"Access Denied" Even Though You Are the Administrator: Windows 11 Ownership, Explained

If Windows is telling you "Access is denied" while you're signed in as an administrator, the fix in most cases is right-click the folder → Properties → Security → Advanced → change the Owner to your account — but here's the part almost nobody explains: being an "Administrator" account and actually having administrator rights at that moment are two different things, and Windows 11 and 10 both run you as a standard user by default until something elevates you.

Which "Access Denied" Are You Actually Looking At?

Jake had already spent forty minutes on this before he called Ethan. "I made myself the administrator on this laptop. Windows still won't let me into a folder. What is even the point of being the administrator if it doesn't work?"

"It does work," Ethan said. "It's just not switched on right now. Being an administrator account and running with administrator rights are two different states, and Windows keeps you in the weaker one almost all the time on purpose. Tell me exactly what you're trying to do and what message you're getting, because 'access denied' covers about five unrelated problems, and three of them have nothing to do with ownership at all."

Windows 11: Fixing "Access Denied" on a Local Folder

Here's the mechanism, because understanding it will save you from making the mistake Jake almost made. Every account in the Administrators group actually gets two access tokens when it signs in: a full-strength one, and a filtered, standard-user one. Windows quietly runs you on the weak token by default. This is User Account Control, or UAC — it's the reason a program has to ask your permission before it can change something serious, even though you're "the administrator." When you open File Explorer normally, you're on the weak token, so a folder locked to Administrators-only can reject you exactly the way it would reject a standard user.

When that happens on a folder you don't have read access to, Explorer shows a dialog that says you don't currently have permission to access the folder and offers a Continue button. Click it, and Windows tries to get you a moment of administrator rights and then — this is the part worth pausing on — permanently rewrites that folder's permission list to add your account with full control, on that folder and everything inside it.

For an ordinary personal folder — an old user profile, a folder that came from another drive, a Windows.old leftover — the cleaner and more visible way to do this is to take ownership deliberately through the Security tab, so you can see exactly what changed:

1. Right-click the folder and choose Properties, then open the Security tab.
2. Click Advanced, then click Change next to the current owner listed near the top.
3. Type your account name, click Check Names to confirm it resolves, then click OK.
4. Check "Replace owner on subcontainers and objects" so the change reaches every file inside, not just the top folder.
5. Still on the Advanced Security dialog, check "Replace all child object permission entries" too, if you can still not open files inside after taking ownership.
6. Click Apply, then OK, then try opening the folder again.

If a right-click menu doesn't show a full Properties option because it's condensed under the newer Windows 11 menu, that's a UI trap, not a permissions problem — see the box below before you assume something's broken.

Prefer the command line, or need to do this on a folder tree with thousands of files where the Security tab dialog would sit there spinning? Two built-in commands do the same job faster, run from an elevated Command Prompt (right-click Start, choose Terminal (Admin), or search "cmd," right-click it, and choose "Run as administrator"):

1. takeown /f "C:\path\to\folder" /r /d y — makes you the owner of the folder and everything inside it. The /r makes it recursive; /d y answers "yes" automatically to any prompt about folders you can't list yet, so the run doesn't stall waiting for input.
2. icacls "C:\path\to\folder" /grant administrators:F /t /c — grants the Administrators group Full Control on the same tree. /t applies it to subfolders and files, /c keeps going even if one file inside throws an error instead of aborting the whole run.

Owning a folder and having permission on it are technically separate things — takeown changes who owns it, icacls changes who's allowed to do what to it — which is why the fastest reliable fix runs both, in that order, rather than assuming ownership alone reopens the door.

Windows 11: "Access Denied" on a Server, Share, or Another PC

This is the one that catches people who just fixed the local-folder problem and assume the same steps apply. They don't. "Jake tried this on his shop PC," Ethan said. "Local admin account, full local rights, tries to open \\HISLAPTOP\Shared from the till computer, and it just says access denied — no Continue button, nothing to click. Different mechanism entirely, and taking ownership of the share on the other end does nothing here."

