Access Denied on a Folder You Own: Fixes That Work

The Symptom

You double-click a folder and Windows reports “You have been denied permission to access this folder” or “Access is denied”. You are logged in as an administrator, the folder is on your own machine, and the error persists even after you try to change permissions. This page explains why that happens and the exact steps to fix it, in order from least to most destructive.

Why Being an Administrator Isn’t Enough

Windows evaluates access to a folder by checking the access token of the process that is trying to open it. That token contains the security identifiers (SIDs) of your user account and the groups you belong to, along with the privileges those groups carry. The folder’s access control list (ACL) is a list of entries that say which SIDs are allowed or denied which operations. When you try to open the folder, Windows walks the ACL and checks your token against it. If no entry grants you the needed permission, you get the error.

Being a member of the Administrators group does not automatically grant you access to every folder. The ACL is the final authority. A folder can explicitly deny access to Administrators, or it can simply not include them. In many cases, the folder’s ACL grants access only to the system account (SYSTEM) or to a specific service account, and the interactive user is not listed at all.

User Account Control (UAC) strips privileges from your token. When you log on, Windows creates two tokens: a full administrator token and a filtered (standard) token. By default, your processes run with the filtered token, which removes the Administrators SID and most privileges. Even if your account is in the Administrators group, the filtered token does not carry that group’s SID. This is why you can be an administrator and still get “Access Denied” on a folder that grants access to Administrators. To use the full token, you must run the program as administrator (right-click → Run as administrator).

The Correct Fixes, In Order

1. Run the Explorer Window as Administrator

If the folder is one that grants access to Administrators, the filtered token is the only thing blocking you. Running Explorer with the full token often solves it without changing any permissions.

1. Press Ctrl+Shift+Esc to open Task Manager.
2. Click File → Run new task.
3. Type explorer.exe and check Create this task with administrative privileges.
4. Click OK. A new Explorer window opens with your full token. Try to open the folder from there.

If that works, you have confirmed the problem is UAC filtering, not a broken ACL. You can then decide whether to change the folder’s permissions (step 3) or just use this method each time.

2. Check the Folder’s Permissions

Before changing anything, look at what the ACL actually says. This tells you which diagnosis applies.

1. Right-click the folder → Properties → Security tab.
2. Click Advanced.
3. Look at the Permission entries list. Note which users or groups are listed and what their Access is (e.g., Full control, Read, Modify).
4. If you see Deny entries, those take precedence over Allow entries for the same user or group. A deny entry for your account or a group you belong to will block you regardless of other allows.

If the folder’s owner is TrustedInstaller or SYSTEM and no entry grants you access, you have a system folder or a folder owned by a service. Do not take ownership of system folders (see the “What People Get Wrong” section). Instead, use the appropriate method below.

3. Change Permissions on a Folder You Own

If the folder is yours (e.g., a folder you created or a user profile folder) and you need to grant your account access, you can modify the ACL. This is safe when you are the owner or have the right to change permissions.

1. Open the folder’s Properties → Security tab.
2. Click Edit to change permissions.
3. Select your user account in the Group or user names list, or click Add to add it.
4. Check Full control in the Allow column.
5. Click Apply and OK.

If the Edit button is greyed out or you get an error, you may need to take ownership first (step 4).

4. Take Ownership Only When Necessary

Taking ownership changes the owner of the folder to your account. The owner can always change permissions, even if the current ACL denies it. This is a powerful step and should be used only when you are certain the folder is not a system folder and you need to regain access.

What this destroys: Taking ownership does not delete data, but it changes the security principal that controls the folder. If the folder is a system folder (e.g., C:\Windows\System32), taking ownership can break Windows updates, services, and security. Do not take ownership of any folder under C:\Windows or C:\Program Files unless you have a specific, documented reason and are prepared to restore the original owner.

To take ownership:

1. Right-click the folder → Properties → Security tab.
2. Click Advanced.
3. Next to Owner, click Change.
4. Type your username and click Check Names, then OK.
5. Check Replace owner on subcontainers and objects if you want to take ownership of everything inside.
6. Click OK and close the dialog.
7. Now you can change permissions as in step 3.

5. Use icacls for Command-Line Control

If you prefer the command line, icacls can display and modify ACLs. Run an elevated Command Prompt (right-click → Run as administrator).

To view the ACL:

icacls "C:\path\to\folder"

This lists the permission entries. The output shows entries like BUILTIN\Administrators:(OI)(CI)F which means full control.

To grant your user full control (replace with your actual username):

icacls "C:\path\to\folder" /grant "YourUsername":(OI)(CI)F

• (OI) and (CI) mean the permission inherits to files and subfolders.
• F means full control.

To remove a deny entry that is blocking you:

icacls "C:\path\to\folder" /remove:d "YourUsername"

This removes deny entries for your user. The /remove:d flag specifically targets deny entries.

6. Reset Permissions to Inherited Values

If the ACL is messed up, you can reset it to inherit from the parent folder. This is a broader fix and should be done only on folders that are not system folders.

1. Right-click the folder → Properties → Security tab.
2. Click Advanced.
3. Click Enable inheritance (if it is disabled).
4. Check Replace all child object permission entries with inheritable permission entries from this object.
5. Click OK.

This replaces the entire ACL with the inherited entries. It can fix a corrupted ACL but will also remove any custom permissions you had set.

What People Get Wrong About This

The most common advice on forums is to take ownership of the folder and then change permissions. This is a natural mistake because it is the first thing that appears in search results, and it does work for user folders. However, applying it to system folders is a disaster.

Why it is a natural mistake: The error message says “You have been denied permission,” and the obvious fix is to make yourself the owner so you can grant yourself permission. It is a logical step, and for a folder you created, it is harmless.

Why it is wrong for system folders: System folders like C:\Windows are owned by TrustedInstaller or SYSTEM for a reason. They contain critical files that Windows updates and services need to access with specific security contexts. If you take ownership and change permissions, you can break the ability of Windows to update itself, cause services to fail, and potentially make your system unstable. The fix for an access-denied error on a system folder is almost never to take ownership; it is to use the correct tool (e.g., Disk Cleanup for C:\Windows\Temp) or to run the appropriate command as administrator.

Another common mistake is to disable UAC to get rid of the filtered token. This is also misguided. Disabling UAC removes the security boundary between standard and administrator processes, making your system more vulnerable to malware. The correct approach is to run the specific program as administrator, not to disable UAC globally.

When the Fix Doesn’t Apply

When You Need to Reinstall

Reinstalling Windows is the last resort and should only be considered after all other options have failed. It destroys all data on the system drive, so back up everything first. Reinstalling is rarely necessary for access-denied errors; the fixes above resolve the vast majority of cases. If you are still stuck, the problem may be a corrupted user profile or a deeper file system issue, which can be addressed with sfc /scannow and chkdsk before resorting to a reinstall.

Summary of Commands

# View ACL on a folder
icacls "C:\path\to\folder"

# Grant full control to a user (replace with actual username)
icacls "C:\path\to\folder" /grant "YourUsername":(OI)(CI)F

# Remove deny entries for a user
icacls "C:\path\to\folder" /remove:d "YourUsername"

These commands are run from an elevated Command Prompt. The output of icacls shows the current ACL; after a successful grant, it will list your user with (OI)(CI)F.