How permissions are handled when you copy and move files and folders

This article describes how Windows Explorer handles file and folder permissions in different situations.

Original product version: В Windows 10 — all editions, Windows Server 2012 R2
Original KB number: В 310316

Summary

In Microsoft Windows 2000, in Windows Server 2003, and in Windows XP, you have the option of using either the FAT32 file system or the NTFS file system. When you use NTFS, you can grant permissions to your folders and files to control access to those objects. When you copy or move a file or folder on an NTFS volume, how Windows Explorer handles the permissions on the object varies, depending on whether the object is copied or moved within the same NTFS volume or to a different volume.

More information

By default, an object inherits permissions from its parent object, either at the time of creation or when it is copied or moved to its parent folder. The only exception to this rule occurs when you move an object to a different folder on the same volume. In this case, the original permissions are retained.

Additionally, note the following rules:

The Everyone group is granted Allow Full Control permissions to the root of each NTFS drive.

Deny permissions always take precedence over Allow permissions.

Explicit permissions take precedence over inherited permissions.

If NTFS permissions conflict, for example, if group and user permissions are contradictory, the most liberal permissions take precedence.

Permissions are cumulative.

To preserve permissions when files and folders are copied or moved, use the Xcopy.exe utility with the /O or the /X switch.

The object’s original permissions will be added to inheritable permissions in the new location.

To add an object’s original permissions to inheritable permissions when you copy or move an object, use the Xcopy.exe utility with the -O and -X switches.

To preserve existing permissions without adding inheritable permissions from the parent folder, use the Robocopy.exe utility, which is available in the Windows 2000 Resource Kit.

You can modify how Windows Explorer handles permissions when objects are copied or moved to another NTFS volume. When you copy or move an object to another volume, the object inherits the permissions of its new folder. However, if you want to modify this behavior to preserve the original permissions, modify the registry as follows.

This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, see How to back up and restore the registry in Windows.

Click Start, click Run, type regedit in the Open box, and then press ENTER.

Locate and then click the registry key: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer .

On the Edit menu, click Add Value, and then add the following registry value:

• Value name: ForceCopyAclwithFile
• Data type: DWORD
• Value data: 1

Exit Registry Editor.

You can modify how Windows Explorer handles permissions when objects are moved in the same NTFS volume. As mentioned, when an object is moved within the same volume, the object preserves its permissions by default. However, if you want to modify this behavior so that the object inherits the permissions from the parent folder, modify the registry as follows:

Click Start, click Run, type regedit, and then press ENTER.

Locate and then click the registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer .

On the Edit menu, click Add Value, and then add the following registry value:

• Value name: MoveSecurityAttributes
• Data type: DWORD
• Value data: 0

Exit Registry Editor.

Make sure that the user account that is used to move the object has the Change Permissions permission set. If the permission is not set, grant the Change Permissions permission to the user account.

The MoveSecurityAttributes registry value only applies to Windows XP and to Windows Server 2003. The value does not affect Windows 2000.

How to change File and Folder permissions in Windows 10

Every file and folder on Windows 10 has permission attributes. It gives your authority to edit, read, write, execute, and modify it. It is relatively easy to change file and folder permissions in Windows 10. However, it depends on the specific criteria. In this post, we will show how you can change file and folder permissions in Windows 10.

How to change File and Folder permissions

I was talking about individual criteria that you need to meet. Those criteria are user authority or power. If you are an admin user, you can almost change anything in Windows. It includes the ability to modify files that are owned by others. However, if you are standard users, you are limited to changing files that only belong to you. In this post, we will discuss the following:

1. Types of Users and Permissions
2. Change Files and Folders Permissions which you own
3. Manage permission when sharing a file or folder with other users
4. Change Files and Folders Permissions which you DON’T own.

While it looks complicated, it is relatively easy to manage permissions. What you need to be careful about is the type of permissions.

1] Type of users in Windows & Permissions

While its not necessary, I think its a good idea that you know about this. There are broadly two types of users— local user accounts and local system accounts.

• Local user accounts include Administrators, Standard users, Child, and Guest account.
• Windows OS manages local System accounts. Accounts with a name such as System, Network service, Local service are all system accounts.

An Administrator can also take over System accounts as well or at least modify the file permissions along with other local user accounts.

Another essential thing, but you should know this. Some of these permissions will not be available for files.

• Full Control
• Modify
• Read and Execute
• List folder contents
• Read
• Write
• Special Permissions

2] Change File and Folder Permissions which you own in Windows 10

This section applies to all kinds of users. As long as you are managing files and folders which you won, there is not much of a problem. But at times, users have experienced that they are not able to edit files that they own or are created by them. Follow the steps to fix those problems.

• Right-click on any folder or file and click on Properties.
• Switch to Security tab, and you should see two sections
  • Group or usernames that have an ownership right on that file
  • Permissions for the selected user
• If you have trouble editing the file or copying files into that folder, then you need to change the permission. Click on the Edit button.
• It will open another window where you can select a user, and add missing permissions by checking the box against the type of permission.
• Once you are done, click on ok, and then apply the changes.

