Do I copy files when Windows says I don't have permission to access this folder?
Hi, everyone. Leo Notenboom here for
Askleo.com. This is a question that comes up
relatively frequently and has for many, many years.
Here's one example.
In one of your articles on recovering
files after a hard disk crash, you stated, Another alternative is to take the old
drive and place it into an external USB enclosure.
I've done that.
Even though all my old files are
on the hard drive, I can't access them due to Windows File permissions.
Is there a simplistic command I can execute to change all the file permissions
on the external hard drive so I can finally access them?
Thanks in advance.
The short answer is, simplistic?
Well, no, nothing related to file permissions is simplistic.
However, it is absolutely possible.
Let me show you what I do when I encounter this scenario.
So on this machine,
this is a Windows 11 machine, I have actually installed a drive.
You'll see it here under this PC.
This one, the C drive is this machine's native drive.
I have a Faux USB that I use in a bunch of other examples.
But this drive, my F drive, is actually a copy of a drive from a different system.
In fact, if you look carefully at my naming convention,
you can probably guess my current drive is a Windows 11 Professional,
and this other drive is coming from an installation of Windows 10 Professional.
It is a completely different drive and I
have done nothing to the permissions to put it to be able to gain access.
So if I go into that drive
and I now try to look at some of the things that I might want to,
for example, in the user's folder, in the primary user for that machine,
I might want to extract the documents from that user in order to recover them.
If I double click on that file or folder, I now get this message that says you don't
currently have permissions to access the folder.
The message that you're seeing right now happens often, but not always.
My theory is that it's a combination of the matching between the accounts
on the existing machine and the accounts that used to be present on the older
machine and the permissions associated with those older accounts.
The bottom line here is I don't have permission right now.
However, if I were to click Continue, you'll notice that the comment says click
continue to permanently get access to this folder.
If I do that, I get the access we're looking for.
I may have to do it on subfolders as well.
It may do the whole thing. It doesn't really matter.
Point is that if you encounter this message, basically, you're probably done.
You probably are going to get the access you're looking for.
However, you might not get this message
and I want to show you a couple of alternatives should that be the case.
So I'm going to cancel this so as to leave things in the state they are in,
this permission denied state, and go into a couple of other techniques.
This time I'm going to right click
on the folder, click on properties and click on the security tab.
You'll notice that it says you must have
read permissions to be able to access what's here.
We'll click on the advanced button.
We'll click on permissions, which is already here.
We're going to click Continue to attempt
the operation with administrative permissions.
In other words, it's essentially UAC.
It's essentially user account control to make this happen.
If I hit continue, now I have the option
to change change various permissions on this external or other drive.
The trick and the key here,
and I think the reason you'll notice that what's going on here is this item
down here, this weird number S 1 521 whatever, that is the magic number.
It's technically called a GWID or globally unique ID that identifies the user account
on the original machine, but user accounts on machines aren't transferable.
The same name will have a completely different GWD on this machine.
And indeed, this machine has the same set of accounts as the other machine did.
So that's the reason there's a problem.
The default user for that other machine is an unrecognized account on this machine.
So what do we want to do?
Well, we are going to add, select a principle.
A principle is basically just an account
or a group that you want to give access to.
What I'm going to do is give access
to everyone, and I'll talk about that in a moment.
Everyone is one of the default principles,
if you will, that Windows supports that you can use for permission assignment.
Check names, and you'll notice that it
becomes capitalized, but most importantly underlined.
In other words, it has been verified as
a group or a principle that you can't assign access to.
I'll click OK.
Now I can modify these different basic permissions associated with that folder.
I'm going to click on Full Control.
For the kinds of things that most people
want, being able to do whatever you want
on that drive is usually what you want to have happen.
We'll click OK, we'll click Apply.
Now you may run into errors through through this process.
Don't let that stop you.
In most cases, these errors are for files you honestly don't care about.
They're often temporary files,
system files, other things that have had additional protections placed on them.
We'll just click on Continue for each one of those, and you can see now it's setting
the security information on all of these things.
Again, we still get the occasional error
as it makes its way through the entire tree.
But once we're done with all of the errors, we're done.
Now, of course, we can get in there and we can see what is in that account.
Now, that's the GUI way, the Windows way, right?
The graphical user interface way.
For this stuff, especially for this stuff, I tend to much prefer the command prompt.
That is probably closer to your desire to have something simplistic.
