The Ultimate Guide to Takeown and Icacls Commands in Windows

Managing file and folder permissions and ownership in Windows via the command line is often unfamiliar to many users. However, mastering the `takeown` and `icacls` commands is crucial in numerous situations, especially when access problems or conflicts arise with NTFS file system security. While the Windows graphical environment allows for adjusting these aspects, the control offered by these tools in the command prompt is unparalleled, enabling the efficient and rapid resolution of complex situations.

In this article, I'll show you how `takeown` and `icacls` work , explaining everything from the basics to advanced scenarios, with practical examples, warnings, tips , and tricks, as well as comparing their capabilities to other systems like Linux . The goal is that, after reading this guide, you'll be able to manage the ownership and permissions of any file or folder on your Windows computer without fear of losing access or creating conflicts. Let's delve into the world of permission management from the command line!

Why are permissions and ownership important in Windows?

The NTFS file system used by Windows incorporates advanced access control mechanisms, similar to those found in systems like UNIX or Linux, but with its own specific features. Each file or folder can have an assigned owner and an access control list (ACL), which defines permissions for users and groups: who can read, modify, delete, execute, or change security settings.

Proper management of these permits is essential for several reasons:

• Protection of personal or confidential information. Prevent accidental access or modification by other users on shared computers.
• Security against threats and malwareA system with well-configured permissions makes it difficult for viruses or ransomware to spread.
• Organization and efficiency in work environmentsControlling who accesses or manages certain documents enhances privacy and productivity.
• Managing shared files on a local network or Active Directory. Access to resources can be limited or authorized as needed.

In many cases, after installing a new program, migrating files, or restoring backups, permission conflicts or ownership issues may arise, preventing you from modifying or deleting files. This is where the takeown and icacls commands come into play.

What is takeown and what is it for?

The `takeown` command is the tool that allows a Windows administrator to take ownership of files or folders to which they were previously denied access. In other words, it changes the ownership of that resource to the user executing the command or to the Administrators group if specified. It is roughly equivalent to the `chown` command in Linux.

This is very useful when:

• You cannot delete, modify, or access a file or folder because the previous owner has removed permissions..
• You need to manage other users' files, deleted users or system accounts.
• You need to regain control of files after a restore, migration, or after having to rescue data following a malware attack..

The basic syntax for takeown is as follows:

takeown /f 

It's important to remember that `takeown` only changes ownership ; it doesn't grant access permissions. For that, it's recommended to use `icacls` afterward.

Main takeown parameters and options

• /f : Specifies the file, folder, or file pattern you want to take ownership of. Wildcards and UNC paths are supported.
• /r: Operates recursively on all files and subfolders contained in the path (ideal for taking ownership of entire folders).
• /a: Assigns ownership to the Administrators group instead of the current user.
• /d Y: Suppresses confirmation messages when the current user does not have list permissions on the specified directory.
• /u : Runs the command with another user's credentials.
• /p : Allows you to specify the password when using /u.
• /s : Runs the command on a remote computer.

Practical example: To take ownership of all files and folders on the C: drive recursively and without questions, the command would be:

takeown /f C:\ /r /dy

Running it on system files with caution may cause instability. Only use it when absolutely necessary.

What is icacls and how is it used?

icacls is the most comprehensive and up-to-date command for displaying, modifying, backing up, restoring, and managing Access Control Lists (DACLs) for NTFS files and folders in Windows. It replaces the older cacls and xcacls commands, adding support for new security properties and formats.

With icacls you can:

• Add, modify, or remove access permissions for users or groups on files and folders.
• Retrieve the permission list (ACLs) of a set of files, back them up to a file, and then restore them.
• Change the file owner to another user (you must have the necessary permissions or have previously used takeown).
• Apply permissions in bulk, recursively, to large numbers of files and directories.
• Reset default permissions (reset) in files or folders.
• Query, verify, and resolve inconsistencies or errors in ACLs.

General syntax and main parameters of icacls

icacls 

Among the most frequent options and arguments we find:

• /grant user:permission: Grants permissions to the specified user. Using :r replaces existing permissions; without :r, adds them to the current ones.
• /deny user:permission: Explicitly deny permissions to a user.
• /remove user: Removes all permissions from a user's DACL.
• /setowner user: Changes the owner of the file or folder to the specified user.
• /inheritance:e|d|r: Controls inheritance of permissions.
• /t: Operates recursively on all files and subfolders.
• /c: Continue in case of errors.
• /q: Suppresses success messages.
• /reset: Resets permissions to default inherited values.
• /save ACL file: Saves the current ACLs to a text file.
• /restore fileACL: Restores the ACL from a saved file.

To manage permissions correctly, it is often essential to first use takeown to acquire the property, and then icacls to adjust permissions.

Basic and advanced permissions in ICACLS

Permissions can be specified with letters or masks:

• F: Total control.
• M: Modify.
• RX: Read and execute.
• R: Read only.
• W: Writing only.

Lists and inheritance options such as (OI), (CI), (IO), etc. can be used to define specific permissions and propagation on objects and folders.

Example: To give the Administrators group full control over a folder and all its contents:

icacls "C:\test" /grant:r Administrators:(OI)(CI)F /T

Common case studies with takeown and icacls

Let's see how to solve some common scenarios step by step:

1. I can't access, delete, or modify a file or folder

This usually occurs when the owner is another user or system account. Solution:

1. Take ownership of the file or folder:

   takeown /f "C:\Path\to\file.ext"

2. Grant you full permissions:

   icacls "C:\Path\to\file.ext" /grant yourUser:F

For folders, add /r in takeown and /T in icacls to do it recursively.

2. Reset NTFS permissions on an entire location

This can be useful after a restore or migration :

icacls * /T /Q /C /RESET

Returns permissions to their default state, but use with caution on system directories.

First, make sure you have permissions with:

takeown /R /F *

Caution : Taking ownership of system folders is not recommended, as it may affect system stability.

3. Save and restore NTFS permissions (ACL)

To back up ACLs to a file:

icacls "C:\test"\* /save "C:\acl-backup\ACL_backup.txt" /T

And to restore later, for example after reinstalling:

icacls "C:\test" /restore "C:\acl-backup\ACL_backup.txt"

4. Change the owner with icacls

To set a new owner (requires permissions):

icacls "C:\FilePath" /setowner Administrators

If you can't, use takeown first.