1

Classic story - moved a portable USB HDD to a new Win10 machine. All folders on it are marked as "Owned by the previous user", and therefore it hit me with the "You need permission to access. Click Continue to gain permanent access". Yes, even when logged as an Admin.

This is really annoying to do every time I move machines with that HDD. Modifying the security permissions works (as in it grant access) but is dreadfully slow to do every time.

The read/write access to the HDD is enforced by the kernel/filesystem of Windows. Linux or any other OS will not enforce it, granting full access regardless of what account is currently logged in. Therefore, is there a way to disable this Read/Write enforcement in Windows in a way that Admins (and only admins) can ignore the ownership and read/modify files of any user/account/owner freely? This will also help with the files that had their ownership info damaged in any way.

Improve this question
2
  • 1
    By default the permissions on an external HDD should allow any Windows user (on any Windows machine) to access the file. If the permissions were changed then that was initiated by the user themselves.
    – Ramhound
    Commented Aug 23, 2023 at 10:32
  • 1
    If sharing across machines, add user Everyone with full access permissions to the root of the drive, tick the box for inheritance, allow it to process all files/directories, and the issue will never occur again. If it needs to be more secure than that, on each machine it will connected to, add the local user that's accessing it from each machine (you can likely do this from only one machine by granting permissions by SID versus user name) - another way would be to add users accessing it to a specific default group, then adding that group with full access permissions
    – JW0914
    Commented Aug 23, 2023 at 13:35

1 Answer 1

Reset to default
4

Windows does have a "security bypass" privilege (SeBackupPrivilege aka "Back up files or folders" for unrestricted read access and SeRestorePrivilege for unrestricted write), which all Administrators actually have by default, but a process still needs to manually activate it; normally it is present "on demand". (PowerShell, for example, uses SeRestorePrivilege when you ask it to delete something that you don't have access to.)

Read/modify access is not determined by file ownership – it's determined by file ACL (access control list). While only one user (or group) can own a file, you can add as many users (or groups) with "Full Control" access to the file's ACL. For an external HDD, it would be simplest to add a single Everyone entry to the ACL, making ownership practically irrelevant.

(Ownership is mostly just for quota accounting and for emergency ACL reset access; the latter is actually why "taking ownership" is the first step of regaining access – but that's only the first step; the second step is to use owner privilege to set a new ACL.)

  1. Assign ownership of everything on the disk to the "Administrators" group. (Not strictly needed but makes things easier, as this group has the same SID on all Windows machines.)

    takeown /f Y:\ /s /a

  2. Reset ACLs on everything to the default "inherit from parent" mode.

    icacls Y:\ /reset /t

  3. Add "Everyone" with full access to the ACL. (Like the built-in Administrators or Users groups, the special "Everyone" identifier also has the same SID on all Windows systems.)

    icacls Y:\ /grant "Everyone:(OI)(CI)(F)"

    Specifying (OI)(CI) will set the entry as "inheritable" so it will automatically propagate to all files and subfolders underneath Y:\.

    Optionally, specifying :r in /grant:r will remove all other explicit entries (replacing the entire ACL with just "Everyone"). Normally /grant only adds to the list.

  4. Remove the other, now redundant ACL entries (Administrators, SYSTEM, &c).

Newly created files will once again have the current user as their owner, but that's not an issue – the files will inherit an ACL that grants Everyone full access.

Improve this answer
1
  • 1
    Excellent answer. Exactly what was needed.
    – Noideas
    Commented Aug 23, 2023 at 11:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .