{"id":2337,"date":"2015-02-22T16:12:49","date_gmt":"2015-02-22T12:12:49","guid":{"rendered":"https:\/\/rakhesh.com\/?p=2337"},"modified":"2015-02-22T16:12:49","modified_gmt":"2015-02-22T12:12:49","slug":"beware-of-takeown-and-recursively-operating","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/windows\/beware-of-takeown-and-recursively-operating\/","title":{"rendered":"Beware of takeown and recursively operating"},"content":{"rendered":"

takeown<\/code> is an in-built Windows tool that lets you take ownership of files and folders. Unlike other tools (e.g. icacls<\/code>) which only let you give someone the right to take ownership of a file or folder, takeown<\/code> seems to actually let you become the owner. And not just yourself, you can run it under a different context and that user account can be made the owner.<\/p>\n

But it has a quirk which isn’t obvious until it turns around and bites you!<\/p>\n

Here’s what I am using takeown<\/code> for. I have a bunch of roaming profile folders that my admin account can’t view because only the user has full access to it. If I were using the GUI I would have opened the security tab of these folders, changed ownership to myself or the Administrators group, set that to propogate to all the child folders, and then add myself to the ACLs of this folder setting it to replace the ACLs of this folder and its children.<\/p>\n

I have a large number of such folders, however, and I want to create a batch file to do this easily.<\/p>\n

The obvious solution is to use takeown<\/code>.<\/p>\n

Y:\\>takeown \/A \/F profile.V2\r\n\r\nSUCCESS: The file (or folder): \"Y:\\profile.V2\" now owned by the administrators group.\r\n<\/pre>\n
But this only sets the ownership of the parent folder. Not a problem, there’s a switch \/R<\/code> which tells takeown<\/code> to recurse, so let’s try that:<\/p>\n
Y:\\>takeown \/A \/R \/F profile.V2\r\n\r\nSUCCESS: The file (or folder): \"Y:\\profile.V2\" now owned by the administrators group.\r\n\r\nYou do not have permissions to read the contents of directory \"Y:\\profile.V2\".\r\nDo you want to replace the directory permissions with permissions granting you\r\nfull control (\"Y\" for YES, \"N\" for NO or \"C\" to CANCEL)? y\r\nSUCCESS: The file (or folder): \"Y:\\profile.V2\\AppData\" now owned by the administrators grou\r\n\r\nSUCCESS: The file (or folder): \"Y:\\profile.V2\\Citrix\" now owned by the administrators group\r\n\r\n...\r\n<\/pre>\n
Note that harmless question: do you want to replace the directory permissions with ones granting us full control? Harmless, because that’s what you would do via the GUI too. Gaining ownership of a folder doesn’t give you any permissions. That’s a separate step, so it seems like the command is only being helpful and offering to do this for you (so it can peek inside the sub-folders and give you ownership there too). And there-in lies the quirk which turned around and bit me. If you answer YES to this question (or use a switch \/D Y<\/code> to answer YES by default) it replaces<\/span> the existing permissions with a new set. Yes, replace, not append as the GUI would have done. The net result of this is that once you run the takeown<\/code> command as above only the Administrators group has any permissions, even the user loses their rights!<\/p>\n
Y:\\>icacls profile.V2\r\nprofile.V2 BUILTIN\\Administrators:(OI)(IO)(F)\r\n             BUILTIN\\Administrators:(CI)(F)\r\n\r\nSuccessfully processed 1 files; Failed processing 0 files\r\n<\/pre>\n
That’s definitely not what we want!<\/p>\n
The right approach here seems to be to use a mix of takeown<\/code> and icacls<\/code>.<\/p>\n
First use takeown<\/code> to get ownership to the parent folder:<\/p>\n
Y:\\>takeown \/A \/F profile.v2\r\n\r\nSUCCESS: The file (or folder): \"Y:\\profile.v2\" now owned by the administrators group.<\/pre>\n
Then use icacls<\/code> to recursively grant Full Control to the parent folder and sub-folders. Note that this only appends to the ACLs, it doesn’t replace. (This takes a few minutes and there’s plenty of output).<\/p>\n
Y:\\>icacls profile.v2 \/grant BUILTIN\\Administrators:F \/T\r\nprocessed file: profile.v2\r\nprofile.v2\\AppData: Access is denied.\r\nSuccessfully processed 1 files; Failed processing 1 files<\/pre>\n
I don’t know why AppData<\/code> failed above. It did for all the profiles I tested with and I didn’t investigate further. Could be an icacls<\/code> limitation I suppose.<\/p>\n
At this point the roaming profile is owned by Administrators, and the ACLs have an entry for the Administrators group in addition to the existing ACEs.<\/p>\n
Now I run takeown<\/code> again, recursively, but this time I target only the sub-folders (i.e. not the parent folder, only the ones below it).<\/p>\n
Y:\\>takeown \/A \/F profile.v2\\* \/R \/D Y<\/pre>\n
takeown<\/code> doesn’t have limitions like icacls<\/code>. It’s ruthless! It will change ownership of all the sub-folders – including AppData<\/code> – and replace the ACEs granting Administrators full access.<\/p>\n
Y:\\>icacls profile.v2\\AppData\r\nprofile.v2\\AppData BUILTIN\\Administrators:(OI)(IO)(F)\r\n                BUILTIN\\Administrators:(CI)(F)\r\n\r\nSuccessfully processed 1 files; Failed processing 0 files\r\n\r\nY:\\>icacls profile.v2\\Searches\r\nprofile.v2\\Searches BUILTIN\\Administrators:(OI)(IO)(F)\r\n                 BUILTIN\\Administrators:(CI)(F)\r\n<\/pre>\n
Now I run icacls<\/code> on all the sub-folders, enabling inheritance on them. (This too takes a few minutes, but there’s no output except towards the end). The result of this step is that the botched ACEs set by takeown<\/code> are fixed by icacls<\/code> as it enables inheritance.<\/p>\n
Y:\\>icacls profile.v2\\* \/inheritance:e \/T\r\n\r\nY:\\>icacls profile.v2\\Searches\r\nprofile.v2\\Searches BUILTIN\\Administrators:(OI)(IO)(F)\r\n                 BUILTIN\\Administrators:(CI)(F)\r\n                 NT AUTHORITY\\SYSTEM:(I)(OI)(CI)(F)\r\n                 MYDOMAIN\\profile:(I)(OI)(CI)(F)\r\n\r\nSuccessfully processed 1 files; Failed processing 0 files\r\n\r\nY:\\>icacls profile.v2\\AppData\r\nprofile.v2\\AppData BUILTIN\\Administrators:(OI)(IO)(F)\r\n                BUILTIN\\Administrators:(CI)(F)\r\n                NT AUTHORITY\\SYSTEM:(I)(OI)(CI)(F)\r\n                MYDOMAIN\\profile:(I)(OI)(CI)(F)\r\n\r\nSuccessfully processed 1 files; Failed processing 0 files<\/pre>\n
And that’s it. That’s how to properly use takeown<\/code> and icacls<\/code> to take ownership and reset permissions on a folder and its children.<\/p>\n","protected":false},"excerpt":{"rendered":"
takeown is an in-built Windows tool that lets you take ownership of files and folders. Unlike other tools (e.g. icacls) which only let you give someone the right to take ownership of a file or folder, takeown seems to actually let you become the owner. And not just yourself, you can run it under a … Continue reading Beware of takeown and recursively operating<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[85],"tags":[117,414,413,469],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/2337"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=2337"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/2337\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=2337"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=2337"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=2337"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}