# “Error Applying Security - Access is denied” while changing file permissions on windows server 2008

I'm an administrator on a Windows 2008 server. When I try to change file permissions on a directory, I get an error:

Error Applying Security

Access is denied.

I am an administrator on the machine, and I made sure nothing has the file(s) locked (with Process Explorer). I even booted another user who had a logged-in Remote Desktop session.

Some of the files it complains about are in a .hg folder, as there is a Mercurial repository in the directory I'm working on.

I noticed that something in the directory is set to read-only so I unchecked that and applied. It looked like it worked, but looking again it's back to read-only and setting permissions still fails.

There is a site in IIS using a subdirectory of this directory.

Update:

I just found this article about this sort of problem. The note at the bottom mentions that if it's not working, check out LockHunter. It told me that the directory was locked by IIS, so I ran iisreset -stop and tried setting permissions again. Same error. :(

This can happen if you really don't have access to that directory. In Windows you CAN lock out the administrator. Ran into this last week, in fact. Check the permissions on that directory to ensure that Administrators is in the list. If you can't even do that, you'll have to take ownership of the folder first (it's a tab in the Advanced Permissions dialog screen).

• Looking at the top level folder I'm working on, Administrators has Full Control. I thought I already have ownership of it, but I just tried taking it again, making sure to check the box to apply recursively. It works now! I can't be sure that another admin didn't do something while I wasn't looking though :P – adambox Oct 22 '10 at 13:39
• @adambox I just had the issue on a fresh environment with a newly created folder, and I am sure that nobody else was doing anything on the system at that time. Reapplying myself as the owner worked. – Stijn Aug 23 '17 at 12:27

I resolved this problem by the following steps:

1. Open a Command Prompt "As Administrator"
2. Run the following commands:

takeown /f G:\folder /r /d y icacls G:\folder /grant administrators:F /T 

If anyone else comes across this problem - it happened for me when I wanted to add a service account user to a folder containing thousands of files and the error came up for a lot of them. MDSN says that if you click Continue it still applies the permission on that file. Problem is nobody wants to click it thousands of times.

What worked at the end was changing ownership (Security tab -> Advanced -> Ownership). I changed ownership to a different user than original and applied it to all sub folders. After it finished I changed it back to original owner and again opted to apply to all sub folders.

After you do that the error no longer occurs when applying permissions. Seems like the above procedure resets any errors there are on folders and files.

• Simply reapplying the original owner, without changing to a different owner, was enough to fix the problem for me. – Stijn Aug 23 '17 at 12:28

try again using the default administrator. In Windows 7/Server 2008 there are UAC type restrictions that do not apply to the default administrator. When using other administrative or domain administrative accounts, access denied type errors when applying permissions do often occur. I'm not one to turn the UAC off, we just need learn to operate in a more secure system.

i reached here via google, though very late to the party, but hopefully can help someone.

in my case, the cause is simply because of a funny folder name in a certain parent folder, after i get rid of the special characters, they are all going fine by taking ownership normally via GUI.

You May need to boot the server and run a cacls command through a startup script before it can be locked.

takeown /f G:\folder /R /A /D y


the /A foregoes the need to icacls administrators after. It is important to remember that this will remove any preexisting permissions and users actively using this folder will no longer have access.

I find takeown works much better than the gui for difficult permissions. If this were on a Windows server than RDPing into the file server directly would allow you to rectify the issue without removing current access though this is not an option for most of us.