This tutorial will show you different ways to change the permissions of a file, folder, drive, or registry key for specific users and groups in Windows 10 and Windows 11.
You can set permissions for registry keys, and files and folders on NTFS and ReFS volumes. These permissions allow or deny access to the files, folders, drives, and registry keys.
Every container (ex: folder) and object (ex: file) on the PC has a set of access control entry (ACE) information attached to it. Known as a security descriptor, this information controls the type of access allowed to users and groups. The security descriptor is automatically created along with the container or object that is created.
There are two types of permissions: explicit permissions and inherited permissions.
- Explicit permissions are those that are set by default on non-child objects when the object is created, or by user action on non-child, parent or child objects. Explicit permissions take precedence over inherited permissions. Enabling or disabling inherited permissions for a file or folder will not affect explicit permissions for the file or folder.
- Inherited permissions are those that are propagated to an object (ex: file or folder) from a parent object (ex: drive or folder). Inherited permissions ease the task of managing permissions and ensure consistency of permissions among all objects within a given container.
The following table lists the access limitations for each set of special NTFS permissions.
Special Permissions | Full Control | Modify | Read & Execute | List Folder Contents (drives and folders only) | Read | Write |
|---|---|---|---|---|---|---|
| Traverse Folder/Execute File | x | x | x | x | ||
| List Folder/Read Data | x | x | x | x | x | |
| Read Attributes | x | x | x | x | x | |
| Read Extended Attributes | x | x | x | x | x | |
| Create Files/Write Data | x | x | x | |||
| Create Folders/Append Data | x | x | x | |||
| Write Attributes | x | x | x | |||
| Write Extended Attributes | x | x | x | |||
| Delete Subfolders and Files | x | |||||
| Delete | x | x | ||||
| Read Permissions | x | x | x | x | x | x |
| Change Permissions | x | |||||
| Take Ownership | x | |||||
| Synchronize | x | x | x | x | x | x |
References:
Access Control Overview
File and Folder Permissions
Set, View, Change, or Remove Permissions on Files and Folders
Set, View, Change, or Remove Special Permissions
You must be signed in as an administrator, current owner of object, or have "full control" permissions of object to reset the object's permissions.
- Option One: Change Permissions of File, Folder, Drive, or Registry Key in Security Settings
- Option Two: Change Permissions of File, Folder, Drive, or Registry Key in Advanced Security Settings
- Option Three: Change Permissions of File, Folder, or Drive using icacls Command
- Option Four: Change Permissions of Registry Key using Set-Acl PowerShell Command
1 Perform an appropriate action below: (see screenshots below)
- In File Explorer (Win+E), right click on the file, folder, or drive you want to change permissions of, and click/tap on Properties.
- In Registry Editor (regedit.exe), right click on a registry key you want to change permissions of, and click/tap on Permissions.
2 If this is for a file, folder, or drive, click/tap on the Security tab, and click/tap on Edit. (see screenshots below)
If you see "You must have Read permissions to view the properties of this object", then you will need to change the owner to your account first.
3 Perform the steps below to change the permissions: (see screenshots below)
- Select a user or group you want to change the permissions for.
- Check or uncheck the Allow or Deny boxed for the simple permissions you want applied to the selected user or group.
- Click/tap on OK when finished changing permissions for users and groups.
You can click/tap on the Add button to add a user or group to configure permissions for this object.
You can select a user or group and click/tap on the Remove button to remove the user or group from this object's permissions.
4 Click/tap on OK. (see screenshot below)
1 Perform an appropriate action below: (see screenshots below)
- In File Explorer (Win+E), right click on the file, folder, or drive you want to change permissions of, and click/tap on Properties.
- In Registry Editor (regedit.exe), right click on a registry key you want to change permissions of, and click/tap on Permissions.
2 Click/tap on the Security tab, and click/tap on the Advanced button. (see screenshots below)
If you see "You must have Read permissions to view the properties of this object", then you will need to change the owner to your account first.
3 Select a user or group you want to change explicit permissions for, and click/tap on the Edit button. (see screenshots below)
You will see "Unable to display current owner" when you see "You must have Read permissions to view the properties of this object" in step 2.
To change inherited permissions, you will need to change the permissions of the parent object (ex: "D:\") instead.
You can click/tap on the Add button to add a user or group to configure permissions for this object.
You can select a user or group and click/tap on the Remove button to remove the user or group from this object's permissions.
4 Select Allow or Deny in the Type drop menu for the type of permissions you want to change. (see screenshots below)
5 If this is for a folder, drive, or registry key, select what you want in the Applies to drop menu for how the permissions will be applied. (see screenshots below)
6 Perform the steps below to select the basic or advanced permissions you want applied: (see screenshots below)
- Click/tap on the Show advanced permissions or Show basic permissions link for what you want.
- Check or uncheck the permissions you want applied to the selected user or group for this object.
- Click/tap on OK when finished.
