How permissions are handled when you copy and move files and folders

This article describes how Windows Explorer handles file and folder permissions in different situations.

Original product version: В Windows 10 — all editions, Windows Server 2012 R2
Original KB number: В 310316

Summary

In Microsoft Windows 2000, in Windows Server 2003, and in Windows XP, you have the option of using either the FAT32 file system or the NTFS file system. When you use NTFS, you can grant permissions to your folders and files to control access to those objects. When you copy or move a file or folder on an NTFS volume, how Windows Explorer handles the permissions on the object varies, depending on whether the object is copied or moved within the same NTFS volume or to a different volume.

More information

By default, an object inherits permissions from its parent object, either at the time of creation or when it is copied or moved to its parent folder. The only exception to this rule occurs when you move an object to a different folder on the same volume. In this case, the original permissions are retained.

Additionally, note the following rules:

The Everyone group is granted Allow Full Control permissions to the root of each NTFS drive.

Deny permissions always take precedence over Allow permissions.

Explicit permissions take precedence over inherited permissions.

If NTFS permissions conflict, for example, if group and user permissions are contradictory, the most liberal permissions take precedence.

Permissions are cumulative.

To preserve permissions when files and folders are copied or moved, use the Xcopy.exe utility with the /O or the /X switch.

The object’s original permissions will be added to inheritable permissions in the new location.

To add an object’s original permissions to inheritable permissions when you copy or move an object, use the Xcopy.exe utility with the -O and -X switches.

To preserve existing permissions without adding inheritable permissions from the parent folder, use the Robocopy.exe utility, which is available in the Windows 2000 Resource Kit.

You can modify how Windows Explorer handles permissions when objects are copied or moved to another NTFS volume. When you copy or move an object to another volume, the object inherits the permissions of its new folder. However, if you want to modify this behavior to preserve the original permissions, modify the registry as follows.

This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, see How to back up and restore the registry in Windows.

Click Start, click Run, type regedit in the Open box, and then press ENTER.

Locate and then click the registry key: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer .

On the Edit menu, click Add Value, and then add the following registry value:

• Value name: ForceCopyAclwithFile
• Data type: DWORD
• Value data: 1

Exit Registry Editor.

You can modify how Windows Explorer handles permissions when objects are moved in the same NTFS volume. As mentioned, when an object is moved within the same volume, the object preserves its permissions by default. However, if you want to modify this behavior so that the object inherits the permissions from the parent folder, modify the registry as follows:

Click Start, click Run, type regedit, and then press ENTER.

Locate and then click the registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer .

On the Edit menu, click Add Value, and then add the following registry value:

• Value name: MoveSecurityAttributes
• Data type: DWORD
• Value data: 0

Exit Registry Editor.

Make sure that the user account that is used to move the object has the Change Permissions permission set. If the permission is not set, grant the Change Permissions permission to the user account.

The MoveSecurityAttributes registry value only applies to Windows XP and to Windows Server 2003. The value does not affect Windows 2000.

File permission denied

I am having problems with file permissions for files I created. I recently built a Windows 7 machine with a RAID-1 array. One of the disks in the RAID failed, I replaced it and rebuilt the RAID-1 array. Then, on bootup, Windows 7 reported file errors and ran chkdsk — many errors corrected (maybe a few thousand). Now, when I attempt to access files I created, I get «do not have permission» error.

When I look at the file permissions, it apears that my user has «full contriol»

Replies (10) 

Step 1:You may try creating a new administrator account and check if you are able to access files using it.

If it works in a new user account then you need to fix the corrupt user profile. You may visit this link for the steps:
http://windows.microsoft.com/en-US/Windows7/Fix-a-corrupted-user-profile

Step 2: I would suggest you to manually apply permissions to a file or folder, follow the steps below.

Manually applying permissions is something that only advanced users should do because you might end up with unintended results.

a. Right-click the file or folder, and then click Properties .

b. Click the Security tab, and then click Edit .

c. To set permissions for a user that is not listed under Group or user names , click Add , type Everyone as the name of the user or group, click OK , select the permissions as Full control, and then click OK .

