User Name Password Log in Register

Remember Me?

What's New? Forum Tutorials News Join Us Search..

FAQ Tutorial Index Advanced Search

 Forum  Windows 10 Forums  Tutorials 

Change Permissions of Objects for Users and Groups in Windows 10

Change Permissions of File, Folder, Drive, or Registry Key for Users and Groups in Windows 10
Published by Shawn Brink Category: User Accounts
20 Mar 2020

How to Change Permissions of File, Folder, Drive, or Registry  

Key for Users and Groups in Windows 10

On NTFS and ReFS volumes, you can set security permissions on les and folders. These permissions grant or deny
access to the les and folders.

Every container (ex: folder) and object (ex: le) on the PC has a set of access control information attached to it. Known as
a security descriptor, this information controls the type of access allowed to users and groups. The security descriptor is
automatically created along with the container or object that is created.

When you are a member of a group (ex: "Administrators") that is associated with an object, you have some ability to
manage the permissions on that object. For those objects you own, you have full control.

Permissions are de ned within an object's security descriptor. Permissions are associated with, or assigned to, speci c
users and groups. For example, for the le Temp.dat, the built-in Administrators group might be assigned Read, Write,
and Delete permissions, while the Backup Operators group might be assigned Read and Write permissions only.

Each assignment of permissions to a user or group is represented in the system as an access control entry (ACE). The
entire set of permission entries in a security descriptor is known as a permission set or access control list (ACL). Thus, for
a le named Temp.dat, the permission set includes two permission entries, one for the built-in Administrators group and
one for the Backup Operators group.

There are two types of permissions: explicit permissions and inherited permissions.

Explicit permissions are those that are set by default on non-child objects when the object is created, or by user
action on non-child, parent, or child objects.
Inherited permissions are those that are propagated to an object from a parent object. Inherited permissions ease
the task of managing permissions and ensure consistency of permissions among all objects within a given
container.
Inherited Deny permissions do not prevent access to an object if the object has an explicit Allow permission
entry.
Explicit permissions take precedence over inherited permissions, even inherited Deny permissions.

By default, objects within a container inherit the permissions from that container when the objects are created. For
example, when you create a folder called MyFolder, all subfolders and les created within MyFolder automatically inherit
the permissions from that folder. Therefore, MyFolder has explicit permissions, while all subfolders and les within it
have inherited permissions.
This tutorial will show you how to change permissions of a le, folder, drive, or registry key to allow or deny access for
users and groups in Windows 10.

Contents
Option One: To Add User or Group and Set Permissions for File, Folder, Drive, or Registry Key in Security Settings
Option Two:To Add User or Group and Set Permissions for File, Folder, Drive, or Registry Key in Advanced
Security Settings
Option Three: To Remove User or Group from Permissions for File, Folder, Drive, or Registry Key in Security
Settings
Option Four: To Remove User or Group from Permissions for File, Folder, Drive, or Registry Key in Advanced
Security Settings
Option Five: To Change Permissions for User or Group of File, Folder, Drive, or Registry Key in Security Settings
Option Six: To Change Permissions for User or Group of File, Folder, Drive, or Registry Key in Advanced Security
Settings
Option Seven: To Change Permissions for User or Group of File, Folder, or Drive in Command Prompt

OPTION ONE
To Add User or Group and Set Permissions for File, Folder, Drive, or Registry Key
in Security Settings

1 Perform one of the following actions for what you want to do:

A) Right click or press and hold on a registry key, and click/tap on Permissions.

OR

B) Right click or press and hold on a le, folder, or drive, and click/tap on Properties. Click/tap on the Security
tab, and click/tap on the Edit button. (see screenshot below)
  If you see this below instead, then it means you will need to take ownership of this le, folder, drive, or
registry key rst, and try again.

2 Click/tap on the Add button. (see screenshot below)

 3 Click/tap on the Advanced button. (see screenshot below)

4 Click/tap on the Find Now button, select the name of the user or group (ex: "Brink2") you want to add, and
click/tap on OK. (see screenshot below)

 If you like, you can press and hold the Ctrl key to select more than one user and/or group to add.
 5 Click/tap on OK. (see screenshot below)

6 Select the added user or group, check the Allow or Deny boxes for the permissions you want to assign to this
user or group for this le, folder, drive, or registry key, and click/tap on Apply. When nished, click/tap on OK. (see
screenshot below)
 7 Click/tap on OK. (see screenshot below)

OPTION TWO
To Add User or Group and Set Permissions for File, Folder, Drive, or Registry Key
in Advanced Security Settings
1 Perform one of the following actions for what you want to do:

A) Right click or press and hold on a registry key, and click/tap on Permissions.