Windows deliberately strips a local account's full administrator token when it authenticates over the network — over a mapped drive, net use, an admin share like \\PCNAME\C$, or Remote Desktop's file-sharing redirection — even though that same account has full rights when you're sitting in front of that PC directly. It's called UAC remote restriction, and it exists specifically to stop malware on one machine from using a shared local admin password to walk sideways into every other PC on the network with full rights. This is why a "Full Control" entry on the share and folder can be entirely correct and you'll still get denied.

"So if I've got two shop laptops that both use the same local 'Admin' account and password because that's how they came set up," Jake said, "that's exactly the setup this is trying to stop me from having?"

"Pretty much," Ethan said. "One infected machine with that password could reach into the other one with full rights, silently, over the network. That's the risk. If it's genuinely just your two machines and you've weighed that, you can turn the restriction off for that account. I wouldn't do it on anything a customer's device touches."

If you understand that trade-off, the fix is a registry value, set on the PC being connected to — not the one you're sitting at:

1. Open Registry Editor and go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System.
2. Create a new DWORD (32-bit) value named LocalAccountTokenFilterPolicy if it isn't already there.
3. Set its value to 1, close Registry Editor, and try the connection again.

A few edge cases worth flagging before you conclude the registry value is the answer: on a domain-joined work laptop, this setting is often controlled centrally and greyed out or reset by policy, so check with whoever manages the domain before spending an hour on it. Over a VPN, the same restriction applies exactly as it does on a local network — VPN doesn't change which token you authenticate with. And inside a virtual machine, a shared folder set up through the hypervisor's own file-sharing feature (rather than a normal Windows network share) uses a completely different permission model, so none of the steps in this section apply there at all.

Windows 11 and 10: "Access Denied" Trying to Enable the Administrator Account

This is a specific, common variant: you type net user administrator /active:yes to switch on the hidden built-in Administrator account, and Command Prompt tells you "System error 5 has occurred. Access is denied." This isn't ownership, and it isn't the network restriction above either. It means either the Command Prompt window itself isn't running elevated, or the account you're typing from genuinely isn't a member of the local Administrators group, whatever the account tile on the sign-in screen might say.

The fix has two parts, and both need to be true:

1. Open Command Prompt or PowerShell by right-clicking it and choosing "Run as administrator" — not just opening it normally, even if your account looks like an administrator account on the sign-in screen.
2. Confirm your account is actually in the Administrators group: run net localgroup administrators and check your username is listed. If it isn't, someone who is already an administrator on that PC needs to add you — through Settings > Accounts > Family & other users on any edition, or Computer Management > Local Users and Groups on Pro editions.

That second point trips up more people than the first. It's genuinely possible to see "Administrator" written under your name on the sign-in screen or in Settings and still not hold that role — most often after a family-safety change quietly demotes an account to Standard, or after setting up a new Microsoft account that inherited the wrong role during a device transfer. If you get "access denied" from a window you're certain is elevated, and your username does appear in that Administrators listing, the remaining cause is usually a security policy blocking the built-in Administrator account specifically, separate from your own account's rights — a Pro/Enterprise-only setting, covered next.

Windows 10: Same Causes, Slightly Different Menus

Every fix above works identically on Windows 10 — the Continue dialog, takeown, icacls, the network registry value, and the "access denied" error from net user administrator /active:yes are the same mechanisms, going back to Windows Vista. The only real differences are cosmetic: Windows 10's right-click menu isn't condensed the way Windows 11's is, so you won't need the "Show more options" step, and the classic Control Panel is more often the primary place for account management rather than a fallback.

One honest note if you're on Windows 10: it reached the end of free security updates on October 14, 2025. It still boots, signs in, and runs every step in this article without any change — permissions and ownership aren't tied to update status — but if this PC is also missing security patches going forward, that's a separate and larger conversation than an access-denied folder. If you're not ready to move to Windows 11 yet, Consumer Extended Security Updates (ESU) are still open for enrollment through Settings > Windows Update, and Microsoft extended that coverage window into October 2027, so there's no rush forced by this one error.

What "Taking Ownership" Actually Means

"Okay, but what is an owner, actually?" Jake asked. "Isn't that just whoever created the file?"

