Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
PowerShell’s “Access to the path is denied” message means Windows refused a specific operation—such as reading, writing, renaming, deleting, or executing a file or folder—for the account and security context running the command. Running PowerShell as administrator can solve an elevation problem, but it will not repair an incorrect or explicit deny entry, missing ownership, a remote-session restriction, or a wrong target path.
Start by recording the exact path, operation, account, computer, and whether the target is local or remote. Inspect the object’s ACL before changing it, then apply the smallest permission or ownership change that allows the failed operation. The workflow below covers local files and folders, registry targets, and PowerShell remoting.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What does “Access to the path is denied” mean in PowerShell?
The error is an authorization failure tied to one object, one requested action, and one security context. The same command can work for an administrator and fail for a standard user, or work locally and fail through a remote session.
Identify all four parts before changing security:
- Target: the literal file, directory, registry key, or other resource named in the error.
- Operation: read, create, write, rename, delete, or execute.
- Identity: the user, group, service account, or supplied credential running the command.
- Context: an interactive local shell, an elevated shell, or a PowerShell remoting session.
A relative path can resolve to a different object than you expect. Resolve it first, and use -LiteralPath when brackets, wildcard characters, or unusual names must be treated literally.
Popular on Amazon
How do I capture the exact failure before changing permissions?
Write down the complete command and error text, then establish exactly what PowerShell tried to access. This prevents changing permissions on a similarly named file or on a parent directory that was not involved.
- Copy the full error, including the path and the operation that failed.
- Record the signed-in account and, if applicable, the account supplied with a credential parameter.
- Record the computer that owns the target and whether the command ran locally or through remoting.
- Resolve and display the target path:
$target = 'C:PathToItem'
Resolve-Path -LiteralPath $targetTest-Path confirms whether the object exists; it does not prove that your account can perform the requested operation. If it returns False, correct the path, drive, share, or session context before editing ACLs.
How can I inspect the ACL that caused the denial?
Inspect first, then decide whether elevation, an ACL change, or ownership recovery is appropriate. Microsoft describes Get-Acl as getting the security descriptor for a resource such as a file or registry key, while icacls displays the discretionary access control list (DACL), including grants, denies, and inheritance.
$target = 'C:PathToItem'
Get-Acl -LiteralPath $target | Format-List
icacls.exe $targetReading the output
- Owner: the account or group that owns the security descriptor. Ownership is not the same as permission to perform every operation.
- Access entries: rules for users and groups. Look for the identity that actually runs the command.
- Allow and deny: an explicit deny can block an operation even when an allow entry also exists.
- Inheritance: inherited entries come from a parent folder; explicit entries are set on the object itself.
For a directory, inspect both the directory and the parent path. Access can fail before the final item is reached if the account lacks the required rights on a parent directory. For a registry target, use Get-Acl with the registry provider path and avoid applying file-system rules to it.
Should I run PowerShell as administrator?
Run an elevated shell when the operation genuinely requires an administrator token, but do not treat elevation as a universal fix. Microsoft documents an access-denied message stating that a cmdlet must run from an elevated process for administrative WSMan changes.
When elevation is appropriate
- Changing local WSMan or other machine-wide settings.
- Editing protected locations where the current account has no administrative token.
- Running a command that explicitly reports it must come from an elevated process.
How to retry safely
- Close the current shell if it is not elevated.
- Open Windows PowerShell or PowerShell 7 using Run as administrator.
- Repeat the original command without changing its path or arguments.
- If it still fails, compare the ACL and ownership instead of repeatedly launching elevated shells.
Elevation changes the token used by the process; it does not remove an explicit deny, repair a broken inheritance chain, or grant a remote endpoint permission that your session does not have.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Also popular on Amazon
- Book - powershell for sysadmins: workflow automation made easy
- Language: english
- Binding: paperback
How do I grant only the permission the command needs?
Make the smallest durable change that completes the operation. Save the existing ACL where the target matters, grant the required right to the correct identity, and preserve unrelated entries.
