Permissions - Allow or Deny Access to Users and Groups in Windows 8

How to Allow or Deny Access Permissions to Users and Groups in Windows 8 and 8.1​

   Information

This will show you how to add, remove, allow, and deny users and groups access with basic and advanced permission settings of a file, folder, drive, or registry key in Windows 8.

   Note

When you set permissions of a folder or drive for a user or group, the newly created and current files and subfolders in the folder or drive will also inherit these permissions as well.

If the folder is set to "Allow" permissions for a user in another folder, then you will need to do one of the following for the user to have access to it.

​

Set the folder to be shared (step 9 at this link) by the other user.​

​

Create a shortcut of the folder, and move it into one the C:\Users\Public folder for the other user to access it from.​

​

If you are an administrator, create a shortcut of the folder and move it into one of the user's user folders (ex: Desktop) for them to access it from.​

​

Set permissions to "Allow" access for the parent folder (first folder in path) instead that includes the folder.​

​

​

   Warning

I would highly recommend that you create a restore point before making changes to a file, folder, drive, or registry key permission settings. This way if you make a mistake and lock (access denied) yourself out of the item, you will be able to do a system restore at boot and select the restore point to undo the mistake.

Be sure to not deny permissions to or remove your user account for the file, folder, drive, or registry key. Doing so could prevent you from having access to the item.

Be sure to not deny permissions to the Everyone group for the file, folder, drive, or registry key. This will also include your user account.

Be sure to not deny permissions to or remove TrustedInstaller, LOCAL SERVICE, RESTRICTED, SERVICE, or SYSTEM if listed. Doing so will prevent Windows 8 from having access, and will cause Windows 8 to not run properly afterwards.

CONTENTS:

• Option One: Change Access Permissions in an Elevated Command Prompt
• Option Two: Change Access Permissions in Security Properties
• Option Three: Change Access Permissions in Advanced Security Properties

OPTION ONE

Change Access Permissions in an Elevated Command Prompt

NOTE: You could also type icacls /? in the elevated command prompt for a complete list of availble switches and options that you could use with the icacls command.


1. If you have not already, you must be the owner of the file, folder, or drive, before you will be able to change access permissions for it.


2. Open an elevated command prompt, and do step 3 or 4 below depending on what object you would like to grant permissions of users amd groups for.


3. To Allow or Deny Permissions for a File in a Command Prompt

​

A) In the elevated command prompt, type the command below and press Enter.​

​

NOTE: Substitute full path of file with the full path of the file that you want to set permissons for within quotes. ​

Substitute user name or group with the name of the user account or group that you want to grant permission to within quotes. ​

Substitute switch with a switch letter in the table below for what permission you would like to set.​

​

​

​

​

[TABLE=class:-grid][TR][TD]
Switch
[/TD]
[TD]
Permission
[/TD][/TR]
[TR][TD]
N
[/TD]
[TD]
Deny all access
[/TD][/TR]
[TR][TD]
F
[/TD]
[TD]
Allow full access
[/TD][/TR]
[TR][TD]
RX
[/TD]
[TD]
Read and execute access
[/TD][/TR]
[TR][TD]
R
[/TD]
[TD]
Read only access
[/TD][/TR]
[TR][TD]
W
[/TD]
[TD]
Write only access
[/TD][/TR]
[TR][TD]
D
[/TD]
[TD]
Remove user or group for no access
[/TD][/TR][/TABLE]

​

​

​

icacls "full path of file" /grant "user name or group":switch​

​

​

​

B) Go to step 5.​

4. To Allow or Deny Permissions for a Folder or Drive in a Command Prompt
NOTE: This command will set permissions for the folder or drive, and all files and subfolders in the folder or drive.

​

A) In the elevated command prompt, type the command below and press Enter.​

​

NOTE: Substitute full path of folder or drive with the full path of the folder or drive that you want to set permissons for within quotes. ​

Substitute user name or group with the name of the user account or group that you want to grant permission to within quotes. ​

Substitute switch with a switch letter in the table for what permission you would like to set.​

​

​

​

icacls "full path of folder or drive" /grant "user name or group":switch /T​

​

​

​

B) Continue on to step 5.​

5. When finished, close the elevated command prompt.

OPTION TWO

Change Access Permissions in Security Properties

NOTE: This option only has basic permissions that can be set for the file, folder, drive, or registry key. For both basic and advanced permissions, see OPTION THREE below instead.


1. If you have not already, you must be the owner of the file, folder, drive, or registry key before you will be able to change access permissions for it.


2. Do step 3 or 4 below depending on what object you would like to take ownership of.


3. To Change Access Permissions of a File, Folder, or Drive in Properties

​

​

A) Right click on the file, folder, or drive that you want to grant a user or group permissions for, and click on Properties.​

​

​

B) Go to step 5.​

4. To Change Access Permissions of a Registry Key in Properties

​

A) In the left pane of Registry Editor (regedit), right click on the registry key that you want to grant a user or group permissions for, and click on Permissions. (see screenshot below)​

​

​

​

​

​

B) Continue on to step 5.​

​

5. In the Security tab, and click on the Edit button. (see screenshot below)






6. If prompted by UAC, then click on Yes.


7. Do step 8 or 9 below depending on if you need to add or remove a user or group. If you do not need to add or remove a user or group, then go to step 10 below.


8. To Add a User or Group to Set Access Permissions of this Object for

​

A) Click on the Add button. (see screenshot below)​

​

​

​

​

​

B) Click on the Advanced button. (see screenshot below)​

​

​

​

​

​

C) Click on the Find Now button. (see screenshot below)​

​

​

​

​

​

D) At the bottom under the Name column, select a user (username) or group that you would like to set permissions of this object for, and click on OK. (see screenshot below)​

​

​

​

​

​

E) Click on OK. (see screenshot below)​

​

​

​

​

​

​

F) Go to step 10, or go to step 9 if you would also like to also remove a user or group.​

9. To Remove a User or Group to have No Access Permissions for this Object
WARNING: This is if you do not want to have a user or group listed that does not currently have inherited permissions. Removing a user or group will also remove all access permissions for this object. See WARNING at the top of the tutorial.

​

​

A) Select the user or group that you want to remove, and click on Remove. (see screenshot below)​

​

​

​

​

​

​

B) Continue on to step 10.​

10. Select a user or group that you want to change the permissions for, then check the Allow or Deny boxes for the items that you want to allow or deny permissions for the selected user or group. (see screenshot below)
NOTE: Checking Deny will override a checked Allow. Checking Full Control will also check all items under it. See WARNING at the top of the tutorial.





11. When finished, click on OK. (see screenshot above)


12. If prompted, click on Yes. (see screenshot below)





13. Click on OK. (see screenshot below step 5)

OPTION THREE

Change Access Permissions in Advanced Security Properties

NOTE: This option has both basic and advanced permissions that can be set for the file, folder, drive, or registry key.



1. If you have not already, you must be the owner of the file, folder, drive, or registry key before you will be able to change access permissions for it.


2. Do step 3 or 4 below depending on what object you would like to take ownership of.


3. To Change Access Permissions of a File, Folder, or Drive in Properties

​

​

A) Right click on the file, folder, or drive that you want to grant a user or group permissions for, and click on Properties.​

​

​

B) Go to step 5.​

4. To Change Access Permissions of a Registry Key in Properties

​

A) In the left pane of Registry Editor (regedit), right click on the registry key that you want to grant a user or group permissions for, and click on Permissions. (see screenshot below)​

​

​

​

​

​

B) Continue on to step 5.​

​

5. In the Security tab, and click on the Advanced button. (see screenshot below)





6. If here, click on the Change permissions button. If prompted by UAC, then click on Yes. (see screenshot below)






7. Do step 8 or 9 below depending on if you need to add or remove a user or group. If you do not need to add or remove a user or group, then go to step 10 below.



