Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm an administrator on a Windows 2008 server. When I try to change file permissions on a directory, I get an error:

Error Applying Security

Access is denied.

I am an administrator on the machine, and I made sure nothing has the file(s) locked (with Process Explorer). I even booted another user who had a logged-in Remote Desktop session.

Some of the files it complains about are in a .hg folder, as there is a Mercurial repository in the directory I'm working on.

I noticed that something in the directory is set to read-only so I unchecked that and applied. It looked like it worked, but looking again it's back to read-only and setting permissions still fails.

There is a site in IIS using a subdirectory of this directory.


I just found this article about this sort of problem. The note at the bottom mentions that if it's not working, check out LockHunter. It told me that the directory was locked by IIS, so I ran iisreset -stop and tried setting permissions again. Same error. :(

share|improve this question
up vote 10 down vote accepted

This can happen if you really don't have access to that directory. In Windows you CAN lock out the administrator. Ran into this last week, in fact. Check the permissions on that directory to ensure that Administrators is in the list. If you can't even do that, you'll have to take ownership of the folder first (it's a tab in the Advanced Permissions dialog screen).

share|improve this answer
Looking at the top level folder I'm working on, Administrators has Full Control. I thought I already have ownership of it, but I just tried taking it again, making sure to check the box to apply recursively. It works now! I can't be sure that another admin didn't do something while I wasn't looking though :P – adambox Oct 22 '10 at 13:39

I resolved this problem with the following steps:
Open a Command Prompt "As Administrator"
Run the following commands:

takeown /f G:\folder /r /d y
icacls G:\folder /grant administrators:F /T

Takeown will change the owner to you, the administrator. Icacls will give you full privileges on the files.

After that is done, you can apply the correct ACLs.

share|improve this answer
It would be helpful if you included a description and/or reasoning for the commands you have included. – BE77Y May 27 '15 at 15:19
Worked for me :) Thanks. – Jakob Oct 8 '15 at 12:43

try again using the default administrator. In Windows 7/Server 2008 there are UAC type restrictions that do not apply to the default administrator. When using other administrative or domain administrative accounts, access denied type errors when applying permissions do often occur. I'm not one to turn the UAC off, we just need learn to operate in a more secure system.

share|improve this answer

If anyone else comes across this problem - it happened for me when I wanted to add a service account user to a folder containing thousands of files and the error came up for a lot of them. MDSN says that if you click Continue it still applies the permission on that file. Problem is nobody wants to click it thousands of times.

What worked at the end was changing ownership (Security tab -> Advanced -> Ownership). I changed ownership to a different user than original and applied it to all sub folders. After it finished I changed it back to original owner and again opted to apply to all sub folders.

After you do that the error no longer occurs when applying permissions. Seems like the above procedure resets any errors there are on folders and files.

share|improve this answer

You May need to boot the server and run a cacls command through a startup script before it can be locked.

share|improve this answer

I resolved this problem by the following steps:

  1. Open a Command Prompt "As Administrator"
  2. Run the following commands:

takeown /f G:\folder /r /d y icacls G:\folder /grant administrators:F /T


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.