OR

B) Right click or press and hold on a le, folder, or drive, and click/tap on Properties.

2 Click/tap on the Security tab, and click/tap on the Advanced button. (see screenshot below)

3 Click/tap on the Add button. (see screenshot below)

 If you see this below instead, then it means you will need to take ownership of this le, folder, drive, or
registry key rst, and try again.
4 Click/tap on the Select a principal link. (see screenshot below)
 5 Click/tap on the Advanced button. (see screenshot below)

6 Click/tap on the Find Now button, select the name of the user or group (ex: "Brink2") you want to add, and
click/tap on OK. (see screenshot below)

 If you like, you can press and hold the Ctrl key to select more than one user and/or group to add.
 7 Click/tap on OK. (see screenshot below)

8 Select Allow or Deny in the Type drop menu for the type of permissions you want to change. (see screenshots
below step 10)

9 If this is for a folder, drive, or registry key, then select what you want in the Applies to drop menu for how the
permissions will be applied. (see screenshots below step 10)

10 Check or uncheck the Basic permissions or Advanced permissions you want to assign to this user or group for
this le, folder, drive, or registry key, and click/tap on OK. (see screenshots below)
11 When nished, click/tap on OK. (see screenshot below)
 12 Click/tap on OK. (see screenshot below)

OPTION THREE
To Remove User or Group from Permissions for File, Folder, Drive, or Registry Key
in Security Settings

1 Perform one of the following actions for what you want to do:

A) Right click or press and hold on a registry key, and click/tap on Permissions.

OR

B) Right click or press and hold on a le, folder, or drive, and click/tap on Properties. Click/tap on the Security
tab, and click/tap on the Edit button. (see screenshot below)

 If you see this below instead, then it means you will need to take ownership of this le, folder, drive, or
registry key rst, and try again.
 2 Select the user or group (ex: "Brink2") you want to remove, and click/tap on the Remove button. (see
screenshot below)

 If this is an inherited user or group, then you will get the error message below.

In this case, you would need to go to the parent ("Inherited from" source) of this le, folder, drive, or registry
key, and remove this user or group from the parent's security settings instead.
3 When nished, click/tap on OK. (see screenshot below)

4 Click/tap on OK. (see screenshot below)

OPTION FOUR
To Remove User or Group from Permissions for File, Folder, Drive, or Registry Key
in Advanced Security Settings

1 Perform one of the following actions for what you want to do:

A) Right click or press and hold on a registry key, and click/tap on Permissions.

OR

B) Right click or press and hold on a le, folder, or drive, and click/tap on Properties.

2 Click/tap on the Security tab, and click/tap on the Advanced button. (see screenshot below)
 3 Select the user or group (ex: "Brink2") you want to remove, and click/tap on the Remove button. (see
screenshot below)

 If this is an inherited user or group, then you will get the error message below.

In this case, you would need to go to the parent ("Inherited from" source) of this le, folder, drive, or registry
key, and remove this user or group from the parent's advanced security settings instead.

If you see this below instead, then it means you will need to take ownership of this le, folder, drive, or
 registry key rst, and try again.

4 When nished, click/tap on OK. (see screenshot below)

 5 Click/tap on OK. (see screenshot below)

OPTION FIVE
To Change Permissions for User or Group of File, Folder, Drive, or Registry Key in
Security Settings

1 Perform one of the following actions for what you want to do:

A) Right click or press and hold on a registry key, and click/tap on Permissions.

OR

B) Right click or press and hold on a le, folder, or drive, and click/tap on Properties. Click/tap on the Security
tab, and click/tap on the Edit button. (see screenshot below)

 If you see this below instead, then it means you will need to take ownership of this le, folder, drive, or
registry key rst, and try again.
 2 Select a user or group (ex: "Brink2") you want to change permissions for, check the Allow or Deny boxes for the
permissions you want to assign to this user or group for this le, folder, drive, or registry key, and click/tap on
Apply. When nished, click/tap on OK. (see screenshot below)

3 Click/tap on OK. (see screenshot below)

OPTION SIX
To Change Permissions for User or Group of File, Folder, Drive, or Registry Key in
Advanced Security Settings

1 Perform one of the following actions for what you want to do:

A) Right click or press and hold on a registry key, and click/tap on Permissions.