8. To Add a User or Group to Set Access Permissions of this Object for

​

A) Click on the Add button. (see screenshot below)​

​

​

​

​

​

​

B) Repeat steps 8A to 8D in OPTION TWO above.​

​

​

C) Go to step 11.​

​

9. To Remove a User or Group to have No Access Permissions for this Object
WARNING: This is if you do not want to have a user or group listed that does not currently have inherited permissions. Removing a user or group will also remove all access permissions for this object. See WARNING at the top of the tutorial.

​

​

A) Select the user or group that you want to remove, and click on Remove. (see screenshot below)​

​

​

​

​

​

B) Continue on to step 10.​

10. Select a user or group that you want to change the permissions for, then click on the Edit button. (see screenshot below)
NOTE:If you have View instead of Edit, then that user or group has inherited permissions that should not be changed.





11. Select to set the Allow or Deny permission settings for this user or group. (see screenshot below)
WARNING: What you have checked in Deny will override what you have checked in Allow. See WARNING at the top of the tutorial.







12. If this is for a folder, drive, or registry key, then select what you want it to apply to. (see screenshots below)
NOTE: A file will not have this option.







13. Select if you would like to Show advanced permissions or to Show basic permissions. (see screenshots below)
NOTE: The available permission settings will vary depending on if this is a file, folder, drive, or registry key.













14. Check the boxes for the permissions that you would like to set in the Allow or Deny section, and click on OK when finished. (see screenshots below step 13)
WARNING: What you have checked in Deny will override what you have checked in Allow. See WARNING at the top of the tutorial.


15. Click on OK to apply. (see screenshot below step 8A or 9A)


16. If prompted, click on Yes. (see screenshot below)






17. Click on OK. (see screenshot below step 5)



That's it,
Shawn

Related Tutorials

---

• How to "Take Ownership" of a File, Folder, Drive, or Registry Key in Windows 8
• How to Add "Take Ownership" to the Context Menu in Windows 8
• How to "Share with" and "Stop Sharing" Files and Folders on a Network or Shared PC in Windows 8
• How to Change Homegroup Sharing Settings in Windows 8
• How to Add Advanced security to context menu in Windows 8 and Windows 10
• How to Add Reset Permissions to Context Menu in Windows
• Enable or Disable Inherited Permissions for Files and Folders in Windows

 

[anil]

DEAR BRINK,WHILE MANIPULATING WITH SECURITY OPTIONS IN PROPERTIES OF C DRIVE,I ACCIDENTALLY DENIED ACCESS FOR ALL OPTIONS IN AUTHENICATED USERS,NOW I AM GETTING ACCESS DENIED FOR ALL FILES THOSE ARE LINKED WITH C DRIVE AND EVEN I COULDN'T ABLE TO CHANGE THE PERMISSIONS ALSO,FOR THAT I'M GETTING A DIALOG BOX WITH A WARNING i.e COULD NOT ACCESS CONTROL EDITOR .SO PLEASE FIND SOME SOLUTION ABOUT THIS AND SEND THAT THREAD TO ME.PLEASE GET ME SOME SOLUTION ABOUT THIS.

 

[Brink]

Hello Anil, and welcome to Eight Forums.

You might see if doing a system restore using a restore point dated before this happened may be able to undo it.

 

[BigFatBoy]

PERMISSIONS - not child's play !

I browsed thru the Tutorial however my question about Permissions is not addressed.

Q. Is there a direct way (short of a re-install of W8), to re-set all Permissions on all Drivers, Folders, and Files, back to the "factory" defaults ??

My W8Prox64 PC is a standalone machine; not connected to a network other than the Internet.
My user Profile identifies me as the Local Account Administrator of the PC.
My user Profile is a member of the "Administrators Group".
The W8 "built-in" Administrator role is 'Disabled' on my PC. (Local Security Policy\Security Settings\Local Policies\Security Options\Accounts\Administrator Account Status = Disabled)

My UAC is set to the second notch from the top: "Notify me only when apps try to make changes to my computer" (Don't notify me when I make changes to Windows settings)

thank you

 

[Brink]

Hello BFB,

What issues are you having with permissions?

Usually trying to reset permissions will cause Windows to become unstable. You could do a system image recovery if you had created a system image dated before the permission issue to restore the system back to how it was when the system image was created.

 

[BigFatBoy]

My PC is and was working well, except for one recent issue of trying to install a driver for an older HP printer.
Prior to the issue with the printer driver, I *have changed some permissions and/or ownership on some files and even some folders, *but seemingly without any negative results. Even so, I have been changing permissions and ownership over time, so I can not tell you when I started this practice.

While trying to get the printer driver installed yesterday, I again resorted to changing some file permissions and file ownership, even though I have experienced no apparent ill effects because of it; except for the fact that I still can not install a driver for the printer. I have also been negligent in creating restore points when I start experimenting... another bad habit.

I have avoided teaching my self about Permissions because the entire issue appears to be complicated. I looked at a Windows help file on Access Permissions which appeared to be a subject that is quite involved....

So, I thought IF there was a simple way for me to go back to square 1 with Permissions on my operating system, I could then take some time to become educated, make whatever few changes I make carefully, and with backup or restore tools ready in case I made a mess... and maybe even get my driver installation to complete.

In answer to your question, my most recent system image was made as part of a regular backup strategy. When I create a system image, I generally allow the new image to replace any previous image on my 'back-up' hard drive.
thank you
bfb

 

[Brink]

Since you are not having any permission issues with being denied access to anything, I wouldn't worry about.

Otherwise, the only true and safe way to reset all permissions back to default is to reinstall Windows. A repair install should work for this without losing anything, but since you are not having any issues, it's not worth the trouble.

 

[aghasaam]

unable to restrict access to folder on windows 8 OS

Hi Guys,

im new to this forum (about 3 minutes actually) have a question regarding permissions on windows 8.

I have a folder on my D drive and have set the permissions so that only the Administrator account can have access to it. When i log in using my user account (i.e. user 1 - doesnt have permissions to that folder) and try to browse to open the folder, i get a permissions denied box pop asking for administrators password (as expected), i enter the admin password and i can then access the folder (also as expected).

i then close explorer and go back in (as user 1) and i can then open the folder without putting in the administrative password. I then check the permissions and see that my personal user account (user 1) has automatically been added with full control to that folders permissions.

can someone shine some light on this for me please?

any advise is appreciated.

 

[Brink]

Hello Aghasaam, and welcome to Eight Forums.

When you give your password to allow access, it adds that user. You can delete or deny the user in the folder's permissions to stop allowing access again though.

 

[lilyYH]

Brink,

Thank you for your help. I was led to this thread while trying to get rid of this onscreen keyboard, which was driving me nuts.

I was confused on this page of instructions--- I did "option 3",


and under #8, it tells you to repeat steps 8A to 8D in option two. (step B)


The first time, I did not see this, and I think I followed (step C) and went to step 11.


That seemed like enough to change the permissions. Do you need to do both? Are those letters (B, C) steps, or options?

Thanks,

 

[Brink]

Hello Lily,

Those steps are for if you wanted to add a user or group to be able to change the permissions of.

If you were able to change the permissions for the user or group that you wanted to, then you are fine.

 

[lilyYH]

Ok, well I was able to change the file name so I think all is well. Is it advisable to change the permissions back, or is it fine to just leave it like that?

I think the TipBand.dll.mui file I changed it to the group permissions for administrators, but the TabTap file I changed to both Administrators and myself (Lily) because I was confused.

Then I found the real files I was supposed to be changing and did the Administrators. Is one better than the other?

 

[Brink]

It's fine to leave the permissions set as is unless you just wanted to change them back.

In that tutorial, you would need to change the correct files for it work. Since you did. you're fine.