Items missing in "New"-menu when right-clicking in folders on ext HDD

Hello.

I just got a used Dell from my cousin, who installed Windows 7 on it for me, replacing my old Win XP notebook. I am going through the process of finding out how to use it, and working out the kinks of getting it to work with the way I like things to work.

One problem I noticed, was that when I try to right-click in a folder to make a new text file by using the "New"->"Text File" item in the context menu, most of the items are missing - including "Text File" - except for "Folder"!

This is the case on my external harddisk, as well as the new C:\ root drive of the harddisk which Windows is installed on. I can tell Windows doesn't want me to put files in the C:\ dir, but I am puzzled about my external drive. It works fine in all the other folders on the internal HDD in the computer.

I tried to search google for answer, but I couldn't find anyone discussing this issue, except for one thread on this site:
Right click context menu options

I tried to do what was mentioned in the thread, changing the owner of a folder on the external drive, but it didn't seem to make any difference. I have never understood the security settings in Windows, so maybe I am doing it wrong. Windows said "If you have just taken ownership of this object, you will need to close and reopen this object's properties before you can view and change permissions". I don't know what this means.

But anyway, it didn't work.

Does anyone know what the problem is? I use the "New textfile" pretty regularly, so I would not like to give up on it.

Thank you.

It’s not abnormal to have ‘Folder’ be the only option under ‘New’ in the context menu while viewing the root of a drive. When this happens it means that your user account does not have full write access over that location. All four of the write permissions are required for a populated New menu, specifically the permissions,

• Create files / write data
• Create folders / append data
• Write attributes
• Write extended attributes

Lacking any one of these rights will result in a New menu with only one option, ‘Folder’. If your user lacks the ‘Create folders / append data’ permission, a UAC shield will precede this label.


For a populated New menu, ensure that you have all write permissions to that location. The following commands grant the Users group write permissions to the C drive, non-propagating and the other propagating, respectively.

Code:

icacls C:\ /grant Users:(W)

Code:

icacls C:\ /grant Users:(OI)(CI)(W)

Thank you so much, Cyanna and Pyprohly!


The HDD in which the "new" menu only has the "folder" option is my E: drive. I see from your replies, that I have to use the icacls.exe command. When I type "icacls e:", this is the output it gives:

C:\Windows\system32>ICACLS e:
e: BUILTIN\Administrators:(OI)(CI)(F)
NT AUTHORITY\SYSTEM:(OI)(CI)(F)
CREATOR OWNER:(OI)(CI)(IO)(F)
BUILTIN\Users:(OI)(CI)(RX)
BUILTIN\Users:(CI)(AD)
BUILTIN\Users:(CI)(IO)(WD)
Everyone:(RX)

I have never been able to understand the security and permission settings of Windows, but on the surface it looks to me as if the settings are already in a way which should give the access I need, isn't it? I am logged in as an administrator.

By the way, why are the BUILTIN\Users account listed three times in the output?

Do you still think I should try the commands you suggested?


Thanks again.

Hunnicat said:

I have never been able to understand the security and permission settings of Windows
[...]
By the way, why are the BUILTIN\Users account listed three times in the output?

Because the propagation flags differ. You must understand NTFS permissions if this is to make any sense. There’s no other way to put this simply, so, the long answer...

A new Access Control Entry (ACE), aka ‘rule’, occurs when the type (allow or deny), trustee, or propagation flags differ, basically anything but the permissions themselves. In the case of those “BUILTIN\Users” groups you see, the propagation flags differ.

The propagation tokens are (OI), (CI), (IO), and (NP), for Object Inherit (files), Container Inherit (folders), Inherit Only (only apply these permissions to child items), and No Propagation inherit (only apply this rule only level deep).

The token (D) means that this is a deny entry, (I) means that this ACE is inherited. Any other token you see either represents a single permission or a set of permissions.

E.g., for the rule “BUILTIN\Users:(OI)(CI)(RX)”, it says to apply the permission ‘(RX)’ (read and execute) to this object (because ‘(IO)’ is absent), sub files and folders (‘(OI)’ and ‘(CI)’ are present).

Hunnicat said:

it looks to me as if the settings are already in a way which should give the access I need, isn't it? I am logged in as an administrator.

As from what I said earlier, you need all four write permissions to some folder for a populated ‘New’ menu. In the root location of E drive you only have one of the four: ‘(AD)’ (create folders / append data). Although the third Users rule has ’(WD)’ (Create files / write data) it does not apply to E: because the rule states to inherit only.

You might be looking at the first rule, “BUILTIN\Administrators:(OI)(CI)(F)”, and notice the (F) token meaning ‘Full Control’. It’s a common mistake for people to think to assume they have these rights, because they are in the Administrators group after all.

The catch is, this rule is only included in your rights when programs run with administrative rights. I.e., when you “Run as administrator”. Windows Explorer doesn’t with administrative rights so the “BUILTIN\Administrators” does not apply and you don’t get the Full Control.

Hunnicat said:

Do you still think I should try the commands you suggested?

Your computer is your oyster. Here, I’ll help describe what they do and you can answer this question for yourself.

Code:

icacls E:\ /grant Users:(W)

The token (W), standing for ‘write’, represents the four write permissions. Running this will create a fourth “BUILTIN\Users“ entry on E drive. As (OI) and (CI) are absent, this access rule applies to E: and only E:.

Code:

icacls E:\ /grant Users:(OI)(CI)(W)

This does the same as the above, but as you can see, (OI) and (CI) are included this time, meaning the rule would apply to E: and all sub files and folders. Because there already exists a Users entry with the same propagation flags on E:, when this command is run, the “BUILTIN\Users:(OI)(CI)(RX)” ACE would become “BUILTIN\Users:(OI)(CI)(RX)(W)”.

Pyprohly,

Thank you so much for your great explanation. I see I have to read up on this to even scratch the surface.

I tried the latter of the commands, and I am waiting for it to finish - I don't know if it is doing anything, or is just frozen. I regret not trying the first one first, to see if it did the trick, and then trying the second one. I didn't think.

Thank you.

Hunnicat said:

I tried the latter of the commands, and I am waiting for it to finish - I don't know if it is doing anything, or is just frozen.

Yes, as the second one propagates it might take time to complete on a large drive. Though you should notice the effects immediately.

There’s no real harm in stopping it if it takes too long.

Pyprohly said:

Hunnicat said:

I tried the latter of the commands, and I am waiting for it to finish - I don't know if it is doing anything, or is just frozen.

Yes, as the second one propagates it might take time to complete on a large drive. Though you should notice the effects immediately.

There’s no real harm in stopping it if it takes too long.

Oh, that's good to hear. I turned off the power, because I was having problems trying to write to a USB-stick, and the Windows froze.

I didn't see effects. I mean, ICACLS just showed a blinking cursor on the next line, after I entered the command. And when I tried saving a text file in the root dir of E:, notepad still said I didn't have permission to do that, and needed the administrator to give me permission or something.

Wait! Now I was just trying it again, with the non-propagating one, and here's what happened:

C:\Windows\system32>icacls e:\ /grant /User:(W)
Invalid parameter "/grant"

Oh, sorry. I see.

Now I tried:

C:\Windows\system32>icacls e:\ /grant User:(W)
User: No mapping between account names and security IDs was done.
Successfully processed 0 files; Failed processing 1 files

Jesus. My nerves are on the fritz. I am making silly mistakes. Sorry.