2

I am part of the Administrators group. I have a file which I can change ownership from myself to HOSTNAME\Administrators and back just fine using the Security tab in the file properties.

I can also take ownership using this fine script from the internet which provides a context menu when right-clicking on a file.

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\*\shell\runas]
@="Take Ownership"
"NoWorkingDirectory"=""

[HKEY_CLASSES_ROOT\*\shell\runas\command]
@="cmd.exe /c takeown /f \"%1\" && icacls \"%1\" /grant administrators:F"
"IsolatedCommand"="cmd.exe /c takeown /f \"%1\" && icacls \"%1\" /grant administrators:F"

[HKEY_CLASSES_ROOT\Directory\shell\runas]
@="Take Ownership"
"NoWorkingDirectory"=""

[HKEY_CLASSES_ROOT\Directory\shell\runas\command]
@="cmd.exe /c takeown /f \"%1\" /r /d y && icacls \"%1\" /grant administrators:F /t"
"IsolatedCommand"="cmd.exe /c takeown /f \"%1\" /r /d y && icacls \"%1\" /grant administrators:F /t"

However, opening an unprivileged command prompt in the directory is denying me permission when I invoke "takeown" from it:

C:\path>takeown /f "file"
ERROR: The current logged on user does not have ownership privileges on
       the file (or folder) "C:\path\file".

Why do I need to invoke explicit administrative permission with an elevated command prompt when this registry thing invoked from an unprivileged explorer window can change things without a problem?

1

To take ownership, any program needs to explicitly ask for itself the SeTakeOwnershipPrivilege permission from Windows.

See Process Privileges where this is defined as :

image

So it seems as if Windows Explorer took care to allocate itself this permission, but for cmd it is only granted when executing with elevated permissions. A cmd launched from inside Windows Explorer will inherit its parent permissions, and so will be able to take ownership.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.