It'll still be a complicated command, but it'll still be simplistic.
So I'm now going to, before I do this, I'm going to return this to its original
state and remove this everyone and hit okay.
And now, once again,
we're going to go through all of this to undo what we just did.
Basically all of the access that we have set up is being removed because we're
removing access to everyone and we're done.
So you can do all that with a graphical user interface.
That's great.
However, I'm a command line guy.
I much prefer and I feel more comfortable in the Windows Command Prompt.
Among other things,
we'll be clicking a confirmation dialog a lot less when we do this.
So we'll click on Start start, I just type CMD.
Then what's important here, of course, is to run the command prompt
as administrator, which means right clicking on the command
prompt when it comes up and clicking on Run as administrator.
Now, there are two tools we're going to use.
The command we're going to run first is called take own.
Take own assigns ownership of the target that you specify to the currently signed
in user, which theoretically then would give you full access to everything there.
F is an option slash question mark will
give you all of the options and a description for exactly what they mean.
In our case, we are also now going to specify the F drive users askly.
Remember, the F drive is that drive that we move from some other system.
It may be an external drive,
it may be some other drive, but the point is it's the drive that has
the files on which we don't currently have access.
And we'll specify slash R, which I'm pretty sure is for recursive,
meaning do it for everything from that point on down.
I'll hit that and off it goes.
There will be errors.
There will be some things that will fail.
The good news here is that chances are none of those will matter.
They're typically short cuts and cash
files and other random things that really don't have anything to do with the data
that you actually are trying to get access to on that drive.
The other thing you'll notice is that this is going to go through a lot of files.
The problem, of course, is that there's a lot of craft in that directory structure.
There's a lot of cash files, a lot of temporary files.
We'd like to get rid of them, but we can't get rid of them until we take ownership.
Therefore, taking ownership then allows us
to later go in and get rid of them if we want to.
In reality, taking ownership will probably mean more that we'll go in,
extract the data that we care about, and then just erase everything else.
But for the moment, I'm going to pause this video so that I'm
not showing you the whole operation because it can take some time.
Then we'll come back and we'll talk about
another command that will also do something very similar.
And we're done.
Like I said, this did take quite some time
because it had a lot of files and folders to go through, but there it is.
Now, the other command that I alluded to that actually would give us something
closer to what we did in the graphical user interface.
Remember, this command we just ran,
basically all it did was assign ownership of all those files to my current account.
The next command we're going to try is the icacls command, icacls.
The acls is access control list, but this is another one of the built
in tools in Windows for controlling access to the various files and folders.
The path that we're doing is F users askly.
Again, that is the path to which we are
having difficulty getting access to the various files within that.
We are going to say grant R, everyone,
F, basically we're granting everybody full access, and then slash t.
Icacls question mark will give you a full
list of the parameters and what they mean to the tool.
But for now, this is what we're going to run.
If I do that, it's going to take some time.
Again, once again, it's processing the various files in that folder tree.
There may be errors, again,
for some of the things that it may or may not be able to do,
but you can see that this actually turned out to be relatively quick.
The bottom line here is that we've just granted full access to everyone
for that folder tree, which again should allow anyone access
to the files and folders in there that we are attempting to recover.
That's how you do it.
I want to give one last caveat because as I pointed out in this last
command and in the GUI, I've given full access to everyone,
which essentially means I've removed all security from those files.
In most cases, where what you are doing is simply attempting data recovery
from a hard drive from another machine, which is essentially the most common
scenario that we run into here, that's actually pretty appropriate because
what that does is it frees you up to do whatever you need to with whatever account
or whatever other machine you might be using.
If you have other security requirements, for example, maybe you don't want to be
able to have just anybody access those files on those hard drives,
then you may want to investigate some of the parameters associated with those
tools, either in the GUI, assigning it to specific users,
or in the command line, not necessarily using everyone.
That's actually on you to understand what your security needs are.
But like I said, 99 times out of 100,
especially in the home where you're just trying to get those files from that old
machine, giving it to everyone just makes life easier.
I hope this is helpful.
I hope this helps you get through.
I will point you to the article
Askleo.com/4262, which goes through this same process with screenshots and the commands
typed in that you can copy paste if you need to.
Again, that's
Askleo.com/4262 where you'll also find related links, comments, and more.
I'm Leo Notenboom and this is
Askleo.com. Thanks for watching.