There are meaningful improvements, so I’d rewrite this one automatically. The current article is already technically sound, but the strongest version should make one principle much clearer:

Taking ownership and granting yourself permission are not the same thing. takeown changes ownership; icacls changes or restores the access control list. Microsoft documents both tools separately, and Windows 11 supports both.

I’d also strengthen the warning not to take ownership of Windows system folders indiscriminately. The right use case is usually personal files, an old drive, migrated data or folders inherited from another Windows installation—not C:\Windows or broad chunks of the system drive.

“Access Denied” on Your Own Files? Taking Ownership in Windows 11

You double-click a folder that belongs to you.

Windows replies:

Access is denied.

Or perhaps you see:

You don't currently have permission to access this folder.

This can be particularly confusing when:

• the files came from your old PC
• you are an administrator
• the drive belongs to you
• you created the files originally
• the data was restored from backup

The problem is usually not that Windows thinks somebody else physically owns the disk.

It is usually about Windows security permissions and ownership information stored against the files.

The good news is that access can often be restored.

The important thing is to change permissions only where necessary rather than taking control of entire Windows system folders.

Why Can Windows Deny Access to Your Own Files?

Windows uses NTFS permissions to decide which users and groups can:

• read files
• modify them
• delete them
• change permissions
• take ownership

Microsoft notes that access-denied errors commonly occur because the account currently being used does not have the required rights to open the file.

This becomes particularly common after:

• reinstalling Windows
• moving a drive from another PC
• replacing a failed computer
• restoring old files
• changing user accounts
• removing a PC from a domain
• migrating from one Microsoft account to another

Even if your old and new Windows accounts display exactly the same username, Windows may internally treat them as different security identities.

That is why:

“But I'm still Carl”

does not automatically mean:

“Windows sees this as the same account that originally owned the folder.”

Ownership and Permissions Are Different

This is the most important concept.

A file can have:

Owner: your account

while still denying you permission to modify it.

And conversely, you may have access to a folder even though somebody else technically owns it.

Think of it like this:

Ownership

Determines who has the authority to change permissions.

Permissions

Determine what users and groups are actually allowed to do.

That means changing ownership does not necessarily fix access by itself.

Sometimes the correct sequence is:

take ownership → then grant the required permissions

Microsoft’s takeown command is specifically designed to let an administrator recover access by becoming the owner, while icacls is the supported command for displaying and modifying file and folder ACL permissions.

First: Make Sure You're Fixing the Right Problem

Before changing NTFS permissions, check what kind of file you're dealing with.

Access may be restricted because of:

• NTFS permissions
• encryption
• Microsoft Purview/sensitivity labels
• OneDrive or SharePoint permissions
• network-share permissions
• application-specific protection

For example, Microsoft notes that Office files protected by information-protection policies can still deny access even where ordinary filesystem access exists.

So:

Access Denied does not always mean “take ownership.”

If the file lives in SharePoint or OneDrive, investigate the cloud permissions first rather than rewriting local NTFS permissions. Microsoft provides separate sharing and access controls for OneDrive and SharePoint content.

Method 1: Take Ownership Through File Explorer

For one personal folder, the graphical method is usually easiest.

Right-click the affected folder.

Choose:

Properties > Security > Advanced

At the top, look for:

Owner

If it shows:

• an old account
• unknown SID
• another user
• TrustedInstaller

do not immediately change it until you understand what the folder contains.

For an ordinary personal-data folder, choose:

Change

Enter your current Windows username or:

Administrators

then choose:

Check Names

and confirm.

If appropriate, enable:

Replace owner on subcontainers and objects

This applies the ownership change to files and subfolders beneath the selected folder.

Use this only when you genuinely intend to take control of that whole data tree.

Then Check the Permissions

After changing ownership, reopen:

Properties > Security

Look at your account.

You may have:

• Read
• Read & execute
• Write
• Modify
• Full control

For normal personal documents, Modify is usually plenty.

You do not automatically need Full control everywhere.

Microsoft’s icacls documentation distinguishes permissions such as read, write, modify and full access, which is why broad Full Control grants should be used deliberately rather than as the default fix.

Do Not Take Ownership of the Entire C: Drive

This is where otherwise useful advice becomes dangerous.