For further information, visit the below mentioned link:

Thanks and Regards
Umesh P — Microsoft Support.

Visit our Microsoft Answers Feedback Forum and let us know what you think.
[If this post helps to resolve your issue, please click the «Mark as Answer» or «Helpful» button at the top of this message. By marking a post as Answered, or Helpful you help others find the answer faster.]

Permission denied when trying to import a CSV file from PGAdmin

I’m using PGAdmin 1.14.3.

When I try to execute an import command:

ERROR: could not open file «C:\Users\denis\Desktop\BP2Project\USA\US.txt» for reading: Permission denied SQL state: 42501

I did look up other similar questions and none of them solved my issue.

I logged in as user «postgres» who is the superuser. I don’t see why I’m missing permissions. I’m on Windows 7.

8 Answers 8

The user Postgres must have read access on the file from which you are about to copy.

Look at this article to see how to modify files’ security access on Windows.

The permissions article mentioned in the answer by Houari and Flimzy is a good reference material, but a direct answer (the quick fix I used) is:

• Right click the folder containing the data file(s) that permission was denied to and then click Properties.
• In the Folder’s Properties window, select the Security tab.
• Click the Edit button.
• In the «Permissions for the folder» window that opened, click the Add. button.
• Type Everyone into the «Enter the object names to select» text area box.
• Click OK and the window will close.
• Verify that the default Read & Execute permissions were set to Allow via the check checkbox in the previous window.
• Click OK and the window will close.
• Click the Apply button in the Folder Properties window.

Now you can run the SQL COPY statement that needs to access those files.

• Once done, return to the Folder’s Properties window.
• Click the Edit button.
• Select the Everyone entry in the «Group or user names:» field.
• Click the Remove button.
• Click OK on the remaining open windows.

The permissions have now been returned to what they were.

Ok, this is how got COPY command working,to export a table to CSV, step by step. Pls note that I am using pgAdmin 111.

1. Create the target folder you want to export a table to. E.g C:\myExports
2. Set a read/write permission on this folder following the steps below :

Right click the folder containing the data file(s) that permission was denied >to and then click Properties.

In the Folder’s Properties window, select the Security tab. Click the Edit button.

In the «Permissions for the folder» window that opened, click the Add. button. Type Everyone into the «Enter the object names to select» text area box.

Click OK and the window will close. Verify that the default Read & Execute permissions were set to Allow via the >check checkbox in the previous window. Click OK and the window will close.

Click the Apply button in the Folder Properties window.

This is the tricky part, inside myExports folder create a blank CSV file with your desired name.E.g employee.csv

Then run the Copy command like this :

copy employee to ‘C:\myExports\employee.csv’ delimiter ‘,’ csv;

employee is the table name in this example..

Hope this helps.

If you don’t want to give permissions to Everyone, you can add permissions to the account that started the service. In the Control Panel — Administrative Tools — Services, copy the account name in the ‘Log On’ tab. (On my system the account is called ‘Network Service’.) Then share the folder with the CSV-file with this user as shown in the answer above.

To solve this problem you must give permission to the CSV file because that CSV file present in a COPY command are read directly by the server, but not client application. So to make this file accessible to a server we must give full read-write permission so that Postgresql user can read and write on that file.

Reference: article showing step by step procedure.

I just ran into this error and even after adding postgres to permissions on the file folder and the file itself, it still didn’t work. So, I put the file in a public folder. On Windows this was the path: «C:\Users\Public\Documents\census.csv.» It worked!

Responses to this problem on different threads go something like this 1. «Tell me exactly what command you used» 2. «Make sure you have right permissions» 3. «Just use /copy»

I just tried giving permissions to Everyone on the cvs file I am trying to copy from, and it is still giving me the permission denied error. I think this functionality is broken and has been broken for multiple consecutive releases over multiple consecutive versions of Windows.

for me and I’ve just spent some long hours on this. I have a central db residing on a HP box running 14.04 postgresql-9.5 pgAdmin3 postgis-2.2, shares are made through a tweeked Samba share. My clients are using a mixture of windows 10.1, 7, 8.1 and I have one ubuntu 14.04 desktop.

I’m working with large tables updating records and normalising data and have built the routines around SQL copy statements from CSV files which were made from the core COPY public.table_1 TO (the share folder I’d set up in Samba https://www.youtube.com/watch?v=ndAYZ0DJ-U4) ‘/srv/samba/share/[filename].csv’

I can then update the database once the tables have been amended with COPY table_1 from ‘/srv/samba/share/test.csv’ USING DELIMITERS ‘,’ WITH NULL AS » CSV HEADER; from any of my clients.

The key as far as I have been able to determine is that the clients doing the updating must be superusers, also everything must tie up in terms of users as there are 4 servers working together here Postgresql, Samba, UNIX and WINS All of my users are registered on each of the servers with the same username and password homogeneity is the main factor.

Permission denied on Windows 10 when writing to host volume #497

Comments

bhabermaas commented Feb 13, 2017

Expected behavior

It should work. It used to before updating to docker 1.13.0

Actual behavior

Fails with permission denied.

Information

A diagnostic was uploaded with id: A793F06A-2BB2-4848-AECB-269265A747E3/2017-02-13_17-36-24

• Diagnostic ID from «Diagnose & Feedback» in the menu.
• a reproducible case if this is a bug, Dockerfiles FTW
• page URL if this is a docs issue or the name of a man page
• host distribution and version (Windows version, build number, etc)

Steps to reproduce the behavior

The text was updated successfully, but these errors were encountered:

bhabermaas commented Feb 13, 2017

I have allowed all permissions on the mounted volume. If I use the CLI to run the container and mount the volume I can write if I chmod 777.
Using the Remote API, the volume has a bind rw, but unable to write and get permission denied.

rn commented Feb 13, 2017

Thanks for the report. Could you provide a concrete example for us to better understand the issue?
thanks

bhabermaas commented Feb 14, 2017

Very simple. This was working and now it isn’t.

PS C:\Users\bihaber> docker run —rm -it -u fmwpltfm -v //d/dockerOutput:/output:rw fmwtest:latest bash
fmwpltfm@ef5fab65723e:/$ cd /output
fmwpltfm@ef5fab65723e:/output$ ls -al
total 4
drwxr-xr-x 2 root root 60 Feb 14 13:20 .
drwxr-xr-x 1 root root 4096 Feb 14 13:27 ..
-rw-r—r— 1 root root 0 Feb 14 13:20 test
fmwpltfm@ef5fab65723e:/output$ touch test
touch: cannot touch ‘test’: Permission denied
fmwpltfm@ef5fab65723e:/output$

rn commented Feb 14, 2017 •

When you say it used to work, which version did you use before? stable or beta channel?
thanks

bhabermaas commented Feb 14, 2017

No problem on 1.12 stable. I upgraded to 1.13.0 and it worked. then I got a notice to update. hasn’t worked since.

rn commented Feb 14, 2017

I can’t reproduce this. I tried your command line above, but it can’t find the fmwtest image so I use standard ubuntu and use two different users already configured.

Could you provided the output of id when inside your container as user fmwpltfm ?

We did not change anything with regards to the mounting between 1.13.0 stable and the latest stable. I tried the above on the latest Beta, but again we dod not change anything related to the shared volumes there either

bhabermaas commented Feb 14, 2017

Must be a Windows 10 update that is causing it.

rn commented Feb 14, 2017

I’m not sure. I’ve tried on build 10586.672 and 14393.693 (latest RS1 update) and latest insider fast ring build 15031.0 and all three work

bhabermaas commented Feb 14, 2017

Seems to be tired to what userid I specify for the container. I have added that user to windows and given it all access to the disk. But I still get permission denied. Is there anyway that I can turn off permission checking for a mount?

rn commented Feb 14, 2017

The UID mapping is done by the samba client/server and is not easily changeable.