Back up an ACL before editing
icacls supports saving and restoring ACL data. Save a directory tree only when that is the scope you intend to modify.
icacls.exe 'C:PathToFolder' /save "$env:TEMPfolder.acl" /tStore the backup in a location that will remain available if the edit goes wrong. A backup is useful only if you know which directory it represents and can restore it with the matching path.
Grant a narrow right with icacls
For example, this grants the named domain account Modify access on a folder and allows inheritance to items below it:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallicacls.exe 'C:PathToFolder' /grant 'CONTOSOUser:(OI)(CI)M'Replace both the identity and path after diagnosis. (OI) applies to files, (CI) applies to child directories, and M means Modify. If the command only needs to read a file, do not grant Modify; choose the narrowest right that meets the task. A grant on a whole tree is broader than a grant on one file, so use the smallest scope that works.
Construct an ACL with Set-Acl
Set-Acl applies a supplied security descriptor to an item. Read the current ACL, add the intended rule, and write it back so unrelated entries remain present:
Also popular on Amazon
$target = 'C:PathToItem'
$acl = Get-Acl -LiteralPath $target
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
'CONTOSOUser', 'Modify', 'Allow')
$acl.SetAccessRule($rule)
Set-Acl -LiteralPath $target -AclObject $aclDo not replace the entire descriptor with a newly created one unless you deliberately intend to remove existing rules. The Microsoft synopsis for Set-Acl is that it changes the security descriptor of a specified item, such as a file or registry key.
Control inheritance deliberately
Inheritance can be useful for a project folder, but changing it on a system or shared directory can affect many objects. Use icacls inheritance controls only after checking which entries are inherited and which are explicit. Avoid recursive changes when the failed operation concerns one file.
Recommended Free Tools
When should I use takeown?
Use ownership recovery only when ownership is the blocker. Microsoft describes takeown as allowing an administrator to recover access by making the administrator the owner of a previously denied file.
takeown.exe /F 'C:PathToItem' /AThe /A option assigns ownership to the Administrators group. Ownership alone does not automatically give your working account every file right, so follow it with a narrow grant if the original operation still fails.
Recursive ownership recovery is available, but limit it to the intended directory and confirm the path first. Do not run a recursive command against a system root as a general “fix”; it can alter security relationships far beyond the file that failed.
How do local and remote PowerShell permissions differ?
PowerShell remoting adds another authorization layer. A local administrator account, the WinRM service, WSMan configuration, session-configuration permissions, and the credentials supplied to the session are separate checks.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsAlso popular on Amazon
Local checks
- Confirm the target path exists on the computer where the command actually runs.
- Inspect the ACL on that computer, not only the ACL on your workstation.
- Use an elevated local shell when changing machine-wide WSMan settings.
Remote-session checks
- Confirm that the remote computer permits the requested session configuration. Default remote session configurations are restricted to Administrators.
- Verify that WinRM is running and that the WSMan configuration allows the operation.
- Supply alternate credentials when the remote task requires an identity different from the one used to open the session.
- Run the ACL inspection inside the remote session so the output describes the remote object.
An account can be an administrator on the local computer and still lack rights on the remote endpoint. If the same command succeeds locally but fails remotely, investigate session permissions and credentials before changing the file’s ACL.
How do I verify the fix and roll it back?
Verification must reproduce the original operation, not merely show that an ACL command completed.
- Re-run
Get-Aclandicaclsto confirm the intended identity and rule are present. - Repeat the original read, write, rename, delete, or execute command using the same account and context.
- Check that unrelated users, inherited entries, and parent-folder permissions remain as intended.
- If the change caused a problem, restore the saved ACL:
icacls.exe 'C:PathToFolder' /restore "$env:TEMPfolder.acl"Restoration must target the directory represented by the saved ACL. Keep a record of the original command, the identity granted, the scope, and the time of the change so the system owner can review it.
Which fix should I choose?
