12

I have a folder that I can't access from an account that is part of the Administrators group on windows 7.

If I bring up the Security tab on the properties, I see "You do not have permission to view or edit this object's permission settings".

If I click on advanced and go to the owner tab, it tells me that it is "Unable to display current owner."

I can get access to the folder by re-assigning ownership, but this destroys the current permissions on the folder.

So, is there some way of giving admins access to the folder without taking control and destroying the current permissions.

4
  • Taking ownership does not (or at least, should not) destroy the current permissions on the folder. (I've just tried this out and it worked as expected - the permissions were unchanged.) To be on the safe side, you might prefer to use the command-line tool, takeown, instead of the GUI tools. This tool definitely won't change the permissions. Nov 14, 2011 at 2:51
  • Well, after taking ownership, I can't see any permisssions except for the account that just took ownership. Other folders seem to behave properly. I suppose it's possible that the folder was created without any permissions for anybody or had them all stripped out but it seems odd though. Nov 14, 2011 at 15:56
  • The process of taking ownership shouldn't have changed the permissions at all, not even by adding your account. Did you use the takeown command-line tool or Explorer's Advanced Security Settings dialog? Nov 15, 2011 at 1:57
  • Tried it both ways. As I said, other folders seem to behave properly when the owner is changed. I've come to the conclusion that it must have had no permissions for anybody to start with. So it just looked like it had deleted all the old permissions when I took ownership. Nov 18, 2011 at 12:06

4 Answers 4

12

Some careful digging reveals that taking ownership sometimes destroys existing permissions and sometimes doesn't. It all seems to depend on whether you try and do it recursively. Note that Windows does warn you when it is going to replace the existing permissions, but (in the GUI at least) it's very easy to just OK the message without reading or understanding it fully.

To see it, you'll need a directory (c:\SomeFolder in this example) that is owned by a different user account and to which you and the administrators group have zero access.

Command Line

Using the command line "takeown" tool:

TAKEOWN /A /R /F c:\SomeFolder

you should see something like

SUCCESS: The file (or folder) "c:\SomeFolder" is now owned by the administrators group.

You do not have permissions to read the contents of the directory "c:\SomeFolder"

Do you want to replace the directory permissions with permissions granting you full control ("Y" for YES, "N" for NO, "C" for CANCEL)?

Note that if you answer yes here, it really does mean replace the permissions. Any existing permissions will get destroyed. If you answer no, you still have no permissions on the folder but are now the owner so can give yourself permissions normally and without destroying any that already exist.

If you don't specify the recursive flag (/R), you don't get the warning and the owner is changed without affecting any other permissions.

GUI

You'll need to use the "security" tab of the properties window to alter anything via the GUI. This gives you two buttons: "continue" and "advanced". Advanced gives you a window with the four tabs: "permissions", "auditing", "owner" and "effective permissions". Continue gives you just the "owner" tab.

If you select a new owner and tick the "apply to sub-folders" box, hitting OK or apply gives you a "Do you want to replace the permissions" message box that, again, really does mean replace permissions. If you don't check the sub-folders box, you don't get the warning and everything behaves as expected.

It is very easy to not read this message box fully, assume it's just another box asking you to confirm something non-destructive and just hit enter to OK it. It's also very easy to assume they couldn't possibly really mean replace because nobody sane would ever want to do that.

3

If you are not listed as "can read/change permissions" in the folder's ACL, you cannot change them, no matter who or what you are. All Users, Administrators, Builtins, even nt authority\system, are treated equally by the security code. (The system-wide "Take ownership" privilege is an exception, but it cannot modify the ACL either, only reset it.)

You must log in as someone who is allowed to do this, either directly (username + password) or – if you have a lot of spare time – by doing some SeCreateTokenPrivilege wizardry.

11
  • Can I add that permission to the administrators group? Nov 11, 2011 at 12:02
  • 3
    That's not true. The owner of a file can always both read and modify the permissions, and taking ownership doesn't change the permissions themselves. Nov 14, 2011 at 2:44
  • 1
    Also, note that a program running as administrator can read the permissions and ownership of any file by using the backup privilege. MS just haven't provided any programs to do this. :-( Nov 14, 2011 at 2:53
  • 1
    Oh, and you can use restore privilege to change permissions and ownership too. Nov 14, 2011 at 2:55
  • 1
    @grawity: I've just repeated the experiment (using an ACL that didn't grant me permission) and the ACL was not reset when I took ownership. Are you sure you're not thinking of Explorer's "Click Continue to permanently get access to this folder" dialog, as opposed to the security tab Owner dialog? Nov 15, 2011 at 1:55
0

It is OK to use the "Replace owner on subcontainers and objects" checkbox highlighted in green. It is not OK to sue the "Replace all child object permissions entries" checkbox highlighted in red. The latter one will replace existing ACLs (permissions) rather than just changing the owner. NTFS Security Dialog Box

1
  • I'm assuming that this is a Windows 10 dialog? The Windows 7 version doesn't have that checkbox. Sep 25, 2019 at 12:17
0

Old question but still high on the Google results. And it's missing a significant answer...

It is actually possible to grant yourself access while preserving existing permissions, but you need to get hold of subinacl.exe, a little command line tool originally from Microsoft's Windows Resource Kits.

subinacl /file "examplefileorfolder" /grant=mydomain\myusername=F

You need local admin access on the target obviously (run from elevated command prompt).

You can also do it recursively for example:

subinacl /subdirectories "C:\examplefolder\*" /grant=mydomain\myusername=F

But recursively does create an explicit ACE (not inherited) at every single subfolder at every level, which is very messy if you have a fairly big directory structure. Also note you need the asterisk, recursion doesn't work without that for some reason.

I'd only reccomend using it as a last resort though, and practice it on a test area first with some none-essential data, as it's an old utility, and can be a bit temperamental if using recursion (subdirectories) as explained above.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.