Fix Windows Access Denied Using PowerShell (Take Ownership + ACLs)

The Root Cause

Windows security is based on:

• SIDs (Security Identifiers), not usernames

So:

• Same username ≠ same identity
• Files copied across machines retain original ownership

🔍 The Fix Strategy

We perform 3 operations:

1. Take ownership (takeown)
2. Modify ACL (icacls)
3. Delete (Remove-Item)

🧾 Script

$folder = "Z:\backups\_Windows_delete\bcastdvr"
$user = "$env:COMPUTERNAME\$env:USERNAME"

takeown /f $folder /r /d y
icacls $folder /grant "$user:(F)" /t /c
Remove-Item $folder -Recurse -Force

🔬 Command Breakdown

takeown

• Reassigns ownership recursively

icacls

• Modifies ACL (Access Control List)
• (F) = Full control

Remove-Item

• PowerShell-native recursive delete

⚠️ PowerShell vs CMD Gotcha

CMDPowerShell%username%$env:USERNAME

🧪 When This Fails

• Network drives (permissions external)
• Read-only media
• System-protected folders

💡 Takeaway

Understanding Windows ACLs is critical when:

• Working with backups
• Moving files across environments
• Debugging permission issues