NTFS Access Denied means Windows authenticated your account but refused the requested operation under the file or folder’s security rules. The reliable fix is to identify whether the block comes from ownership, an access-control entry, inheritance, EFS encryption, a lock, a bad path or file-system corruption, then change only the setting that explains the symptom. Start with the inspection steps below; do not recursively reset permissions on a Windows system folder as a first move.
What “NTFS access denied” actually means
NTFS is the Windows file system that stores a security descriptor with each file and folder. When you open, copy, move, rename or delete an object, Windows first authenticates your account and then evaluates that descriptor. The result is an authorization decision, not a diagnosis of one particular fault.
As an Amazon Associate I earn from qualifying purchases.
The descriptor can include a discretionary access control list (DACL), an owner, inheritance settings and access-control entries (ACEs). An ACE can allow or deny rights such as reading data, writing data, deleting the object or traversing a folder. An explicit deny is evaluated before an allow in the normal canonical order, so an account can have an Allow entry and still be refused. A stale security identifier (SID) from an account that no longer exists can also leave an unexpected rule behind.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Ownership is separate from permission entries. Microsoft’s access-control model allows the owner to change an object’s permissions even when the owner was not otherwise granted access. Taking ownership therefore gives you the ability to repair the DACL; it does not automatically grant every right to every user, and it does not decrypt an encrypted file.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Keep these concepts separate while troubleshooting:
- Owner: the security principal allowed to change the object’s permissions.
- DACL: the allow and deny rules that determine ordinary access.
- Inheritance: whether permissions flow from a parent folder.
- EFS: encryption that requires the encrypting user or an appointed recovery agent, regardless of ordinary NTFS permissions.
- Volume health: file-system metadata or disk errors that can mimic an authorization failure but need a storage repair.
Identify the exact operation and scope first
Record what fails before changing anything. “Access denied” while opening one file has a different decision path from a whole drive that refuses writes.
| Symptom | What to check first | Why the distinction matters |
|---|---|---|
| One file will not open | That file’s owner, DACL, EFS attribute, lock and name | A parent-folder repair may change many unrelated objects without fixing encryption or a lock. |
| One folder and its children fail | Folder inheritance, child overrides and stale or deny ACEs | You may need a controlled recursive change, but only after preserving the existing ACL. |
| Delete or rename is refused | Delete rights on the object and its parent, plus whether another process has the file open | Read permission does not imply delete permission. |
| Copy fails | Read access at the source, write/create access at the destination, path and name validity | The source and destination each have independent security checks. |
| Move fails | Whether both locations are on the same NTFS volume, then source-delete and destination-create rights | A same-volume move and a cross-volume move use different underlying operations. |
| An entire volume behaves abnormally | Volume status, file-system errors and whether the volume is mounted read-only or busy | Changing individual ACLs cannot repair damaged NTFS metadata. |
Write down the full path, drive letter, account name, exact operation and whether the message appears in File Explorer, an application or a command prompt. This record makes it possible to test the same action after each change.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Inspect ownership, permissions and inheritance without changing them
Use the Security tab for a single object
- In File Explorer, right-click the file or folder and choose Properties.
- Open Security. Select your account and note the Allow and Deny entries shown under permissions.
- Select Advanced. Record the current Owner, whether inheritance is enabled, and every principal listed in the access-control entries.
- Look for a principal displayed only as a SID, an explicit Deny entry, or an entry that applies to “This folder, subfolders and files.” Those details often explain why a seemingly correct Allow entry has no effect.
Do not remove entries just because they look unfamiliar. System and application folders commonly contain service accounts and deliberately restricted rules. If the object is a folder tree, preserve the existing ACL before making a bulk change.
Capture an ACL from an elevated Command Prompt
Open Start, type Command Prompt, right-click it and select Run as administrator. Replace the example path with the real one. To display the current DACL, run:
icacls "D:pathtoobject"
To save the ACLs for later reference or restoration, run:
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
icacls "D:pathtofolder" /save "C:acl-backup.txt" /T /C
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall/T walks the folder tree and /C continues if an individual item reports an error. Store the backup somewhere outside the affected tree. An ACL backup is a record of security entries; it is not a copy of the file contents.
Repair a single object in the graphical interface
Take ownership when the owner is wrong
- Return to Properties > Security > Advanced.
- Next to Owner, select Change.
- Enter the intended account or administrator group, choose Check Names, then select OK.
- If the target is a folder and you deliberately need the change to reach its children, enable the option to replace the owner on subcontainers and objects. Use that option only when the entire tree belongs under the same administrative control.
- Select Apply, close the dialogs, reopen Advanced Security Settings and verify the owner.
Ownership changes the ability to edit the DACL; it is not a reason to grant Full Control broadly. After ownership is corrected, add the smallest permission needed for the account that must perform the operation.
Correct an Allow entry or an incorrect Deny entry
- In Advanced Security Settings, select the affected principal and choose Disable inheritance only if you have decided that this object must stop receiving parent rules. Choose whether existing inherited entries should be converted to explicit entries; retain them unless you have a documented reason to remove them.
- For an incorrect explicit Deny, select that specific entry and remove it. Do not remove every Deny entry indiscriminately.
- Select Add to choose the required user or group, then grant only the needed rights. Read is sufficient to open a file; Modify is generally enough for an application that must read, create, change and delete its own files. Reserve Full Control for a clearly defined administrative need.
- Apply the change and inspect the resulting list. Check whether the entry applies to the current folder only, to subfolders, to files, or to all three.
Adding an Allow entry cannot overcome a still-active Deny entry. If the account is a member of several groups, inspect the effective result of all of those entries rather than judging one row in isolation.
Make controlled repairs with icacls
icacls is Windows’ built-in command for viewing and changing DACLs, ownership, inheritance and recursive scope. Run it from an elevated Command Prompt and use the narrowest operation that matches the symptom.
Set the owner
To set ownership on a folder tree for the local Administrators group, an administrator can use:
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
icacls "D:pathtofolder" /setowner "Administrators" /T /C
Use the real principal name for the installation and language of Windows. Confirm the result with icacls or Advanced Security Settings before changing permissions.
Grant Modify to one account
For a user who needs to work in a data folder, a narrowly scoped Modify grant is preferable to Full Control:
icacls "D:pathtofolder" /grant "User":(OI)(CI)M /T /C
(OI) applies to files, (CI) applies to subfolders, and M is Modify. Remove the inheritance and scope flags when only the top-level object should change. Replace User with the intended account or group; do not paste this command unchanged into a system directory.
Remove a specific stale or incorrect entry
If inspection identifies an obsolete principal, remove that principal rather than resetting the whole tree:
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
icacls "D:pathtoobject" /remove "OldAccount"
Use the exact account or SID shown by the inspection. Removing a group can also remove access for legitimate members, so verify group membership first.
Reset inherited permissions only with a recovery plan
icacls "D:pathtofolder" /reset /T /C replaces entries with the default inherited permissions for each object. This can repair a deliberately damaged data tree, but it can also remove carefully designed application, service or personal permissions. Do not run a recursive reset on Windows, Program Files, a profile root or another system-managed tree unless you have a tested recovery plan and an ACL backup.
Restore a saved ACL when a change made matters worse
If you saved the original ACL, the corresponding restoration command is:
icacls "D:pathtofolder" /restore "C:acl-backup.txt"
Restoration depends on the paths and principals still being meaningful. It changes security metadata, not file contents, so keep the backup and document exactly what was restored.
Free tools Windows power users keep installed
One-click scans. No signup required.
Check for EFS encryption before changing permissions
Encrypting File System (EFS) is independent of ordinary NTFS authorization. Microsoft states that an EFS-encrypted file is accessible only to the person who encrypted it, regardless of the other permissions on the file. An administrator who takes ownership cannot decrypt it merely by adding an Allow entry.
Best Value
- [Upgraded Version] - This external hard drive features a mirrored logo stripe combined with a striped anti-slip design, and the rounded corners of the casing make it easier to grip. The stripes also have a heat dissipation function, ensuring stable and fast data transfer.