The best remedy depends on scope, authority, persistence, risk, and context—not simply on whether a command can be made to run.
| Approach | Scope | Authority needed | Persistence | Risk and best use |
|---|---|---|---|---|
| Retry elevated | One command or session | Administrator token | One-time process context | Low change risk; use when the error explicitly requires elevation. |
Targeted icacls /grant |
One file, folder, or intentional child tree | Rights to modify its DACL | Durable ACL entry | Preferred for a known identity and operation; keep the right and path narrow. |
Set-Acl with an edited descriptor |
Specific item | Rights to write its security descriptor | Durable ACL change | Useful for scripted, repeatable changes; preserve existing entries deliberately. |
takeown, then a grant |
One item or deliberately limited directory | Elevated administrator | Ownership and any later ACL grant persist | Recovery path when ownership blocks access; ownership alone may not complete the task. |
| Remote-session correction | Endpoint, session configuration, and target | Appropriate remote credentials and endpoint rights | Depends on the endpoint or ACL change | Use when local tests pass but remoting fails; do not assume local admin membership is sufficient. |
What common “fixes” should I avoid?
Broad changes can hide the symptom while creating a larger security problem. Avoid these shortcuts unless a documented recovery plan specifically requires them:
- Granting
Everyone:Fto a file, folder, or system location. - Disabling User Account Control to bypass an elevation prompt.
- Running a recursive ACL reset on a system root without first saving the current ACL and identifying the affected objects.
- Changing ownership or permissions on a protected resource without the system owner’s approval.
- Repeating an elevated command indefinitely when the target path, remote credential, or explicit deny is the actual cause.
Test a permission change on a non-critical path when possible. For business, shared, or operating-system resources, involve the owner before making a durable ACL or ownership change.
Also popular on Amazon
What if the denial continues after the ACL looks correct?
Work through the remaining variables in order:
- Path: resolve the literal path again and confirm the command is reaching the expected computer and item.
- Identity: verify the account shown in the ACL is the account actually executing the command, including any service or alternate credential.
- Operation: check that the granted right matches the failed action; read access does not automatically allow deletion or execution.
- Parent path: inspect each parent directory for the access needed to reach the child.
- Context: distinguish an elevated local shell from a remote session with a restricted endpoint configuration.
- Ownership: use
takeownonly if ownership, rather than the DACL, is preventing recovery. - Rollback: if a change produced unexpected behavior, restore the saved ACL and involve the resource owner.
This sequence keeps the diagnosis tied to the exact failure and avoids replacing a narrow authorization problem with a broad, difficult-to-audit permission change.
As an optional shortcut for broader Windows troubleshooting, Outbyte PC Repair can address more than 100 common Windows issues where possible, including broken system elements and shared DLL problems, and includes an app-crash log; it runs on Windows 11, 10, 8 and 7. It offers a free trial of at least two days before a subscription, complements antivirus software rather than replacing it, and results vary, so it does not repair every PowerShell access problem.
Free tools Windows power users keep installed
One-click scans. No signup required.
How do I prevent repeat permission errors?
Document the account, target path, required operation, and final ACL whenever you create a script that touches protected files or remote endpoints. Prefer explicit, narrow identities and paths, keep ACL backups for important trees, and test scripts under the same account and elevation level that production will use. That practice makes a later “Access to the path is denied” message a specific, auditable authorization issue instead of a guess-and-reset exercise.
Frequently Asked Questions
Can a PowerShell path contain brackets or wildcard characters without changing the target?
Yes. Use -LiteralPath with cmdlets such as Get-Acl and Test-Path when the path must be interpreted exactly as written. This prevents wildcard characters from selecting a different set of files.
What do OI and CI mean in an icacls grant?
OI means object inherit, so the rule can flow to files, while CI means container inherit, so it can flow to child directories. Remove either flag when inheritance to that type of child is not required.
Is an ACL backup usable on a different computer?
The saved entries contain identities that may resolve differently across computers or domains. Treat the backup as a recovery record for the same path and security environment, and review identity mappings before restoring it elsewhere.
Why can a user read a file but still be unable to delete it?
Deletion is controlled by permissions on the containing directory as well as access to the file itself. Inspect the parent directory’s ACL and the account’s effective rights instead of granting broad rights directly to the file.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
