permissions for an account using the command-line.<\/p>\n<\/p>\n
<\/a>Taking ownership of a file<\/h3>\nOpen an elevated Command Prompt<\/a> window. Use the following syntax to take ownership of a file:<\/p>\ntakeown \/f <filename><\/i><\/pre>\nReplace <\/i><filename><\/i><\/b> with the actual file name with the full path.<\/i><\/p>\n
The currently logged on user is now the owner of the file.<\/em><\/p>\nTo set Administrators<\/code> group the owner of the file, use the \/A<\/code> switch in addition:<\/p>\ntakeown \/f <filename> \/a<\/i><\/pre>\n\n\/A<\/code> Gives ownership to the Administrators group instead of the current user. If \/A<\/code> is not specified, file ownership will be given to the currently logged-on user. This parameter is not<\/strong> case-sensitive.<\/li>\n<\/ul>\nIf the operation was successful, you should see the following message:<\/p>\n
“SUCCESS: The file (or folder): “filename” now owned by user “Computer Name\\User name”.”<\/i><\/p>\n
or<\/p>\n
SUCCESS: The file (or folder): “filename” now owned by the administrators group.<\/p><\/blockquote>\n
<\/a>Assign File Permissions<\/h3>\nThen to grant Administrators<\/b> Full Control permissions for the file, use ICACLS<\/b>. Here is the syntax:<\/p>\nicacls <filename><\/i> \/grant administrators:F<\/pre>\n\nNote: On non-English Windows installations, the error “No mapping between account names and security IDs was done” occurs when running the above command because the built-in admininstrator account name may be different in non-English versions. In that case, you can use the SID instead of the account name.<\/p>\nRun:<\/p>\n
icacls <filename><\/i> \/grant *S-1-5-32-544:F<\/pre>\nThe command works in English as well as non-English Windows OS.<\/p>\n<\/div>\n
Example 2: To assign Full Control permissions for the currently logged on user, use this command:<\/p>\n
icacls <filename><\/i> \/grant %username%:F<\/pre>\n%username%<\/b> represents the account name of the currently logged-on user. ICacls accepts this variable directly.<\/i><\/p>\n
Example 3: To assign Full Control permissions for the user named John<\/code>, use this command:<\/p>\nICACLS <filename><\/i> \/grant John:F<\/pre>\n
\n<\/a>Taking ownership of a folder<\/h3>\nUse the following syntax:<\/p>\n
takeown \/f <foldername><\/i><\/pre>\n(or)<\/p>\n
takeown \/f <foldername> \/a<\/i><\/pre>\n\n\/a<\/code> Gives ownership to the Administrators group instead of the current user. If \/a<\/code> is not specified, ownership will be given to the currently logged-on user. This parameter is not<\/strong> case-sensitive.<\/li>\n<\/ul>\nYou’ll see the following output:<\/p>\n
SUCCESS: The file (or folder): “folder_name” now owned by by user “computername\\username”<\/p>\n
(or)<\/p>\n
SUCCESS: The file (or folder): “folder_name” now owned by the administrators group.<\/p><\/blockquote>\n
Change ownership recursively:<\/h4>\n
To change the ownership of a folder, its subfolders, and files in each subfolder, use this syntax:<\/p>\n
takeown \/f <foldername><\/i> \/r \/d y<\/pre>\nThe currently logged on user is now the owner of the folder.<\/em><\/p>\nTo set Administrators<\/code> group the owner of the folder, its subfolders, and files recursively, use the \/A<\/code> switch in addition:<\/p>\ntakeown \/f <foldername> \/a \/r \/d y<\/i><\/pre>\n\n\/R<\/code> Recurse: instructs the tool to operate on files in the specified directory and all subdirectories.<\/li>\n\/D<\/code> prompt Default answer used when the current user does not have the “list folder” permission on a directory. This occurs while operating recursively (\/R) on sub-directories. Valid values “Y” to take ownership or “N” to skip.<\/li>\n<\/ul>\n<\/a>Assign Folder Permissions<\/h3>\nThen to assign the Administrators<\/b> group Full Control Permissions for the folder, use this syntax:<\/p>\nicacls <foldername><\/i> \/grant administrators:F \/T<\/pre>\n\nNote: On non-English Windows installations, the error “No mapping between account names and security IDs was done” occurs when running the above command because the built-in admininstrator account name may be different in non-English versions. In that case, you can use the SID instead of the account name.<\/p>\nRun:<\/p>\n
icacls <foldername><\/i> \/grant *S-1-5-32-544:F \/T<\/pre>\nThe command works in English as well as non-English Windows OS.<\/p>\n<\/div>\n
The \/T<\/b> parameter is added so that the operation is carried out through all the sub-directories and files within that folder.<\/p>\nCommand-line help:<\/h4>\n
To know the complete usage information for Takeown.exe and ICacls.exe, run these commands from a Command Prompt window.<\/p>\n
takeown \/?<\/b><\/pre>\nicacls \/?<\/b><\/pre>\n
\n<\/a>Easier Methods for Taking Ownership<\/h3>\nCommand Script<\/h4>\n
To further simplify the process of taking ownership, Tim Sneath<\/a> of Microsoft provides a .CMD file (Windows Command Script) which takes ownership and assigns Full Control Permissions to Administrators for the directory. For more information, read Tim’s post, titled Secret #11: Deleting the Undeletable<\/a>.<\/p>\nAdd the “Take Ownership” command to the right-click menu<\/h4>\n
This again uses the special runas<\/b><\/i> verb in Windows Vista and higher, which I’ve covered earlier (REF<\/b> RunAs<\/a><\/i>).<\/p>\nvia WinMatrix.com<\/a><\/p>\nDownload takeown_context.reg<\/a><\/b> and save to Desktop. Right-click on the file and choose Merge<\/b>. Click Yes<\/b> when asked for confirmation. This adds an extended command named Take Ownership<\/b> in the context menu for files and directories. To access the command, you need to press and hold the SHIFT<\/b> key and then right-click on a file or folder.<\/p>\n(You can read more about the tweak in the article Take Ownership of File or Folder via Right-click Context Menu in Windows<\/a><\/em>.)<\/p>\n
\nAdditional Information<\/h2>\n
The above section covers most of the stuff you need. Read below if you need more tips on this topic.<\/p>\n
<\/a>icacls.exe also can change ownership of a file or folder!<\/h3>\nTakeown.exe and Icacls.exe are the two built-in console tools in Windows, that lets you change file or folder ownership and assign access control permissions, respectively. Takeown.exe sets the currently logged-in user account as the owner of an object (file or folder).<\/p>\n
However, with Takeown.exe, you can’t make another account as the owner of an object.<\/p>\n
Did you know that the icacls.exe tool can also be used to change ownership?<\/em><\/p>\nTo change the ownership to a third-party account (i.e., the account that’s not currently logged in) or group, you may use icacls.exe with the \/setowner<\/code> command-line argument, instead of takeown.exe.<\/p>\nChange ownership of a file or folder using icacls.exe<\/h3>\n
We saw how to change the ownership using icacls.exe in the last part of the article Take Ownership of a File or Folder Using Command-Line in Windows<\/a>. Here are some more examples:<\/p>\nThe following is the command-line syntax to change the ownership of a file or folder using icacls.exe:<\/p>\n
icacls \"file_or_folder_name\" \/setowner \"NT Service\\TrustedInstaller\"<\/pre>\nExamples: Set #1: Change ownership of a single file or folder<\/h4>\nicacls \"D:\\Annual Reports\\2020\\November\" \/setowner \"John\"<\/pre>\nicacls \"D:\\Tax Audit\\November.xlsx\" \/setowner \"John\"<\/pre>\nicacls \"D:\\Tax Audit\\November.xlsx\" \/setowner \"Administrators\"<\/pre>\nIf the operation was successful, you’ll see the following message:<\/p>\n
processed file: file_or_folder_name<\/em>\nSuccessfully processed 1 files; Failed processing 0 files<\/pre>\nExample #2: Change ownership for a folder (subfolder, and files) recursively<\/h4>\n
To change the ownership of a folder, its subfolders, and all the files in all subfolders recursively, use the \/T<\/code> switch (traverse) in addition:<\/p>\nicacls \"folder_name\" \/setowner \"Administrators\" \/T<\/pre>\n
\n\/T<\/code> indicates that this operation is performed on all matching files\/directories below the directories specified in the name.<\/li>\n<\/ul>\nThe above command sets TrustedInstaller as the owner of the folder, its subfolders, and all the files in all the subfolders.<\/p>\n
\n<\/a>Revert the Ownership back to TrustedInstaller<\/h3>\nSometimes, to fix an issue, you may need to alter a data file<\/a> such as XML or a registry key<\/a> owned by TrustedInstaller. For that, you first need to take ownership of the file, folder, or registry key<\/a>.<\/p>\nAfter modifying the files or settings, you need to revert the ownership back to TrustedInstaller<\/strong>, if TrustedInstaller was the previous or original owner. To set the ownership back to TrustedInstaller, use these steps:<\/p>\nThe Windows Modules Installer service or TrustedInstaller enables the installation, modification, and removal of Windows updates and optional components. By default, TrustedInstaller is also the owner of many critical registry keys and system files.<\/em><\/p>\n\n- Right-click on a file or registry key, and click Permissions.<\/li>\n
- Click Advanced to open the Advanced Security Settings dialog.<\/li>\n
- Near “Owner:”, click Change.<\/li>\n
- In the Select User or Group dialog, type “
NT SERVICE\\TrustedInstaller<\/code>” and press ENTER.
\n<\/li>\n- Click Apply, OK.
\n<\/li>\n<\/ol>\nThis changes the object’s ownership (file, folder, or registry key<\/a>) to TrustedInstaller or Windows Modules Installer.<\/p>\nRELATED:<\/strong> Take Ownership of a Registry Key & Assign Permissions Using Command-line<\/a><\/div>\nUsing icacls.exe command to set TrustedInstaller as the owner of a file<\/h4>\n
From an admin Command Prompt window, use the following command-line syntax:<\/p>\n
icacls \"path\\filename\" \/setowner \"NT Service\\TrustedInstaller\"<\/pre>\nExample:<\/p>\n
icacls \"C:\\Windows\\PolicyDefinitions\\WindowsStore.admx\" \/setowner \"NT Service\\TrustedInstaller\"<\/pre>\nTrustedInstaller now owns the file WindowsStore.admx.<\/p>\n
\n<\/a>icacls \/setowner access denied?<\/h3>\nSometimes, the icacls.exe \/setowner<\/code> command-line can encounter the following error:<\/p>\nfilename: Access is denied.\nSuccessfully processed 0 files; Failed processing 1 files<\/pre>\nThis can happen when it encounters an NTFS hard link. The error usually pops up when you attempt to change ownership of protected files in the Windows directory — e.g., C:\\Windows\\Notepad.exe<\/code>. A hard link<\/a> is the file system representation of a file by which more than one path references a single file in the same volume.<\/p>\nFor example, the Notepad.exe files have two hard-linked files, which you can see using the following command:<\/p>\n
fsutil.exe hardlink list C:\\Windows\\notepad.exe<\/pre>\n<\/p>\n
You can see that Notepad.exe is hard-linked to the following files:<\/p>\n
C:\\Windows\\System32\\Notepad.exe\nC:\\\\Windows\\WinSxS\\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.488_none_4cea9379ceedab35\\notepad.exe<\/pre>\nThe icacls.exe \/setowner<\/code> command encounters the ACCESS_DENIED<\/code> error when processing these hard links.<\/p>\nNote that the icacls.exe documentation says, “This option does not force a change of ownership; use the takeown.exe utility for that purpose.”<\/em><\/p>\nIf you encounter “Access is Denied” errors when setting ownership using Icacls, you may have to rely on Takeown.exe, SubInACL, or the third-party SetACL.exe (see next paragraph) command-line utility.<\/p>\n
