How to Use the takeown and icacls Commands in Windows 11 to Fix File Permission Faults

When connecting external hard drives from previous Windows installations, recovering files following a clean OS reinstall, or attempting to delete lingering software folders (such as old Windows.old leftovers), Windows 11 frequently blocks access with frustrating Access is Denied or You need permission from TrustedInstaller alerts. These errors occur because NTFS filesystems bind security Access Control Lists (ACLs) to specific Security Identifiers (SIDs) rather than username strings. Using the native takeown and icacls command-line utilities, you can seize ownership and grant full administrative control in seconds.

Understanding the Two-Step Permission Recovery Process

Repairing locked NTFS files requires a strict two-step administrative sequence:

1. Step 1: Take Ownership (takeown): In Windows security architecture, you cannot alter permissions on an object unless you are registered as its Owner or hold backup rights. The takeown tool replaces the existing owner (e.g., TrustedInstaller or an orphaned legacy SID) with your administrative account.
2. Step 2: Grant Access Control (icacls): Once ownership is established, the icacls (Integrity Control Access Control List) tool modifies the discretionary access control list (DACL) to grant Full Control permissions.

Step-by-Step: Fixing Locked Files via Windows Terminal

1. Open Windows Terminal as Administrator

1. Press Win + X on your keyboard.
2. Select Terminal (Admin) or PowerShell (Admin).

2. Seize Ownership with takeown

To recursively seize ownership of a locked folder and all of its subdirectories and files:

takeown /F "D:\LockedFolder" /R /D Y

Command Parameter Breakdown:

• /F <path>: Specifies the target filename or directory path.
• /R: Recursively applies ownership down through all subdirectories.
• /D Y: Automatically suppresses confirmation prompts by answering “Yes” to take ownership of directory structures where you currently lack list permissions.

3. Grant Full Administrative Permissions with icacls

Now that ownership is assigned to Administrators, grant full read, write, and execute permissions to your local Administrators group:

icacls "D:\LockedFolder" /grant Administrators:F /T /C

Command Parameter Breakdown:

• /grant Administrators:F: Grants the local Administrators group Full Control (F).
• /T: Operates recursively down the directory tree.
• /C: Continues the operation even if errors occur on individual locked files, ensuring the rest of the directory tree is successfully unlocked.

Resetting Inherited Permissions Across an Entire Drive

If permission inheritance is damaged across an entire external drive, causing erratic read errors across hundreds of folders, you can reset all ACLs to clean inherited defaults:

icacls "D:\" /reset /T /C

The /reset switch strips explicit, corrupted security descriptors and restores clean inheritance from the root partition.

Common icacls Permission Codes Reference

Permission Code	Rights Granted
:F	Full Control: Complete read, write, modify, delete, and permission editing rights.
:M	Modify: Read, write, and delete files, but cannot alter security ACLs.
:RX	Read and Execute: View file contents and execute scripts/programs.
:R	Read-Only: View contents without execution or modification rights.