Privacy and Security Enable or Disable Inherited Permissions for File, Folder, or Registry Key in Windows 11

This tutorial will show you how to enable or disable inherited permissions for files, folders, and registry keys in Windows 10 and Windows 11.

You can set permissions for registry keys, and files and folders on NTFS and ReFS volumes. These permissions allow or deny access to the files, folders, drives, and registry keys.

Every container (ex: folder) and object (ex: file) on the PC has a set of access control information attached to it. Known as a security descriptor, this information controls the type of access allowed to users and groups. The security descriptor is automatically created along with the container or object that is created.

There are two types of permissions: explicit permissions and inherited permissions.

• Explicit permissions are those that are set by default on non-child objects when the object is created, or by user action on non-child, parent or child objects. Explicit permissions take precedence over inherited permissions. Enabling or disabling inherited permissions for a file or folder will not affect explicit permissions for the file or folder.
• Inherited permissions are those that are propagated to an object (ex: file or folder) from a parent object (ex: drive or folder). Inherited permissions ease the task of managing permissions and ensure consistency of permissions among all objects within a given container.

By default, objects within a container inherit the permissions from that container when the objects are created. For example, when you create a folder called MyFolder, all subfolders and files created within MyFolder automatically inherit the permissions from that folder. Therefore, MyFolder has explicit permissions, while all subfolders and files within it have inherited permissions.

When you disable inherited permissions for a file or folder (object), you can choose to either Convert inherited permissions into explicit permissions on this object or Remove all inherited permissions from this object.

When you enable inherited permissions for a file or folder (object), all permissions from the object's parent (ex: drive or folder) will get added to the object. You will see Inherited from in the object's Advanced Security Settings to let you know the parent.

References:

You must be signed in as an administrator, current owner, or have "full control" permissions to enable or disable inherited permissions for files, folders, and registry keys.

If you are unable to enable or disable inherited permissions for a file or folder, then you will need to take ownership of the file or folder first, and try again afterwards. This can happen when you are not the owner, or you do not have read or write permissions.

DO NOT disable inherited permissions of Windows system folders like "C:\Windows" or "C:\Program Files\WindowsApps". Doing so will cause issues with Windows that may only be corrected by a clean install, repair install, or restore system image.

EXAMPLE: Explicit and inherited permissions







1 Perform an appropriate action below:

• Right click on the file or folder you want in File Explorer (Win+E) to enable inherited permissions for, and click/tap on Properties.
• Right click on a registry key in Registry Editor (regedit.exe) you want to enable inherited permissions for, and click/tap on Permissions.

2 Click/tap on the Security tab, and click/tap on the Advanced button. (see screenshot below)


3 Click/tap on the Change permissions button if there. (see screenshot below)


4 Click/tap on the Enable inheritance button. (see screenshot below)


5 Click/tap on Apply to see the applied inherited permissions. (see screenshot below)


6 Click/tap on OK. (see screenshot below)

If this is for a registry key or folder, you can check Replace all child object permissions entries with inheritable permission entries from this object before clicking on OK to replace the permissions of all subkeys or subfolders and files in this key/folder with the same inherited permissions from this key/folder.

This will also remove explicit permissions from the child objects.

7 Click/tap on OK. (see screenshot below)






1 Perform an appropriate action below:

• Right click on the file or folder you want in File Explorer (Win+E) to disable inherited permissions for, and click/tap on Properties.
• Right click on a registry key in Registry Editor (regedit.exe) you want to disable inherited permissions for, and click/tap on Permissions.

2 Click/tap on the Security tab, and click/tap on the Advanced button. (see screenshot below)


3 Click/tap on the Change permissions button if there. (see screenshot below)


4 Click/tap on the Disable inheritance button. (see screenshot below)


5 Do step 6 (convert inherited permissions) or step 7 (remove inherited permissions) below for what you want.

This will not remove explicit permissions.

8 Click/tap on OK. (see screenshot below)






1 Open Terminal (Admin), and select either Windows PowerShell or Command Prompt.

2 Type the command below you want to use into Terminal, and press Enter. (see screenshots below)

Substitute <full path of file or folder> in the commands above with the actual full path of the file with extension or folder you want.

For example:

icacls "D:\Folder" /inheritance:e

OR

icacls "D:\Folder\file.txt" /inheritance:e

1 Open Terminal (Admin), and select Windows PowerShell.

2 Type the command below you want to use into Terminal, and press Enter. (see screenshot below)

Substitute <branch> in the commands above with the actual HKCR (HKEY_CLASSES_ROOT), HKCU (HKEY_CURRENT_USER), HKLM (HKEY_LOCAL_MACHINE), HKU (HKEY_USERS), or HKCC (HKEY_CURRENT_CONFIG) branch the key is in.

Substitute <key path> in the commands above with the rest of the path of the registry key.

For example:

$acl = Get-Acl "HKCU:\Control Panel\ExampleKey"; $acl.SetAccessRuleProtection($true,$true); Set-Acl "HKCU:\Control Panel\ExampleKey" $acl

That's it,
Shawn Brink