\n<\/a>Using SetACL.exe to take ownership and assign permissions<\/h3>\n
Windows includes a command-line tool named Takeown.exe,<\/b> which can be used from an admin Command Prompt<\/a> to quickly change the ownership of a file or folder. Here is how to take ownership of a file or folder<\/strong> and then assign permissions for an account using the command-line.<\/p>\n Open an elevated Command Prompt<\/a> window. Use the following syntax to take ownership of a file:<\/p>\n Replace <\/i><filename><\/i><\/b> with the actual file name with the full path.<\/i><\/p>\n The currently logged on user is now the owner of the file.<\/em><\/p>\n To set If the operation was successful, you should see the following message:<\/p>\n “SUCCESS: The file (or folder): “filename” now owned by user “Computer Name\\User name”.”<\/i><\/p>\n or<\/p>\n SUCCESS: The file (or folder): “filename” now owned by the administrators group.<\/p><\/blockquote>\n Then to grant Administrators<\/b> Full Control permissions for the file, use ICACLS<\/b>. Here is the syntax:<\/p>\n Run:<\/p>\n The command works in English as well as non-English Windows OS.<\/p>\n<\/div>\n Example 2: To assign Full Control permissions for the currently logged on user, use this command:<\/p>\n %username%<\/b> represents the account name of the currently logged-on user. ICacls accepts this variable directly.<\/i><\/p>\n Example 3: To assign Full Control permissions for the user named Use the following syntax:<\/p>\n (or)<\/p>\n You’ll see the following output:<\/p>\n SUCCESS: The file (or folder): “folder_name” now owned by by user “computername\\username”<\/p>\n (or)<\/p>\n SUCCESS: The file (or folder): “folder_name” now owned by the administrators group.<\/p><\/blockquote>\n To change the ownership of a folder, its subfolders, and files in each subfolder, use this syntax:<\/p>\n The currently logged on user is now the owner of the folder.<\/em><\/p>\n To set Then to assign the Administrators<\/b> group Full Control Permissions for the folder, use this syntax:<\/p>\n Run:<\/p>\n The command works in English as well as non-English Windows OS.<\/p>\n<\/div>\n The \/T<\/b> parameter is added so that the operation is carried out through all the sub-directories and files within that folder.<\/p>\n To know the complete usage information for Takeown.exe and ICacls.exe, run these commands from a Command Prompt window.<\/p>\n To further simplify the process of taking ownership, Tim Sneath<\/a> of Microsoft provides a .CMD file (Windows Command Script) which takes ownership and assigns Full Control Permissions to Administrators for the directory. For more information, read Tim’s post, titled Secret #11: Deleting the Undeletable<\/a>.<\/p>\n This again uses the special runas<\/b><\/i> verb in Windows Vista and higher, which I’ve covered earlier (REF<\/b> RunAs<\/a><\/i>).<\/p>\n via WinMatrix.com<\/a><\/p>\n (You can read more about the tweak in the article Take Ownership of File or Folder via Right-click Context Menu in Windows<\/a><\/em>.)<\/p>\n The above section covers most of the stuff you need. Read below if you need more tips on this topic.<\/p>\n Takeown.exe and Icacls.exe are the two built-in console tools in Windows, that lets you change file or folder ownership and assign access control permissions, respectively. Takeown.exe sets the currently logged-in user account as the owner of an object (file or folder).<\/p>\n However, with Takeown.exe, you can’t make another account as the owner of an object.