Do not casually take ownership of:

C:\

or:

C:\Windows

or:

C:\Program Files

or other protected operating-system areas.

Windows intentionally protects many system locations using identities such as:

TrustedInstaller

Changing ownership and permissions across them can:

• weaken Windows security
• interfere with updates
• break servicing
• affect application installation
• create permissions that are extremely difficult to restore correctly

Your own article already gives this warning, and I would make it even more prominent.

If the problem affects:

D:\Old Documents

that's one thing.

If it affects:

C:\Windows\System32

stop and investigate why before changing ownership.

Method 2: Use takeown

For larger personal-data folders, administrators may prefer Command Prompt.

Open:

Windows Terminal (Admin)

or:

Command Prompt (Admin)

For a single file:

takeown /f "D:\Old Data\Report.docx"

For a folder and its contents:

takeown /f "D:\Old Data" /r /d y

Microsoft documents takeown as a supported Windows 11 command that allows an administrator to recover access to previously denied files by becoming their owner.

What the switches mean

/f
Specifies the file or folder.

/r
Processes subfolders recursively.

/d y
Automatically answers Yes to relevant confirmation prompts.

Be extremely careful with /r.

If you point it at the wrong directory, it can change ownership across thousands of files.

takeown Does Not Automatically Give You Full Access

This is the point many guides miss.

Running:

takeown /f "D:\Old Data" /r /d y

changes ownership.

It does not necessarily grant your account the permissions required to read, modify or delete everything.

That is where icacls comes in.

Method 3: Use icacls to Grant Access

First determine your current username:

whoami

You might get:

DESKTOP-ABC\carl

Then you can grant your account Modify permission to the relevant folder.

For example:

icacls "D:\Old Data" /grant "%USERNAME%":(OI)(CI)M /t

Broadly:

M = Modify

(OI) = inherit to files

(CI) = inherit to folders

/t = process the directory tree

Microsoft documents icacls as the supported Windows command for modifying discretionary access control lists and permissions.

For personal data, Modify is often preferable to granting Full Control everywhere.

What About Full Control?

You might see guides using:

icacls "D:\Old Data" /grant "%USERNAME%":F /t

where:

F = Full control

That can work.

But Full Control also includes permission-changing and ownership-related rights that ordinary file use usually does not require.

For personal documents, I'd start with:

Modify

unless there is a specific reason you need more.

The principle is:

Grant the minimum permission that solves the problem.

If Permissions Are Completely Messed Up

icacls can also reset ACL entries.

For example:

icacls "D:\Old Data" /reset /t

But be careful.

Reset means Windows rebuilds permissions based on inherited defaults.

That might be appropriate for a normal subfolder where the parent permissions are known to be correct.

It is not something I would run casually on:

• entire drives
• Windows system folders
• specialist application directories
• business file structures with deliberate permissions

Before resetting permissions recursively, understand what the intended permissions should actually be.

Inheritance Can Be the Real Problem

A folder can contain unexpected permissions because it stopped inheriting them from its parent.

In:

Properties > Security > Advanced

look for whether inheritance is:

Enabled

or:

Disabled

For ordinary personal files, allowing inheritance from a correctly configured parent folder may simplify permissions considerably.

But in business environments, inheritance may be disabled deliberately to protect:

• HR data
• finance folders
• management information
• confidential projects

Do not turn inheritance back on simply because the button exists.

“Access Denied” on an Old Drive After Reinstalling Windows

This is one of the most common legitimate uses for ownership changes.

Imagine:

1. Your old Windows installation fails.
2. Windows is reinstalled.
3. The old secondary drive survives.
4. You log in with a newly created account.
5. Windows denies access to old user folders.

Even if the new account has the same display name, its internal SID differs from the original account.

Taking ownership of the old personal-data folder and granting your new account Modify permissions can restore access.

That is exactly the type of scenario these tools are meant to solve.

A Microsoft Account Name Does Not Guarantee the Same Permissions

Another source of confusion is reinstalling Windows and signing back into the same Microsoft account.

You may assume that because the email address is identical, all old NTFS permissions should automatically recognise you.

That isn't always how local filesystem security behaves.

Windows permissions ultimately operate using security identifiers.

A newly created local Windows identity can therefore behave differently from the old one.

What If the Folder Came From Another PC?

If you connect a drive removed from another Windows computer, permission errors are completely unsurprising.

The ACL may contain references to users and groups that do not exist on the new system.

For example, Windows may display something resembling:

S-1-5-21-...

instead of a friendly username.

That is an unresolved SID from the previous Windows installation or domain.

For ordinary personal data, taking ownership and assigning permissions to the new account may be appropriate.

What If the Files Were Encrypted With EFS?

This changes everything.

If files were encrypted using Windows Encrypting File System (EFS), taking ownership does not decrypt them.

Ownership controls permissions.

Encryption controls whether the data itself can be decoded.

If the EFS certificate/private key is unavailable, changing ownership or granting Full Control will not magically recover the plaintext.

This is one reason you should not automatically assume:

Access Denied = NTFS ownership problem.

If file names appear green in some configurations or you know EFS was used, stop before altering large permission trees and locate the relevant certificate/key backup.

What About BitLocker?

BitLocker protects an entire volume.

If an old drive is BitLocker encrypted, you may first need:

• password
• BitLocker recovery key

before NTFS ownership is even relevant.

Once the volume is unlocked, you may still encounter ordinary NTFS permission issues inside it.

These are two separate security layers:

BitLocker → unlock the disk

NTFS permissions → control access to files

Network Shares Have Two Permission Layers

If the files live on a network server, taking ownership locally may not be the correct solution.

Windows file shares can involve:

Share permissions

and:

NTFS permissions

Your effective access is determined by the combination.

So if:

\\Server\Finance

returns Access Denied, ask the server administrator to check the intended access model.

Do not take ownership of company data simply because your account is an administrator somewhere.

OneDrive and SharePoint Are Different Again

If you're denied access to a OneDrive or SharePoint file, local NTFS ownership may be irrelevant.

Microsoft 365 controls access through:

• sharing permissions
• site membership
• Teams membership
• links
• SharePoint groups

Microsoft confirms that owners can review and change access to OneDrive and SharePoint content through their sharing and permissions controls.

Fix the correct permission system.

When You Should NOT Take Ownership

Do not use ownership changes as the default response for:

• C:\Windows
• C:\Program Files
• WindowsApps
• system files
• domain-managed company folders
• SharePoint content
• encrypted files
• folders belonging to another employee
• folders protected for regulatory/security reasons

Administrative capability is not the same thing as authorisation.

On a business PC or server, there may be a legitimate reason you cannot access the folder.

Don't Use a “Take Ownership” Registry Hack

You may find downloads promising to add:

Take Ownership

to every Windows right-click menu.

I would avoid recommending that in a business-focused article.

It turns a powerful administrative action into something far too easy to invoke casually.

The supported:

Security > Advanced

interface and Microsoft’s built-in takeown/icacls tools already provide everything required.

A Safe Troubleshooting Order

If Windows says Access Denied on files you believe are yours:

1. Confirm whether the file is local, networked, OneDrive or SharePoint.
2. Check whether the issue is NTFS permissions rather than encryption.
3. Check Properties > Security.
4. Check the current Owner.
5. For personal data, change ownership only if appropriate.
6. Give your account the minimum permissions required.
7. Use takeown only for larger or inaccessible personal-data trees.
8. Use icacls when you need to repair or grant ACL permissions.
9. Avoid recursive changes across system directories.
10. If the folder belongs to a business system, involve IT rather than overriding its security model.

The key principle is:

Take ownership only of data you genuinely need to control, and change the smallest permission scope necessary.

How Hamilton Group Can Help

Windows permission problems can be easy to fix when they involve an old personal folder.

They become much more dangerous when they involve:

• servers
• shared drives
• Windows system folders
• encryption
• business data
• Microsoft 365

Hamilton Group can help with:

• Windows 11 permissions
• Access Denied errors
• NTFS permissions
• file ownership
• takeown
• icacls
• old drive recovery
• BitLocker
• OneDrive and SharePoint permissions
• Windows file servers

For businesses, we can restore legitimate access without flattening carefully designed permissions across an entire file system.

Visit hgmssp.com or call 0330 043 0069.