Fix NTFS Security Copy Access Denied Error

This guide explains how to resolve the “Access is denied” error that appears when copying files or folders with NTFS security settings to a new destination. This typically happens when the destination lacks the necessary permissions or when the source has restrictive ACLs. You’ll learn how to take ownership, adjust permissions, and use built-in tools to complete the copy successfully.

What You’ll Need

• An administrator account on the Windows computer (or the ability to enter administrator credentials when prompted).
• Access to the source and destination folders (locally or over the network).
• If copying from a network share, ensure you have read permissions on the source and write permissions on the destination.

Step-by-Step

1. Identify the exact error. When you copy a folder, note whether the error appears for a specific subfolder or file. This helps target the fix.
2. Take ownership of the source folder. Right-click the source folder, select Properties, go to the Security tab, and click Advanced. Next to Owner, click Change. Enter your administrator username, click Check Names, then OK. Check the box Replace owner on subcontainers and objects and click OK. Confirm any prompts.
3. Grant yourself full control on the source. In the same Security tab, click Edit, then Add. Enter your username, click Check Names, then OK. In the permissions list, check Full control and click OK. Apply this to all subfolders by clicking Advanced, then check Replace all child object permission entries.
4. Check the destination folder permissions. Right-click the destination folder (e.g., the drive root or a subfolder), go to Properties > Security. Ensure your account has Modify or Full control. If not, click Edit, select your user, and check Modify or Full control. Apply and OK.
5. Use robocopy to copy with security. Open Command Prompt as administrator. Use the command:
   robocopy "C:\source" "D:\destination" /E /COPY:DAT /DCOPY:DAT /R:1 /W:1
   This copies all subdirectories and preserves data, attributes, and timestamps. If you need to preserve NTFS ACLs, add /COPY:DATS (adds security info).
6. If robocopy still fails, copy without security. If you only need the files and not the ACLs, use /COPY:DAT (without the S). This often bypasses the error because it doesn’t try to replicate restrictive permissions.
7. For network shares, use the appropriate method. If the source is on a network drive, map the drive and ensure you have read access. If the destination is a network share, ensure you have write access. You may need to run the copy as a user with permissions on both sides.
8. Disable inheritance on the destination (if needed). If the destination inherits restrictive permissions from a parent folder, right-click the destination, go to Security > Advanced, and click Disable inheritance. Choose Convert inherited permissions into explicit permissions, then add your account with full control.
9. Use a temporary local copy. If the source is on a network share and permissions are too restrictive, copy the data to a local drive first (where you have full control), then copy from local to the final destination. This often bypasses the network ACL issues.
10. After copying, verify the data. Check that all files and folders are present. If you used robocopy, review the log for any skipped files.

Common Mistakes

• Not taking ownership recursively. If you only change the owner on the top folder, subfolders may still have restricted ACLs. Always check the “Replace owner on subcontainers and objects” box.
• Forgetting to apply permission changes to child objects. Similar to ownership, you must replace permissions on all child objects, or some files will remain inaccessible.
• Using Windows Explorer to copy without admin rights. Even if you are an administrator, Explorer may not run with elevated privileges. Use an elevated Command Prompt or robocopy for a more reliable copy.
• Copying to a destination that inherits restrictive permissions. The destination may have inherited deny rules. Always check the effective permissions on the destination.
• Ignoring the difference between share permissions and NTFS permissions. On network shares, both need to allow access. Share permissions are set on the Sharing tab, NTFS on the Security tab.

Tips

• Use robocopy with a log file. Add /LOG:copy.log to the command to see exactly which files failed.
• Run robocopy with the /B flag. This uses backup mode, which can bypass some permission checks if you have the right privileges.
• If you don’t need the NTFS permissions, don’t copy them. Use /COPY:DAT instead of /COPY:DATS to avoid the error entirely.
• Consider using a tool like xcopy with /O if you need to copy ownership and ACLs, but robocopy is more robust.
• Before copying, disable antivirus real-time scanning temporarily. Some AV software can interfere with file operations, though this is less common.

Troubleshooting

If the error persists after following the steps:

• Check if the source files are encrypted. Encrypted files (EFS) cannot be copied to a different user without proper certificates. If you see an error about encryption, you may need to decrypt the files first.
• Look for read-only attributes. Right-click the source folder, go to Properties, and uncheck Read-only if it’s set. Apply to all subfolders.
• Try copying to a different destination. For example, copy to a USB drive or a different local folder. If that works, the issue is with the original destination’s permissions.
• Use the built-in “Takeown” command. Open Command Prompt as admin and run: takeown /f "C:\source" /r /d y. This takes ownership of all files and folders recursively.
• Use icacls to grant permissions. Run: icacls "C:\source" /grant "YourUsername":F /t. This grants full control recursively.
• If the source is on a network share, ask the administrator to grant you full control on the share and NTFS levels. You cannot override share permissions from the client side.
• Restart the computer. Sometimes a pending file operation or a locked file can cause the error. A restart clears many locks.

Frequently Asked Questions

Why do I get “Access is denied” even though I’m the administrator?

Administrator accounts don’t automatically have access to all files. The file’s ACL may explicitly deny access to everyone except the owner. You need to take ownership first, then grant yourself permissions.

Can I copy NTFS permissions without being the owner?

No. You must be the owner or have the “Change Permissions” special permission to modify ACLs. Taking ownership is the standard way to gain this ability.

What’s the difference between copying with /COPY:DAT and /COPY:DATS?

/COPY:DAT copies Data, Attributes, and Timestamps. Adding S also copies Security (ACLs). If you don’t need the ACLs, omit the S to avoid the error.

Does robocopy require admin rights?

Robocopy itself doesn’t require admin, but to copy security information or take ownership, you need elevated privileges. Run Command Prompt as administrator for best results.

Why does the error mention “destination directory” when I’m copying from a source?

The error usually occurs when the destination folder doesn’t allow you to create files or folders. The copy process needs write permissions on the destination, and if the destination inherits restrictive permissions, you’ll see this error.

Can I copy files to an external drive if the source is on a network share?

Yes, but you need read permissions on the network share and write permissions on the external drive. If the network share denies read to your account, you’ll still get an error.

Related

• Adjust Hidden Mac Preferences Onyx?
• Recover Deleted EMF Files: Full Guide
• Grand Blue NPC Locations: All Three Islands