- 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
- 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
- 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
- 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
In File Explorer, right-click the file, choose Properties, select Advanced on the General tab and look for Encrypt contents to secure data. If it is selected, the encrypting user must sign in and decrypt the file, or the designated EFS recovery agent must do so. Open the Advanced dialog, clear the encryption option, apply it and allow Windows to process the file. If neither credential is available, do not delete the encrypted original while experimenting; recovery requires the appropriate EFS key.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Rule out locks, invalid names and path defects
File in use
An application, background service, antivirus scanner or synchronization client can hold a handle open. Close programs that may be using the file, pause synchronization, and retry. If the lock persists, restart Windows and test before launching the suspected application. A lock is not repaired by granting more permissions.
Path length and naming problems
Overlong paths, reserved device names and characters that are invalid for the Win32 API can produce an error that resembles an ACL failure. Test the object from a shorter parent path, verify every folder and file name, and avoid reserved names. If the item came from another operating system or archive, use a tool that can rename it to a valid Windows name before attempting a permission repair. Preserve the original location until the file is safely accessible.
Recommended Free Tools
Copy and move specifics
A copy needs read access at the source and create/write access at the destination. A move across volumes is effectively a copy followed by deletion of the source, so both sets of rights are required. A move within one NTFS volume primarily changes directory entries and still requires rights on the relevant parent directories. Test opening, copying to a temporary folder and deleting a disposable test file separately; each result narrows the cause.
Use chkdsk only when volume health is suspect
chkdsk checks a volume’s file system and metadata for logical and physical errors. It addresses corruption, not an ordinary DACL mistake, and repair modes require an elevated prompt.
Inspect first
- Open Command Prompt as administrator.
- Run
chkdsk X:, replacingX:with the affected drive letter. Read the reported file-system status and error information. - If the volume is removable or intermittently disconnecting, stabilize the connection before starting a repair.
Choose the repair level
| Command | Purpose | Operational impact |
|---|---|---|
chkdsk X: /f |
Fixes logical file-system errors. | May need exclusive access; Windows can schedule it at the next restart if the volume is busy. |
chkdsk X: /r |
Includes logical repair and checks for bad sectors while attempting to recover readable information. | Can take a long time, especially on large or troubled disks; schedule downtime and ensure important data has another copy. |
Do not interrupt a repair casually. After it completes, reboot if Windows scheduled the check, then retry the original operation. If errors recur, the volume remains inaccessible or storage repeatedly reports transaction-log failures, stop making broad permission changes and follow Microsoft’s storage-corruption recovery guidance.
Validate the fix and keep an audit trail
- Repeat the exact action that originally failed, using the same account and path.
- Test the least risky equivalent first: open a copy, create a temporary file, rename it, then delete the temporary file.
- Reopen Properties > Security > Advanced or run
icaclsto confirm the final owner, inheritance state and entries. - Record the date, account, path, command or GUI change, and result. Keep the ACL backup until normal operation has been confirmed.
- If only one application still fails, check that application’s service account and data-location requirements rather than widening access for every user.
When the same error returns after a precise ACL repair, treat that recurrence as evidence that the cause may be EFS, a lock, a naming defect or storage corruption. Repeating increasingly broad permission grants can hide the symptom while creating a larger security problem.
Quick Recap
A practical decision path
- One object or many? Start with that object’s Security and Advanced views; use recursive commands only for a confirmed tree-wide problem.
- Open, copy, move or delete? Identify the required source and destination rights, including parent-folder delete rights.
- Owner incorrect? Set the owner, then add the minimum Allow entry.
- Deny or stale SID present? Remove only the identified incorrect entry and re-test effective access.
- EFS attribute present? Sign in as the encrypting user or use the recovery agent; NTFS permission edits are not a substitute.
- Lock or invalid path suspected? Close the holder, restart, shorten the path or repair the name.
- Volume reports errors? Inspect with
chkdsk, then select/for/raccording to the required repair and available downtime. - Still inaccessible? Preserve the evidence and backups, avoid further blanket resets, and move to storage-corruption recovery or professional data-recovery advice.
If you prefer an optional shortcut after trying the manual checks, Outbyte PC Repair can address more than 100 common Windows issues where possible, including broken system elements, invalid redirects and shared DLL files, while offering settings tweaks, temporary and cache cleanup, privacy warnings, vulnerability checks, a real-time boost, file shredding and an app-crash log. It runs on Windows 11, 10, 8 and 7, offers a free trial by category for at least two days before a paid subscription, complements an antivirus rather than replacing one, and results vary—no tool repairs every crash.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
