Why do I get a privilege error when running “takeown” from the command line?

Question

I am part of the Administrators group. I have a file which I can change ownership from myself to HOSTNAME\Administrators and back just fine using the Security tab in the file properties.

I can also take ownership using this fine script from the internet which provides a context menu when right-clicking on a file.

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\*\shell\runas]
@="Take Ownership"
"NoWorkingDirectory"=""

[HKEY_CLASSES_ROOT\*\shell\runas\command]
@="cmd.exe /c takeown /f \"%1\" && icacls \"%1\" /grant administrators:F"
"IsolatedCommand"="cmd.exe /c takeown /f \"%1\" && icacls \"%1\" /grant administrators:F"

[HKEY_CLASSES_ROOT\Directory\shell\runas]
@="Take Ownership"
"NoWorkingDirectory"=""

[HKEY_CLASSES_ROOT\Directory\shell\runas\command]
@="cmd.exe /c takeown /f \"%1\" /r /d y && icacls \"%1\" /grant administrators:F /t"
"IsolatedCommand"="cmd.exe /c takeown /f \"%1\" /r /d y && icacls \"%1\" /grant administrators:F /t"

However, opening an unprivileged command prompt in the directory is denying me permission when I invoke "takeown" from it:

C:\path>takeown /f "file"
ERROR: The current logged on user does not have ownership privileges on
       the file (or folder) "C:\path\file".

Why do I need to invoke explicit administrative permission with an elevated command prompt when this registry thing invoked from an unprivileged explorer window can change things without a problem?

Answer 1

To take ownership, any program needs to explicitly ask for itself the SeTakeOwnershipPrivilege permission from Windows.

See Process Privileges where this is defined as :

So it seems as if Windows Explorer took care to allocate itself this permission, but for cmd it is only granted when executing with elevated permissions. A cmd launched from inside Windows Explorer will inherit its parent permissions, and so will be able to take ownership.