Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I made a very dumb mistake and I am hoping there is a way to fix this without having to boot in through a Linux Live CD and extracting the data.

My user login to my Windows 7 system is: John John is part of the Administrator's group.

I have a folder called "C:\Users\John"

I tried to make this folder accessible to ONLY John (and deny from all other Administrators) by going to the Folder, Right Click > Secturity tab and then selecting all the checkboxes under "Deny" while having selected the "Administrators" group.

As a result, I cannot access this folder from any of the accounts: "John" and "Administrator" as both of them belong to the Administrators groupd and deny permissions out-weigh the "Allow Permissions"

Is there any way I could revert this back? Thanks a million!

share|improve this question
FYI, If a user is an administrator, they can just take ownership of the folder and change the permissions to whatever they want. You're not really protecting anything. – MDMarra Mar 13 '10 at 21:10
up vote 4 down vote accepted

The easiest thing to do is to put in your Windows disk (or get to any command prompt, if you can logon as administrator) and then go to the command prompt and type:

`cacls c:\users\john /t /e /g Administrators:f`

This should give the administrators group full control over the folder.

If you can logon as Administrator, you should also be able to do it from the GUI by going into advanced and replacing file permissions, however, it is much easier using the above at the command prompt.

share|improve this answer

If you've given "John" full permissions, and then denied the Adminsitrators group, perhaps simply remove John from the Administators group.

That way the deny won't affect him, but "John" still has full permissions, so he can remove the deny.

Then make John an admin again.

share|improve this answer

Because the user John can no longer even load its own profile, since it's denied access, you'll have to log in from another account. Try logging into another Administrator account. Then, go change the permissions. Even though the administrator account is denied access, it may still be able to change the permissions. If not, you can try using the admin account to take ownership of the file.

To take ownership, log in as an admin. Browser to where the folder is. Go to the security dialog, and click "Advanced". Go to the "owner" tab, and click "Edit". Select who to set the owner to - you'll have to set either the logged in user or the administrators group as the owner. Once you've taken ownership, revert the security privileges. Then, log back in as John (which should work now), use John to take ownership (so that John owns his own files).

Finally, what you want to do is uncheck all of the "allow" boxes for the administrators group, but you don't want to "deny" access to it, since as you found out, that overrides "allow" access. Un-allowing is usually preferable to denying.

Taking ownership

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.