<\/p>\n Did you know that the icacls.exe tool can also be used to change ownership?<\/em><\/p>\n To change the ownership to a third-party account (i.e., the account that’s not currently logged in) or group, you may use icacls.exe with the We saw how to change the ownership using icacls.exe in the last part of the article Take Ownership of a File or Folder Using Command-Line in Windows<\/a>. Here are some more examples:<\/p>\n The following is the command-line syntax to change the ownership of a file or folder using icacls.exe:<\/p>\n If the operation was successful, you’ll see the following message:<\/p>\n To change the ownership of a folder, its subfolders, and all the files in all subfolders recursively, use the The above command sets TrustedInstaller as the owner of the folder, its subfolders, and all the files in all the subfolders.<\/p>\n Sometimes, to fix an issue, you may need to alter a data file<\/a> such as XML or a registry key<\/a> owned by TrustedInstaller. For that, you first need to take ownership of the file, folder, or registry key<\/a>.<\/p>\n After modifying the files or settings, you need to revert the ownership back to TrustedInstaller<\/strong>, if TrustedInstaller was the previous or original owner. To set the ownership back to TrustedInstaller, use these steps:<\/p>\n The Windows Modules Installer service or TrustedInstaller enables the installation, modification, and removal of Windows updates and optional components. By default, TrustedInstaller is also the owner of many critical registry keys and system files.<\/em><\/p>\n This changes the object’s ownership (file, folder, or registry key<\/a>) to TrustedInstaller or Windows Modules Installer.<\/p>\n From an admin Command Prompt window, use the following command-line syntax:<\/p>\n Example:<\/p>\n TrustedInstaller now owns the file WindowsStore.admx.<\/p>\n Sometimes, the This can happen when it encounters an NTFS hard link. The error usually pops up when you attempt to change ownership of protected files in the Windows directory — e.g., For example, the Notepad.exe files have two hard-linked files, which you can see using the following command:<\/p>\n You can see that Notepad.exe is hard-linked to the following files:<\/p>\n The Note that the icacls.exe documentation says, “This option does not force a change of ownership; use the takeown.exe utility for that purpose.”<\/em><\/p>\n If you encounter “Access is Denied” errors when setting ownership using Icacls, you may have to rely on Takeown.exe, SubInACL, or the third-party SetACL.exe (see next paragraph) command-line utility.<\/p>\n<\/p>\n<\/a>Taking ownership of a file<\/h3>\n
takeown \/f <filename><\/i><\/pre>\n
Administrators<\/code> group the owner of the file, use the \/A<\/code> switch in addition:<\/p>\ntakeown \/f <filename> \/a<\/i><\/pre>\n
\n
\/A<\/code> Gives ownership to the Administrators group instead of the current user. If \/A<\/code> is not specified, file ownership will be given to the currently logged-on user. This parameter is not<\/strong> case-sensitive.<\/li>\n<\/ul>\n<\/a>Assign File Permissions<\/h3>\n
icacls <filename><\/i> \/grant administrators:F<\/pre>\n
icacls <filename><\/i> \/grant *S-1-5-32-544:F<\/pre>\n
icacls <filename><\/i> \/grant %username%:F<\/pre>\n
John<\/code>, use this command:<\/p>\nICACLS <filename><\/i> \/grant John:F<\/pre>\n
\n<\/a>Taking ownership of a folder<\/h3>\n
takeown \/f <foldername><\/i><\/pre>\n
takeown \/f <foldername> \/a<\/i><\/pre>\n
\n
\/a<\/code> Gives ownership to the Administrators group instead of the current user. If \/a<\/code> is not specified, ownership will be given to the currently logged-on user. This parameter is not<\/strong> case-sensitive.<\/li>\n<\/ul>\nChange ownership recursively:<\/h4>\n
