Fix "You Need Permission to Perform This Action"

The Problem

Windows checks two things before it lets you touch a file: who owns it, and what the access control list says your account may do. Both are stored with the file, not with the PC — so files copied from an old machine, restored from a backup, or left behind by a deleted user account carry permissions that refer to an account that no longer exists.

The result is being locked out of your own documents on your own PC, even from an administrator account. Fixing it means taking ownership and then granting your account access.

Error says the file is in use rather than denied? Different cause — see fix "file is open in another program". Whole user profile misbehaving? Test a new account as described in Step 8.

Symptoms

• "You'll need to provide administrator permission to delete this folder."
• "You don't currently have permission to access this folder."
• "Access is denied" when opening, renaming, or saving a file.
• Folders from an old PC or an external drive show a padlock overlay.
• An Unknown Account with a long S-1-5-21-… identifier appears in the Security tab.

Step 1: Confirm You Are an Administrator

1. Open Settings → Accounts → Your info.
2. Under your name it should say Administrator. If it says Standard user, you cannot change permissions.
3. To change it, sign in with an administrator account and use Settings → Accounts → Other users → select the account → Change account type.
4. On a work or school PC, permissions are set by policy — contact IT rather than overriding them.

Step 2: Take Ownership Through the Properties Dialog

This is the safe, reversible route for a specific folder.

1. Right-click the folder → Properties → Security tab → Advanced.
2. At the top, next to Owner, click Change.
3. Type your Windows account name (or Administrators) into the box, click Check Names, then OK.
4. Tick Replace owner on subcontainers and objects.
5. Click Apply. Accept any warnings and let it work through the folder tree — this can take several minutes on a large folder.
6. Do not close the dialog yet; continue to Step 3.

Step 3: Grant Your Account Full Control

Ownership alone does not grant access. This step does.

1. Still in Advanced Security Settings, click Add → Select a principal.
2. Type your account name → Check Names → OK.
3. Set Type to Allow and tick Full control.
4. Click OK.
5. Back on the main list, tick Replace all child object permission entries with inheritable permission entries from this object.
6. Click Apply → OK, and confirm the warning.
7. Close and reopen the folder.

Step 4: Do It from Terminal for Large or Stubborn Trees

Faster than the dialog, and it does not stall on a deep folder tree.

1. Right-click Start → Terminal (Admin).
2. Take ownership recursively:

   takeown /f "D:\Path\To\Folder" /r /d y
   

3. Grant your account full control:

   icacls "D:\Path\To\Folder" /grant "%USERNAME%":F /t /c
   

4. /t walks subfolders; /c continues past individual errors.
5. Get the exact path by right-clicking the folder → Copy as path.
6. Expect some Access is denied lines on system-protected items — those are normal and safe to ignore.

Step 5: Remove Stale Accounts from the Permission List

An Unknown Account entry is a leftover from a machine or user that no longer exists.

1. Right-click the folder → Properties → Security → Advanced.
2. Select each Unknown Account (S-1-5-21-…) entry and click Remove.
3. Confirm your own account and Administrators are still listed with Full control before you close the dialog.
4. Click Apply → OK.
5. Removing every entry, including SYSTEM, leaves the folder inaccessible to Windows itself — always leave SYSTEM and Administrators in place.

Step 6: Reset Permissions on a Whole Drive Cleanly

Use this when an entire external or secondary drive is inaccessible.

1. In Terminal (Admin), reset inheritance across the drive:

   icacls "D:\" /reset /t /c
   

2. Then re-grant access:

   icacls "D:\" /grant "%USERNAME%":F /t /c
   

3. Replace D: with the correct letter — check in Windows + R → diskmgmt.msc first.
4. Never run this against C:\. Resetting permissions on the Windows drive breaks the installation, and repairing it means a reinstall.
5. Related: partition and format a hard drive.

Step 7: Check for Encryption Rather Than Permissions

An encrypted file looks like a permissions problem but is not one.

1. Right-click the file → Properties → Advanced. If Encrypt contents to secure data is ticked, it uses EFS and only the original account with its certificate can read it.
2. Green file names in Explorer indicate EFS encryption; blue indicates compression.
3. Without the original account or its exported certificate, the data is not recoverable — that is the point of encryption.
4. For whole-drive encryption, you need the recovery key: enable BitLocker drive encryption.

Step 8: Test with a New User Account

This separates a damaged profile from damaged file permissions.

1. Settings → Accounts → Other users → Add account → I don't have this person's sign-in information → Add a user without a Microsoft account.
2. Make it an administrator, sign in, and try to open the folder.
3. If it works there, your original profile is damaged — move your data to the new account.
4. If it fails there too, the file permissions are the problem; repeat Steps 2-4.

Step 9: Repair Windows and Rule Out Ransomware

1. In Terminal (Admin):

   sfc /scannow
   

   DISM /Online /Cleanup-Image /RestoreHealth
   

2. Reboot and re-run sfc /scannow: how to run SFC and DISM.
3. If files across many folders became inaccessible at once, and file names or extensions have changed, stop and treat it as ransomware — do not pay, and do not reformat before reading what to do if hit by ransomware.
4. Also check Windows Security → Virus & threat protection → Ransomware protection → Controlled folder access. If it is on, it blocks apps you have not allowed from writing to Documents and Pictures — add the app under Allow an app through Controlled folder access.

What Not to Do

• Don't run icacls C:\ /reset /t. It destroys the permission model Windows depends on and the PC will need reinstalling.
• Don't disable UAC to work around prompts. It removes a real security boundary and does not fix ownership.
• Don't grant Full control to "Everyone" on folders holding personal data — especially on a shared or network drive.
• Don't take ownership of C:\Windows or Program Files. Windows Update and system repair both depend on TrustedInstaller owning those.

Still Not Working?

If ownership and permissions are correct and access is still denied, check whether the file sits on a drive from another PC where BitLocker or EFS was used, and whether a security suite is enforcing its own protection layer. Pause the suite and retest.

For a drive whose data you need but cannot unlock, connect it to the original PC and copy the files from there — that is far more reliable than fighting the ACLs: transfer files from an old PC to a new PC.

Related: how to recover deleted files and organise and back up important documents.