"Only at first," Ethan said. "After that it's whoever holds the right to change the permission list — which is a right, not a fact about history. Every file and folder keeps a permission list, an ACL, that says which accounts can read it, write to it, or nothing at all. The owner is the one account that's always allowed to rewrite that list, even if the list currently says the owner itself has no access. That's the whole trick behind 'access denied even as admin' — you can be denied read access to a folder you technically own, right up until you use the ownership right to grant yourself access back."

That's also why takeown and icacls are two separate commands instead of one. Takeown answers "who's allowed to change the rules." Icacls is what actually changes them — it edits the ACL directly, adding, removing, or replacing specific permissions for specific accounts, with letter codes like F for full control, M for modify, and R for read-only.

The "You need permission to perform this action" message people hit trying to delete or rename a specific file is the same ownership problem wearing a different mask — it usually appears on a single file rather than a whole folder, and the fix is identical: check who owns that specific file under Security > Advanced, not just the folder around it, since a file can carry different permissions than the folder it sits in.

Do You Need a Third-Party Tool for This?

You'll find shell-extension utilities that add a one-click "Take ownership" entry straight to the right-click menu. They're not doing anything you can't already do — under the hood they're calling the same takeown and icacls behavior described above, just wrapped in a menu shortcut so you skip typing the command.

The only real risk with the third option is provenance — you're granting a downloaded tool the ability to rewrite system permissions on request, so it's worth getting it from a source you actually recognize rather than the first search result. If you're only fixing this once, there's nothing a shell extension does that the built-in Security tab doesn't already do for free.

Automating This Across Several PCs or Folders

If you're doing this repeatedly — Jake resets machines for the shop often enough that typing the same six clicks every time got old — the two commands from earlier chain into a single line you can save as a batch file:

takeown /f "C:\path\to\folder" /r /d y && icacls "C:\path\to\folder" /grant administrators:F /t /c

Save that as a .bat file, right-click it and choose "Run as administrator" whenever you need it, and it'll take ownership and grant Full Control in one step instead of two. You can also paste it as a right-click "Run as administrator" shortcut target if you want it available without opening a terminal at all. It's worth naming the file something specific like fix-folder-access.bat rather than something generic, since a batch file that silently grants Full Control recursively is not something you want a family member double-clicking on the wrong folder by accident.

When You Do All of This and It's Still Denied

Document the failure honestly instead of repeating the same command louder. Here's what each remaining failure pattern actually points to:

If none of that matches what you're seeing, the honest answer is that this article covers permission-layer causes, not every possible cause — a corrupted user profile or a failing drive can also throw an access-denied message that looks identical on the surface, and no permission command fixes either of those.

The Step People Skip: Tightening Back Up Afterward

"So once I fix it," Jake said, "am I done? Or is there a step people always skip?"

"There's one," Ethan said. "If you granted Administrators or your own account Full Control on a folder just to get past this error, and the folder wasn't supposed to be wide open — a customer's tax documents, a shared folder other people also use — go back afterward and tighten it. Right-click, Properties, Security tab, and look at exactly who's listed and what they can do. It's easy to solve the denial and forget you left the door open wider than it needs to be, especially if it's the kind of folder that later gets shared to a network drive or synced to the cloud without anyone rechecking who has access to it first." That habit costs Jake nothing and has saved him from exactly the kind of "how did this folder end up shared with everyone" conversation that's expensive to have after the fact.

Frequently Asked Questions

Why does Windows say access denied when I'm the administrator?

Because "administrator" describes which group your account belongs to, not what rights you're running with at that instant. Windows runs Administrators-group accounts on a filtered, standard-user token by default and only grants the stronger token when a program specifically asks for elevation. A folder locked to Administrators-only can reject you on the weak token exactly as it would a standard user.

What does "You don't currently have permission to access this folder" mean?

It means the folder's permission list doesn't currently include your account with read access. The Continue button on that dialog tries to elevate you and then permanently adds your account to the folder's permissions — it's not a temporary unlock.

Is it safe to click Continue on that dialog?

For a personal or app-specific folder, yes. For anything inside the Windows installation itself, no — it permanently widens that folder's permissions, and doing that to an operating-system folder can weaken protections you'll never notice removed until something exploits them.

How do I take ownership of a folder in Windows 11?

Right-click it, choose Properties, open the Security tab, click Advanced, click Change next to Owner, enter your account name, check "Replace owner on subcontainers and objects," then Apply and OK. For large folder trees, takeown /f "path" /r /d y from an elevated Command Prompt does the same thing faster.

What's the difference between takeown and icacls?

Takeown changes who owns a file or folder — who has the right to rewrite its permissions. Icacls actually edits those permissions. Taking ownership alone doesn't grant access; you usually need to run icacls afterward to actually add Full Control for your account or the Administrators group.

Why do I still get access denied after taking ownership?

The most common reason is an explicit Deny entry on the folder or a file inside it, which overrides any Full Control grant. Open Security > Advanced and look for a Deny line rather than adding another Allow on top of it.

Why can't I enable the built-in Administrator account?

Either the Command Prompt or PowerShell window running the command isn't elevated, or your account isn't actually a member of the local Administrators group despite what the sign-in screen shows. Right-click and choose "Run as administrator," and check group membership with net localgroup administrators.

Why do I get access denied connecting to a shared folder or another PC on my network, even as an admin?

Windows strips a local account's full administrator rights when it authenticates over the network, specifically to stop a shared local admin password from being used to compromise other machines. This is unrelated to file ownership — no amount of taking ownership of the shared folder fixes it.

What is UAC remote restriction and should I turn it off?

It's the mechanism above, controlled by a registry value called LocalAccountTokenFilterPolicy. Setting it to 1 restores full local-admin rights over the network, but it removes that protection for every remote connection using that account, not just the one you're troubleshooting — treat it as a deliberate trade-off, not a default setting.

Does Windows 11 Home have Group Policy Editor for permission-related settings?

No. Both the Local Group Policy Editor (gpedit.msc) and Local Security Policy (secpol.msc) are Pro, Enterprise, and Education only. On Home, the registry is the equivalent path for the same settings.

Do I need a third-party tool to take ownership of a file?

No. Shell-extension "Take ownership" add-ons just wrap the same takeown and icacls behavior in a right-click shortcut. They're convenient if you do this often, but the built-in Security tab or command line does the identical job for free.

Can access denied mean the file is actually locked by another program?

Yes, and it's easy to mistake for a permissions error. If Windows specifically says a file is in use by another process, that's not a permission problem at all — close the program holding it, or find it in Task Manager, rather than running ownership commands.

Does BitLocker or Device Encryption cause access denied?

It can lock a drive at a layer underneath file permissions, so takeown and icacls won't help until the drive itself is unlocked with its recovery key, found at aka.ms/myrecoverykey. Since Windows 11 24H2, Device Encryption is on by default on many new Home clean installs, which surprises people who didn't turn anything on themselves.

What about Windows.old and files after upgrading — access denied there too?

Yes, by design. Other users' personal folders inside Windows.old\Users are locked, and you'll see the same Continue dialog covered earlier in this article. Windows.old itself is only kept for about 10 days after an upgrade before Windows deletes it automatically.

Is this different on Windows 10 vs Windows 11?

The underlying mechanisms — the Continue dialog, takeown, icacls, and UAC remote restriction — are identical on both and go back to Windows Vista. The only differences are cosmetic: Windows 11's right-click menu is condensed, so you may need "Show more options" to see Properties, and Windows 10 relies more on the classic Control Panel for account management.

Revision note. Written August 2026, covering Windows 11 (25H2 and 24H2) and Windows 10 22H2, Home and Pro editions. This will need a revisit if a future Windows release changes how the folder-access Continue dialog behaves or moves the Security tab's ownership controls somewhere new.so kindlynrefer latest details on MS website if not worked or let me know through contact us page, i will check and update...If you've been stuck on this one for a while: it's a genuinely confusing error because the word "administrator" means two different things at once in Windows, and nobody tells you that up front — you're not missing something obvious.