takeown \/f <foldername><\/i> \/r \/d y<\/pre>\n
Administrators<\/code> group the owner of the folder, its subfolders, and files recursively, use the \/A<\/code> switch in addition:<\/p>\ntakeown \/f <foldername> \/a \/r \/d y<\/i><\/pre>\n
\n
\/R<\/code> Recurse: instructs the tool to operate on files in the specified directory and all subdirectories.<\/li>\n\/D<\/code> prompt Default answer used when the current user does not have the “list folder” permission on a directory. This occurs while operating recursively (\/R) on sub-directories. Valid values “Y” to take ownership or “N” to skip.<\/li>\n<\/ul>\n<\/a>Assign Folder Permissions<\/h3>\n
icacls <foldername><\/i> \/grant administrators:F \/T<\/pre>\n
icacls <foldername><\/i> \/grant *S-1-5-32-544:F \/T<\/pre>\n
Command-line help:<\/h4>\n
takeown \/?<\/b><\/pre>\n
icacls \/?<\/b><\/pre>\n
\n<\/a>Easier Methods for Taking Ownership<\/h3>\n
Command Script<\/h4>\n
Add the “Take Ownership” command to the right-click menu<\/h4>\n
Download takeown_context.reg<\/a><\/b> and save to Desktop. Right-click on the file and choose Merge<\/b>. Click Yes<\/b> when asked for confirmation. This adds an extended command named Take Ownership<\/b> in the context menu for files and directories. To access the command, you need to press and hold the SHIFT<\/b> key and then right-click on a file or folder.<\/p>\n
\nAdditional Information<\/h2>\n
<\/a>icacls.exe also can change ownership of a file or folder!<\/h3>\n
\/setowner<\/code> command-line argument, instead of takeown.exe.<\/p>\nChange ownership of a file or folder using icacls.exe<\/h3>\n
icacls \"file_or_folder_name\" \/setowner \"NT Service\\TrustedInstaller\"<\/pre>\n
Examples: Set #1: Change ownership of a single file or folder<\/h4>\n
icacls \"D:\\Annual Reports\\2020\\November\" \/setowner \"John\"<\/pre>\n
icacls \"D:\\Tax Audit\\November.xlsx\" \/setowner \"John\"<\/pre>\n
icacls \"D:\\Tax Audit\\November.xlsx\" \/setowner \"Administrators\"<\/pre>\n
processed file: file_or_folder_name<\/em>\nSuccessfully processed 1 files; Failed processing 0 files<\/pre>\n
Example #2: Change ownership for a folder (subfolder, and files) recursively<\/h4>\n
\/T<\/code> switch (traverse) in addition:<\/p>\nicacls \"folder_name\" \/setowner \"Administrators\" \/T<\/pre>\n
\n
\/T<\/code> indicates that this operation is performed on all matching files\/directories below the directories specified in the name.<\/li>\n<\/ul>\n
\n<\/a>Revert the Ownership back to TrustedInstaller<\/h3>\n
\n
NT SERVICE\\TrustedInstaller<\/code>” and press ENTER.
\n<\/li>\n
\n<\/li>\n<\/ol>\nUsing icacls.exe command to set TrustedInstaller as the owner of a file<\/h4>\n
icacls \"path\\filename\" \/setowner \"NT Service\\TrustedInstaller\"<\/pre>\n
icacls \"C:\\Windows\\PolicyDefinitions\\WindowsStore.admx\" \/setowner \"NT Service\\TrustedInstaller\"<\/pre>\n
\n<\/a>icacls \/setowner access denied?<\/h3>\n
icacls.exe \/setowner<\/code> command-line can encounter the following error:<\/p>\nfilename: Access is denied.\nSuccessfully processed 0 files; Failed processing 1 files<\/pre>\n
C:\\Windows\\Notepad.exe<\/code>. A hard link<\/a> is the file system representation of a file by which more than one path references a single file in the same volume.<\/p>\nfsutil.exe hardlink list C:\\Windows\\notepad.exe<\/pre>\n
<\/p>\nC:\\Windows\\System32\\Notepad.exe\nC:\\\\Windows\\WinSxS\\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.488_none_4cea9379ceedab35\\notepad.exe<\/pre>\n
icacls.exe \/setowner<\/code> command encounters the ACCESS_DENIED<\/code> error when processing these hard links.<\/p>\n
\n<\/a>Using SetACL.exe to take ownership and assign permissions<\/h3>\n