OR

B) Right click or press and hold on a le, folder, or drive, and click/tap on Properties.

2 Click/tap on the Security tab, and click/tap on the Advanced button. (see screenshot below)
 3 Select a user or group (ex: "Brink2") you want to change permissions for, and click/tap on the Edit button. (see
screenshot below)

 If this is an inherited user or group, then you will see a View button instead of an Edit button.

In this case, you would need to go to the parent ("Inherited from" source) of this le, folder, drive, or registry
key, and change permissions of this user or group from the parent's advanced security settings instead.

If you see this below instead, then it means you will need to take ownership of this le, folder, drive, or
registry key rst, and try again.
 4 Select Allow or Deny in the Type drop menu for the type of permissions you want to change. (see screenshots
below step 6)

5 If this is for a folder, drive, or registry key, then select what you want in the Applies to drop menu for how the
permissions will be applied. (see screenshots below step 6)

6 Check or uncheck the Basic permissions or Advanced permissions you want to assign to this user or group for
this le, folder, drive, or registry key, and click/tap on OK. (see screenshots below)
7 When nished, click/tap on OK. (see screenshot below)

8 Click/tap on OK. (see screenshot below)

OPTION SEVEN
To Change Permissions for User or Group of File, Folder, or Drive in Command
Prompt

 For more options on the icacls command, see: Icacls - Microsoft Docs

1 Open a command prompt or elevated command prompt depending on your permission level for this le,
folder, or drive.

2 Type the command below you want to use into the command prompt, and press Enter . (see screenshot below
step 3)

(Apply to this le only)

icacls "full path of file" /grant "user or group":(permissions)

OR

(Apply to this folder only)

icacls "full path of folder" /grant "user or group":(permissions)

OR

(Apply to this folder, subfolder and les)

icacls "full path of folder" /grant "user or group":(permissions) /t /c

OR
(Apply to this drive only)
icacls "drive letter:" /grant "user or group":(permissions)

OR

(Apply to this drive, subfolder and les)

icacls "drive letter:" /grant "user or group":(permissions) /t /c

 Substitute full path of le in the command above with the actual full path of the le with extension (ex:
"F:\MyFolder\Lock.png") you want to change permissions for.

Substitute full path of folder in the commands above with the actual full path of the folder (ex:
"F:\MyFolder") you want to change permissions for.

Substitute drive letter in the commands above with the actual drive letter (ex: "F") you want to change
permissions for.

Substitute user or group in the commands above with the name of the user or group (ex: "Brink2") you
want to change permissions for.

Substitute permissions in the commands above with one or more basic and/or advanced permissions
you want to assign to the user or group from the table below with each permission separated by a
comma in.

For example: icacls "F:\MyFolder" /grant "Brink2":(RX,W) /t /c

Basic Permissions Description

N no access

F full access

M modify access

RX read and execute access

R read-only access

W write-only access

D delete access

Advanced Permissions Description

DE delete

RC read control

WDAC write DAC

WO write owner

S synchronize

AS access system security

MA maximum allowed

GR generic read

GW generic write

GE generic execute
 GA generic all

RD read data/list directory

WD write data/add le

AD append data/add subdirectory

REA read extended attributes

WEA write extended attributes

X execute/traverse

DC delete child

RA read attributes

WA write attributes

3 When nished, you can close the command prompt if you like.

That's it,
Shawn

 Related Tutorials

Enable or Disable Inherited Permissions for Files and Folders in
Windows
How to Add Inherited Permissions Context Menu in Windows
How to Add Reset Permissions to Context Menu in Windows
How to Add View Owner to Context Menu in Windows
How to Add Take Ownership to Context Menu in Windows 10
How to Change Owner of File, Folder, Drive, or Registry Key in
Windows 10
How to Add Advanced security to context menu in Windows 8
and Windows 10
How to Add or Remove Users from Groups in Windows 10
How to Remove Security tab from Drives, Files, and Folders
Properties in Windows 10
How to Add List Permissions Context Menu in Windows
How to Backup and Restore Permissions of Files, Folders, or
Drives in Windows 10
How to Add Change Owner to Context Menu in Windows 10

23 Nov 2017 #1

Try3

Posts : 6,148
Windows 10 Home
x64 Version 20H2
Build 19042.685