When changing permission for yourself, it is best to check on the box against Full Control. It will keep you off from any trouble you were having with the file or folder.

How to apply the same permission to subfolders and files

It only makes sense to have full control of all the files and folders inside it. Doing it one by one is cumbersome, and thats where you need to use the Advanced button.

• First, make sure to choose the set of permissions or Full control for the top folder
• Then go back to the Security tab, click on the Advanced button.
• Then select the user, which is yourself, and check the box which says—Replace all child object permission entries with inheritable permission entries from this object.
• Click on Apply and then Ok button.

In simple words, whatever the permission, the object, i.e. User, which in this case is you, will be applied to all files, and subfolders.

3] Manage permission when sharing a file or folder with other users

There can be multiple scenarios here:

• The file can be shared, but it cannot be modified.
• Folders shared with multiple users, but they are not allowed to delete the file or add any file.
• Some users are allowed to modify files while others can have read-only access.

Open the permission window by clicking on the Edit button. Next, select the user for which you want to modify. If the user is not there, you can add a new user by clicking on the Add button. It will open a search window which you can use to find the user. Add when you find it.

Once the user is available, select it and then assign appropriate permission. Select what you want to allow, and what you want to deny. It is how you would assign for yourself, except that you are doing it for some other account.

4] Change Files and Folders Permissions which you DONT own

That is where ownership comes into the picture. If you do not own a folder or someone else has modified files in such a way, then you can change it. However, only an admin user can change it for you.

Follow our detailed guide to learn how to take ownership of files and folders which you don’t own.

It might be too much to grasp for once, but once you are through, there will be no confusion left. I hope you were able to understand it clearly.

PS: Attribute Changer lets you change file & folder attributes in Windows 10 easily.

Date: November 14, 2019 Tags: Files, User Account

Set the folder permissions for Everyone on Windows-7 (10, 8.1), how to?

The solution is simple to Set the folder permissions for Everyone on Windows 10, 8.1, 7, .. and MS Server 2016, 2019!

1.) . Set the folder permissions for Everyone! (Image 1 to 3)
2.) . File and Folder Permissions!

1.) Set the folder permissions for Everyone!

1. Please Start the MS-Explorer for example via [Windows-Logo]+[E] keyboard shortcut.

2, Browse to Folder and select via right mouse click!

3, In Context-Menu go to (select) Properties and select the Tab Security
(. see Image-1 Point 1 to 3)

(Image-1) Windows-7 — Set the folder permissions for Everyone on!

In order to secure a windows (7, 8.1, 10, ie 11) computer and its resources, you must consider the rights that users will have. You can safely a computer or multiple computers by imparting users or groups specific user rights. You can help secure an object, such as a file or folder, by assigning permissions to allow users or groups to perform specific actions on that object. (permission rights for users on windows)

(Image-2) Folder permissions for User on Windows-7!

The windows permissions for Folders include Full Control, Modify, Read & Execute, List Folder Contents, Read, and Write access. For information about these permissions, see File and Folder Permissions. Each of these permissions consists of a logical group of special permissions, which are listed and defined below. Not all of the special permissions will apply to all objects

Please click Find Now and select Everyone (. see Image-3 Arrow-1,2,3)! and «OK»

Deny all folders permission from all users/administrators via CMD/Batch in Windows 7/8/10

I need to deny all folder permissions for all users, include administrators and others groups via batch file.

I found two topics about this, but i can’t solve my problem

This command works icacls D:\Desktop\test /deny Administrator:(OI)(CI)(DE,DC) , but this command affects only special permissions:

But I need to deny all others permissions like image:

I need to deny all permissions to all all users (administrators, system, and others) via batch, so that nobody can access this folder, not even the system, or the creator of the folder.

2 Answers 2

I hope I have helped you, This will change the permissions to ALL deny. To undeny it simply do this code

I think you should learn more about NTFS permissions (technically, the Discretionary Access Control Lists (DACL)) before complaining the appearances of the GUI.

The Security tab in files’ Properties dialog box have limited control over what permissions you can allow, and what you can deny. You should also ideas about the purposes of the built-in user groups, because specifically, the groups that appear in the GUI are never the only groups your system has (it only shows users or groups that have permission entries applied on the files).

For now, I will assume that you want to deny access to Everyone.

First: simply clicking Deny on Full control on all the users on the list is not enough.

You need to Deny two groups for this: the Everyone group and the Anonymous Logon group. (Because «Everyone» no longer includes anonymous logon since Windows XP)

After everyone is denied, it might be a good idea to remove inherited permission entries as well, since they no longer apply and waste your system a little time processing those entries.

With the guide above, I think you can teach yourself to operate all these on the GUI. The result should look something like this:

If you still have no idea what to do, here is the command-line equivalent (using icacls command — you need Windows Vista SP1 or later because of /inheritance option):

If the names «Everyone» or «Anonymous Logon» don’t work for you.

(Yes, it’s the same thing, but with SIDs specified in place of user names.)

Here is one caveat though: The owner of the files can change permissions whenever they want. And the Administrators can change the owner of the files at least to themselves. These are special privileges granted by the system that you can’t deny, so with a bit of effort, all process of setting this DACL are reversible by Administrators.