What is the output of id when you are inside the container?
What is are the permissions on the /output directory in the container?

bhabermaas commented Feb 14, 2017

If I run without the mount, the permissions look correct —

PS C:\Users\bihaber> docker run —rm -it fmwtest:latest bash
root@d74e5994d6b7:/# ls -al /test_output
total 8
drwxrwxrwx 1 fmwpltfm root 4096 Aug 23 08:53 .
drwxr-xr-x 1 root root 4096 Feb 14 14:34 ..
root@d74e5994d6b7:/# exit
exit

If I run it with the mount then the permissions are lost —

PS C:\Users\bihaber> docker run —rm -it -u fmwpltfm -v //d/dockerOutput:/test_output:rw fmwtest:latest bash
fmwpltfm@a3463248866f:/$ ls -al /test_output
total 4
drwxr-xr-x 2 root root 40 Feb 14 14:10 .
drwxr-xr-x 1 root root 4096 Feb 14 14:34 ..
fmwpltfm@a3463248866f:/$

rn commented Feb 14, 2017

because in the first case you are loooking at a local directory in the container and in the second case you are looking at the drectory mounted from the host. These are different directories with different permission settings

bhabermaas commented Feb 14, 2017

So how do I get the permissions to agree? On windows the dockerOutput directory has full access for user fmwpltfm (windows user).

bhabermaas commented Feb 14, 2017

rn commented Feb 14, 2017

This has little to do with the permissions on the host (ie windows). When you share the drive in Docker for Windows you provide a username/password in the dialog box. This is passed to the Linux VM which uses these credentials to SMB mount the drive. Inside the VM the directories are mounted with the default user and permission (root and 0755).

I’m not entirely sure why this works for me, but not for you. Again, could you provide the output of id when in the container. Also, another difference may be, is windows user fmwpltfm a local admin or not?

bhabermaas commented Feb 14, 2017

Below is the same output but with the user id from container. I have tried putting the windows user in all different groups but with no affect.
ALL I WANT TO DO IS HAVE MY PROGRAM RUNNING IN THE CONTAINER BE ABLE TO WRITE ITS OUTPUT TO THE DIRECTORY ON WINDOWS.

PS C:\Users\bihaber> docker run —rm -it -u fmwpltfm -v //d/dockerOutput:/test_output:rw fmwtest:latest bash
fmwpltfm@2631ad002435:/$ id
uid=735019(fmwpltfm) gid=1000(fmwpltfm) groups=1000(fmwpltfm)
fmwpltfm@2631ad002435:/$ ls -al /test_output
total 4
drwxr-xr-x 2 root root 40 Feb 14 14:10 .
drwxr-xr-x 1 root root 4096 Feb 14 15:12 ..
fmwpltfm@2631ad002435:/$

rn commented Feb 14, 2017

I understand what you want to do. No need to use all capital letters. It’s rude

bhabermaas commented Feb 14, 2017

Sorry I apologize.

bhabermaas commented Feb 14, 2017 •

I uninstalled Docker 1.13.1 and reinstalled Docker 1.12.3 — problem solved.
The moral of the story is: Do not update to a newer Docker if the one you have works.
Obviously Docker 1.13 stable isn’t as stable as it should be.

seydu commented Feb 23, 2017

@bhabermaas How did you downgrade to 1.12?
I am trying to do so but I cannot find that version of docker for Windows.

bhabermaas commented Feb 23, 2017

Fortunately I had the earlier download so I could install it after uninstalling 1.13. You should ask the Docker people where you can get earlier releases.

seydu commented Feb 23, 2017

xaljer commented Nov 2, 2017 •

I use Docker for windows 17.10.0-ce-win36 (13788) on Windows 1709, and I enable Linux containers on Windows (tech preview). When I do touch a.txt on the mounted host volume, I got touch: setting times of ‘a.txt’: Permission denied , and the same operation on other path in container is OK.

I found this because I got some similar errors, like: rsync: mkstemp «/workspace/test-read-speed/subsystems/linux/configs/device-tree/.zynq-7000.dtsi.qRGtxg» failed: Permission denied (13) and rsync: failed to set permissions on «/workspace/test-read-speed/.»: Permission denied (13) .

I changed permission of that path on Windows for all users, but it does not work.