7 Click/tap on OK. (see screenshot below)
8 Click/tap on OK. (see screenshot below)
1 Open Terminal (Admin), and select either Windows PowerShell or Command Prompt.
2 Type the command below you want to use into Terminal, and press Enter. (see table and screenshots below)
icacls "<full path of file with extension>" /grant "<user or group>":(<permissions>)icacls "<full path of folder>" /grant '<user or group>:(<permissions>)'icacls "<full path of file with extension>" /grant "<user or group>":(<permissions>)icacls "<full path of folder>" /grant '<user or group>:(<permissions>)'icacls "<full path of file with extension>" /grant "<user or group>":(<permissions>) /t /cicacls "<full path of folder>" /grant '<user or group>:(<permissions>)' /t /cicacls "<drive letter>:" /grant "<user or group>":(<permissions>)icacls "<drive letter>:" /grant '<user or group>:(<permissions>)'icacls "<drive letter>:" /grant "<user or group>":(<permissions>) /t /cicacls "<drive letter>:" /grant '<user or group>:(<permissions>)' /t /cSubstitute <full path of file with extension> in the commands above with the actual full path of the file with extension you want to change permissions of.
Substitute <full path of folder> in the commands above with the actual full path of the folder you want to change permissions of.
Substitute <drive letter> in the commands above with the actual drive letter (ex: "D") of the drive you want to change permissions of.
Substitute <user or group> in the commands above with the name of the user account (ex: "Brink") or group (ex: "Administrators") you want to change permissions for this object.
Substitute <permissions> in the command above with one or more basic and/or advanced permissions you want to assign to the user or group from the table below with each permission separated by a comma.
For example:
Command: icacls "D:\Folder" /grant "Administrators":(F,WO) /t /c
PowerShell: icacls "D:\Folder" /grant 'Administrators:(F,WO)' /t /c
Description | |
|---|---|
| N | no access |
| F | full access |
| M | modify access |
| RX | read and execute access |
| R | read-only access |
| W | write-only access |
| D | delete access |
Description | |
|---|---|
| DE | delete |
| RC | read control |
| WDAC | write DAC |
| WO | write owner |
| S | synchronize |
| AS | access system security |
| MA | maximum allowed |
| GR | generic read |
| GW | generic write |
| GE | generic execute |
| GA | generic all |
| RD | read data/list directory |
| WD | write data/add file |
| AD | append data/add subdirectory |
| REA | read extended attributes |
| WEA | write extended attributes |
| X | execute/traverse |
| DC | delete child |
| RA | read attributes |
| WA | write attributes |
1 Open Terminal (Admin), and select Windows PowerShell.
2 Type the command below into Terminal, and press Enter. (see table and screenshot below)
$acl=Get-Acl "<branch>:\<key path>";$rule=New-Object System.Security.AccessControl.RegistryAccessRule("<user or group>","<permission>","<Allow or Deny>");$acl.AddAccessRule($rule);Set-Acl "<branch>:\<key path>" $aclSubstitute <branch> in the commands above with the actual HKCR (HKEY_CLASSES_ROOT), HKCU (HKEY_CURRENT_USER), HKLM (HKEY_LOCAL_MACHINE), HKU (HKEY_USERS), or HKCC (HKEY_CURRENT_CONFIG) branch the key is in.
Substitute <key path> in the command above with the rest of the path of the registry key.
Substitute <user or group> in the command above with the name of the user account (ex: "Brink") or group (ex: "Administrators") you want to change permissions for this registry key.
Substitute <permission> in the command above with a permission you want to assign to the user or group from the table below with.
Substitute <Allow or Deny> with only Allow or Deny for which type of permission you want.
For example:
$acl=Get-Acl "HKCU:\Control Panel\ExampleKey";$rule=New-Object System.Security.AccessControl.RegistryAccessRule("Administrators","FullControl","Allow");$acl.AddAccessRule($rule);Set-Acl "HKCU:\Control Panel\ExampleKey" $aclDescription | |
|---|---|
| ChangePermissions | The right to change the access rules and audit rules associated with a registry key. |
| CreateSubKey | The right to create subkeys of a registry key. |
| Delete | The right to delete a registry key. |
| EnumerateSubKeys | The right to list the subkeys of a registry key. |
| ExecuteKey | Same as ReadKey. |
| FullControl | The right to exert full control over a registry key, and to modify its access rules and audit rules. |
| Notify | The right to request notification of changes on a registry key. |
| ReadKey | The right to query the name/value pairs in a registry key, to request notification of changes, to enumerate its subkeys, and to read its access rules and audit rules |
| ReadPermissions | The right to open and copy the access rules and audit rules for a registry key. |
| SetValue | The right to create, delete, or set name/value pairs in a registry key. |
| TakeOwnership | The right to change the owner of a registry key. |
| WriteKey | The right to create, delete, and set the name/value pairs in a registry key, to create or delete subkeys, to request notification of changes, to enumerate its subkeys, and to read its access rules and audit rules. |
That's it,
Shawn Brink
- Change Owner of File, Folder, Drive, or Registry Key in Windows 11
- Add Take Ownership to Context Menu in Windows 11
- View Effective Permissions of File, Folder, Drive, or Registry Key in Windows 11
- Enable or Disable Inherited Permissions for File, Folder, or Registry Key in Windows 11
- Reset Permissions of File, Folder, or Registry Key in Windows 11
