Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a folder that I can't access from an account that is part of the Administrators group on windows 7.

If I bring up the Security tab on the properties, I see "You do not have permission to view or edit this object's permission settings".

If I click on advanced and go to the owner tab, it tells me that it is "Unable to display current owner."

I can get access to the folder by re-assigning ownership, but this destroys the current permissions on the folder.

So, is there some way of giving admins access to the folder without taking control and destroying the current permissions.

share|improve this question
    
Taking ownership does not (or at least, should not) destroy the current permissions on the folder. (I've just tried this out and it worked as expected - the permissions were unchanged.) To be on the safe side, you might prefer to use the command-line tool, takeown, instead of the GUI tools. This tool definitely won't change the permissions. –  Harry Johnston Nov 14 '11 at 2:51
    
Well, after taking ownership, I can't see any permisssions except for the account that just took ownership. Other folders seem to behave properly. I suppose it's possible that the folder was created without any permissions for anybody or had them all stripped out but it seems odd though. –  Nigel Hawkins Nov 14 '11 at 15:56
    
The process of taking ownership shouldn't have changed the permissions at all, not even by adding your account. Did you use the takeown command-line tool or Explorer's Advanced Security Settings dialog? –  Harry Johnston Nov 15 '11 at 1:57
    
Tried it both ways. As I said, other folders seem to behave properly when the owner is changed. I've come to the conclusion that it must have had no permissions for anybody to start with. So it just looked like it had deleted all the old permissions when I took ownership. –  Nigel Hawkins Nov 18 '11 at 12:06
add comment

2 Answers 2

up vote 5 down vote accepted

Some careful digging reveals that taking ownership sometimes destroys existing permissions and sometimes doesn't. It all seems to depend on whether you try and do it recursively. Note that Windows does warn you when it is going to replace the existing permissions, but (in the GUI at least) it's very easy to just OK the message without reading or understanding it fully.

To see it, you'll need a directory (c:\SomeFolder in this example) that is owned by a different user account and to which you and the administrators group have zero access.

Command Line

Using the command line "takeown" tool:

TAKEOWN /A /R /F c:\SomeFolder

you should see something like

SUCCESS: The file (or folder) "c:\SomeFolder" is now owned by the administrators group.

You do not have permissions to read the contents of the directory "c:\SomeFolder"

Do you want to replace the directory permissions with permissions granting you full control ("Y" for YES, "N" for NO, "C" for CANCEL)?

Note that if you answer yes here, it really does mean replace the permissions. Any existing permissions will get destroyed. If you answer no, you still have no permissions on the folder but are now the owner so can give yourself permissions normally and without destroying any that already exist.

If you don't specify the recursive flag (/R), you don't get the warning and the owner is changed without affecting any other permissions.

GUI

You'll need to use the "security" tab of the properties window to alter anything via the GUI. This gives you two buttons: "continue" and "advanced". Advanced gives you a window with the four tabs: "permissions", "auditing", "owner" and "effective permissions". Continue gives you just the "owner" tab.

If you select a new owner and tick the "apply to sub-folders" box, hitting OK or apply gives you a "Do you want to replace the permissions" message box that, again, really does mean replace permissions. If you don't check the sub-folders box, you don't get the warning and everything behaves as expected.

It is very easy to not read this message box fully, assume it's just another box asking you to confirm something non-destructive and just hit enter to OK it. It's also very easy to assume they couldn't possibly really mean replace because nobody sane would ever want to do that.

share|improve this answer
add comment

If you are not listed as "can read/change permissions" in the folder's ACL, you cannot change them, no matter who or what you are. All Users, Administrators, Builtins, even nt authority\system, are treated equally by the security code. (The system-wide "Take ownership" privilege is an exception, but it cannot modify the ACL either, only reset it.)

You must log in as someone who is allowed to do this, either directly (username + password) or – if you have a lot of spare time – by doing some SeCreateTokenPrivilege wizardry.

share|improve this answer
    
Can I add that permission to the administrators group? –  Nigel Hawkins Nov 11 '11 at 12:02
2  
That's not true. The owner of a file can always both read and modify the permissions, and taking ownership doesn't change the permissions themselves. –  Harry Johnston Nov 14 '11 at 2:44
1  
Also, note that a program running as administrator can read the permissions and ownership of any file by using the backup privilege. MS just haven't provided any programs to do this. :-( –  Harry Johnston Nov 14 '11 at 2:53
1  
Oh, and you can use restore privilege to change permissions and ownership too. –  Harry Johnston Nov 14 '11 at 2:55
1  
@grawity: I've just repeated the experiment (using an ACL that didn't grant me permission) and the ACL was not reset when I took ownership. Are you sure you're not thinking of Explorer's "Click Continue to permanently get access to this folder" dialog, as opposed to the security tab Owner dialog? –  Harry Johnston Nov 15 '11 at 1:55
show 6 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.