Fix File Permissions Windows 10

[ConnectionProblem]

First of all been using your products for 3 years and they are great. Thank you for your support of a niche capability that I loved about WHS.

 

I recently reformatted installed Windows 10 and restored my pool, but my file permissions are a little messed up. Writing to folders of child folders that existed pre reinstall require User Access Control Confirmation and some programs pop an error saying I don't have access to write to them.

 

Thank you

[Christopher (Drashna)]

1. Right click on the drive. 
2. Open the "Security" tab. 
3. Click on the "Advanced" button at the bottom. 
4. Click on the "Change" link next to "Owner", and set the owner to "Administrators" and check the "Replace owner on subcontainers and objects" option.

5. In the Permissions tab below, add full privileges to "Administrators", and "SYSTEM" (and for ease here), and to "Users"

6. Check the "Replace all child object permission entries with inheritable permission entries from this object" option underneath.

7. Click "OK", and agree to all of the prompts that it shows. 

 

If the pool is large, or has a LOT of small files, this may take upwards of a few hours. 

After it is done, you can set the fine grain control (or set the 'Users" group to only have Read & Execute permissions instead. 

 

[ConnectionProblem]

Bingo, thank you sir.

[Christopher (Drashna)]

You're very welcome. 

 

And in case you're curious, want to learn a bit about NTFS permissions, or just like us being verbose: 

 

 

The specific issue is that user accounts are assigned a randomly generated "SID" (Security ID) upon creation. This SID is what is actually used in the NTFS security entries, rather than the user name. When you reinstall, the new account is going to have a new SID, even if you use the same name.   Meaning that the old account info is no longer valid. 

 

But you may notice that the built in accounts and groups (such as "SYSTEM" and "Administrator", or "Users" and "Administrators") are recognized just fine. These are "built in" and always use the same SID on EVERY installation of Windows (since before XP, even). 

So when assigning permissions, it may be best to use the built in groups whenever possible, as this will prevent issues when reinstalling. 

 

(Also, pinning and moving to the "Nuts & Bolts" section, since this is a FAQ)

[ConnectionProblem]

I don't think I was using any custom or granular users or groups. I'm pretty sure I changed the computer name. So I'm not sure if that lead to needing the fix.

[GreenApple]

Hello,

I followed the instructions from Drashna above and applied the settings to the Pool (Drive N: in my case).  The process did not complete and I received the two errors along with a warning afterwards that the recycle bin was corrupt and requesting that the contents be emptied.  Is there any advice or are there any additional steps I should take to apply permissions to the files in the pool?

 

I would like to attach some screen captures to this post but it was not working in Firefox.  Any tips on adding pictures to posts?

Thanks,

[Christopher (Drashna)]

I don't think I was using any custom or granular users or groups. I'm pretty sure I changed the computer name. So I'm not sure if that lead to needing the fix.

 

If you reinstalled the system, it may still happen.

 

Users and groups are identified by Security IDs (SIDs).  Built in accounts (user accounts such as Administrator, Guest, SYSTEM; and groups such as Administrators, Users, Authenticated Users) always have the same SIDs.  

However, even if you use the same username on the new install, the account is going to get a randomly generated SID. 

 

And these SIDs are what are stored on the disks for the NTFS permissions.  So if you used something other than the built in accounts/groups, as soon as you reinstalled, those "other" SIDs are no longer valid, and are not used. 

 

 

This is why you'd have to reset the permissions after a reinstall, in some cases. And why it's best to use the built in groups, whenever possible. 

 

 

However, if you were using the built in groups, make sure all of the disks are present in the UI (no missing disks), as the pool is marked as read only, if there are missing disks. 

 

 

 

Hello,

 

I followed the instructions from Drashna above and applied the settings to the Pool (Drive N: in my case).  The process did not complete and I received the two errors along with a warning afterwards that the recycle bin was corrupt and requesting that the contents be emptied.  Is there any advice or are there any additional steps I should take to apply permissions to the files in the pool?

 

I would like to attach some screen captures to this post but it was not working in Firefox.  Any tips on adding pictures to posts?

 

Thanks,

 

 

The Recycle Bin thing is normal. Windows expects a very specific set of permissions on the folder. If these are "out of whack", it flags it as such, and will try to reset it to what it expects. 

 

As for the other errors, if you don't have ownership of the files, this can happen, in some cases.  And in this case, the above instructions are basically the same. Find the "owner" tab or section on the "Advanced" window, and set it to "Administrators".  Once you've done that, reapply the permissions, and it should fix everything.

 

Otherwise, please do grab screenshots.  Also, use something like Imgur to upload them. They list a BBCode that you can post here, actually). 

[GreenApple]

Hello,

I've had ownership in the files in the past as an administrator and I believe the next step is to apply the same process to each folder.  It seems to fail at the DrivePool level.

