95

Somehow I accidentally set all the files in a subfolder to "No Owner' and I can't seem to change all the permissions. I can change one by hand by changing the owner then setting permissions but how can I change owner of all the files in this directory at once?

92

Use takeown from the command prompt to take ownership a folder, all its subfolders and files recursively:

takeown /f "c:\folder\subfolder" /r

This works well, but if you don't run your command line console as administrator it may fail for files you don't own.

105

To fix really broken permissions, the best is to run these two commands one after the other:

takeown /f "C:\path\to\folder" /r
icacls "C:\path\to\folder" /reset /T

The first one will give you ownership of all the files, however that might not be enough, for example if all the files have the read/write/exec permissions set to "deny". You own the files but still cannot do anything with them.

In that case, run the second command, which will fix the broken permissions.

  • 3
    Excellent technical advice ... your solution was the only one that worked. Thanks again. – carrabino Aug 24 '14 at 21:11
  • 4
    Best advice, need to use both takeown and icacls. – gnac Dec 2 '14 at 23:41
  • 2
    /A option is useful if you wish to give 'ownership to the administrators group instead of the current owner'. You need to have Administrators privileges to do this. May need to open cmd window using ctrl-shift-enter. – PeterVermont Dec 2 '15 at 15:40
  • 4
    I've added the /D Y parameter to takeown so it auto-confirms recursed directories where you don't have 'list directory' permissions for. – Jeroen Wiert Pluimers Jul 6 '16 at 14:51
  • 3
    @JeroenWiertPluimers, although it's a good advice I've removed the edit as it's (stupidly enough) a localised parameter so on English Windows it will be /D Y, on French one /D O, maybe on Spanish /D S, etc. – laurent Apr 18 '17 at 9:44
26

Note that cacls is deprecated (since Windows Vista?) and it advises you to use icacls.

This command will recursively reset the permissions on a folder:

icacls "C:\path\to\folder" /reset /T
5

You can use cacls from the command prompt:

cacls "C:\path\to\folder" /E /T /C /G "Administrator":F

The /T switch allows it to function recursively. Replace Administrator with the user you wish to give permissions to.

1

I had problems with files with very long paths (greater than 256 characters). The two commands

takeown /f "C:\path\to\really_long_folder_name" /r
icacls "C:\path\to\really_long_folder_name" /reset /T

worked except for these files with really long paths and names. I ended up renaming

"C:\path\to\really_long_folder_name"

to

"C:\path\to\r"

and then running

takeown /f "C:\path\to\r" /r /D Y
icacls "C:\path\to\r" /grant Everyone:(F) /t /c /q

after which I could rename the folders to something more sensible. takeown's /D Y answers yes to prompts. For icacls I used /grant to give full access to everyone (as I was just trying to access data on a hard drive from a dead PC), with /t to process sub folders and files, /q to run in quiet mode (hide successes) and /c to show errors. I repeated the process, renaming folders until all the files permissions were updated successfully.

Hopefully this helps someone who has come across errors similar to the "failed to enumerate objects in the container access is denied" errors I was getting when trying to gain access to the data from an old hard drive.

0

Thanks @this.lau_ for the /reset tip, this is exactly what I needed to complete my script to take ownership of the CSC and make a backup of it. After taking ownership of C:\Windows\CSC the permissions tend to get very inconsistent regarding inheritance - the /reset switch fixed this straight up for me.

Function Copy-CSCData {
    $Datetime = Get-Date -Format yyyyMMdd.hhmmss
    $LogPath = 'PATH TO LOG'
    $CSCSource = 'C:\Windows\CSC\v2.0.6\namespace'
    $Dest = 'DESTINATION PATH'
    $icaclsource = "\\?\" + $CSCSource

    $CSCLogfile = "$LogPath\" + "$Datetime" + "_CSCRobocopy.log"

    icacls.exe $icaclsource /reset /T
    icacls.exe $icaclsource /grant :r "Everyone:(OI)(CI)F"

    Robocopy $CSCSource $Dest /Copy:DATSO /E /XO /Z /LOG+:$CSCLogfile /V /FP /NP /R:2 /W:2 /XF "~$*","*.tmp"
}

@Thesle Williams - if you check out the $icaclsource variable from above you notice I add "\?\" in front of the source path. By adding this in the front, it will accept longer file names. This is also a problem I had but this fixed it! Cheers.

Josh

  • Welcome to Super User! Just letting you know that "pinging" users only works in comments to posts, not in the actual posts. Unfortunately you can't comment on posts other than your own, or on answers to your questions, until you have 50+ reputation. See How do comment @replies work?. Note that you can't just ping anyone in a comment. Only the author of the post and any other user that has already commented. – robinCTS Jun 16 '18 at 2:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy