Fixing Windows File Permissions

TL;DR

Incorrect file permissions on Windows can let people see files they shouldn’t, or stop the right people from accessing them. This guide shows you how to check and fix these permissions using standard Windows tools.

Checking Permissions

1. Find the File/Folder: Locate the file or folder you want to check in File Explorer.
2. Right-Click & Properties: Right-click on it and select ‘Properties’.
3. Security Tab: Click on the ‘Security’ tab. This shows who has access, and what they can do.
4. Users/Groups List: You’ll see a list of users and groups (like ‘Everyone’, your user account, or specific teams).
5. Permissions Explained: For each user/group, you’ll see permissions like ‘Read’, ‘Write’, ‘Modify’, ‘Full control’.
   • Read: Can open and view the file.
   • Write: Can change the file.
   • Modify: Read & Write access plus deleting the file.
   • Full Control: Complete access – read, write, modify, delete, change permissions.

Fixing Permissions

If the permissions look wrong (e.g., ‘Everyone’ has full control when they shouldn’t), follow these steps:

Method 1: Basic Permission Changes

1. Edit Permissions: In the ‘Security’ tab, select the user/group you want to change permissions for and click ‘Edit’.
2. Tick Boxes: Tick or untick the boxes under ‘Allow’ to grant or deny specific permissions. Be careful – removing essential permissions can lock people out!
3. Apply & OK: Click ‘Apply’, then ‘OK’ on both windows.

Method 2: Advanced Permission Settings (More Control)

1. Advanced Button: In the ‘Security’ tab, click the ‘Advanced’ button.
2. Owner Tab: Check who owns the file/folder under the ‘Owner’ tab. If it’s not right, change it to an appropriate user account (usually yours or a dedicated admin account).
   • Click ‘Change’, enter the new owner name and click ‘Check Names’.
3. Permissions Tab: Go to the ‘Permissions’ tab. This shows more detailed permissions.
4. Remove Unnecessary Entries: Select entries you don’t want and click ‘Remove’. Be cautious!
5. Add Necessary Entries: Click ‘Add’, enter the user/group name, click ‘Check Names’, then select the specific permissions they need.
6. Inheritance: Pay attention to inheritance.
   • If a folder has inherited permissions from its parent folder, changes you make here might not stick unless you disable inheritance first (tick ‘Replace all child object permission entries with inheritable permission entries from this object’ or similar option).
7. Apply & OK: Click ‘Apply’, then ‘OK’ on both windows.

Method 3: Using icacls (Command Line – for advanced users)

The icacls command lets you manage permissions from the command line. Open Command Prompt as an administrator.

1. View Permissions: To see current permissions, use:

   icacls <file/folder path>

2. Grant Permission: To grant ‘Read’ permission to a user:

   icacls <file/folder path> /grant <username>:R

3. Remove Permission: To remove all permissions for a user:

   icacls <file/folder path> /remove <username>

Important Notes

• Administrator Access: You usually need administrator rights to change permissions.
• Be Careful! Incorrect permissions can cause serious problems. Back up important files before making changes.
• Inheritance: Understand how inheritance works – it’s a common source of confusion.
• Testing: After changing permissions, test them with different user accounts to make sure they work as expected.