I am sharing my screen captures at the following link using OneDrive.  Please review and let me know know if you have any additional advice.

Thanks

https://1drv.ms/f/s!AuLYefUiL9FiiRQ_njNtSq060NFF

[Christopher (Drashna)]

yeah, that's the "system volume information" folder.  Aka a nightmare...

 

 

If you see errors there, they are safe to ignore.  This is because Windows is overzealous about locking down this folder (there is a good reason, but still....). 

[defcon]

I've had this problem before after a Windows reinstall, its rather annoying and common. A faster (well not really, but less clicking around) way is to run following in an admin cmd prompt, at the root level of your data drives -

 

takeown /R /F *    (takes ownership)

ICACLS * /T /Q /C /RESET (resets all permissions to default and inherit)

 

Someone made a tool to this as well - http://lallouslab.net/2013/08/26/resetting-ntfs-files-permission-in-windows-graphical-utility/

[Christopher (Drashna)]

Windows includes a built in graphical method to take ownership of files/folders and reset the permissions, though ....

[jmone]

 

1. Right click on the drive. 
2. Open the "Security" tab. 
3. Click on the "Advanced" button at the bottom. 
4. Click on the "Change" link next to "Owner", and set the owner to "Administrators" and check the "Replace owner on subcontainers and objects" option.
5. In the Permissions tab below, add full privileges to "Administrators", and "SYSTEM" (and for ease here), and to "Users"
6. Check the "Replace all child object permission entries with inheritable permission entries from this object" option underneath.
7. Click "OK", and agree to all of the prompts that it shows. 

 

If the pool is large, or has a LOT of small files, this may take upwards of a few hours. 

After it is done, you can set the fine grain control (or set the 'Users" group to only have Read & Execute permissions instead. 

 

I'm trying to clean up my permissions but I'm getting an issue where Windows is Complaining I don't have enough Disk Space.  In Drive Pool, I'm using "Ordered File Placement" and had the Limit set to 99% Full / 1GB Free.  Looking at some of these drive in DP some have around 1GB free, but 3 are not reporting any Free Space stats at all.  I tried to change the Limit set to 98% / 2GB Free and did a re balance but nothing moved.

 

Any Suggestions?

 

Thanks

Nathan

[jmone]

So deleted some content from my pool (that made some space of my three full drives), and I could the update the ownership and permissions.  

 

I have the following now set (does this look OK)?

 

Owner

- Administrators

 

Permission Entries (all Inherited from "M:\")

- Administrators (Full Control)

- System (Full Control)

- Authenticated Users (Modify)

- Users (Read & Execute)

 

I then have selected sub directories set up as a network share

[Christopher (Drashna)]

Oh ... 1GB free... yeah, that's not good.  You want ~1% free or more, otherwise NTFS will freak out and not be able to modify files (which is exactly what you're seeing). 

 

As for the permissions, yeah, that looks fine. 

 

 

The only really important one is "SYSTEM", as this is used by our software, and many other system services. 

[jmone]

Thing was I had it set in DP to be 99% Full / 1GB Free and the drives filled up.... Like to 100%.  One had a only few KB free then after a balance had 0 (I ended up with 3 drives with 0 free).  Anyway, I've now set it to 98% / 2GB Free and the lowest is 1GB free (rest are 1.5 to - 2GB free).

[Christopher (Drashna)]

Honestly, I'd recommend more than this.  99% may be fine, but you want at least 10GB free. And I'd really recommend 50GBs free.   

 

As for filling past the 1GB, yeah, that can happen in many cases, as there may not be a good "fit", and the software attempts to fill it as best it can.  Sometimes, that means that it passes that limit set by the balancer. And if the balancing ratio is high enough, it will trigger a balancing pass.

 

that's also why I recommend 10GB or more. This way, the main balancing settings are more likely to trigger a pass if this limit is exceeded. 

[Bjur]

On 9/30/2016 at 2:38 PM, defcon said:

I've had this problem before after a Windows reinstall, its rather annoying and common. A faster (well not really, but less clicking around) way is to run following in an admin cmd prompt, at the root level of your data drives -

 

takeown /R /F *    (takes ownership)

ICACLS * /T /Q /C /RESET (resets all permissions to default and inherit)

 

Someone made a tool to this as well - http://lallouslab.net/2013/08/26/resetting-ntfs-files-permission-in-windows-graphical-utility/

Just want to say thanks for this post. I had trouble moving, deleting some folders in Stablebit and have tried the Windows GUI settings.

The two commands did the trick!

[Shane]

Since the existing Windows takeown and icacls utilities can have difficulties with unicode and long path support, I have created a new thread here. It describes the default NTFS permissions used by DrivePool and a guide to how I use a freeware utility call SetACL to fix broken pool permissions.