Can't Access External HD To Change Security Permissions

I can't remember doing anything this stupid to my computers in a long time, but seriously need help now.

I was working with a 2TB external hard drive when I selected to change the security permission access and then realized that wasn't what I wanted to do, so stopped the process midway. A warning box popped up that the permissions were mixed on this external drive and that was it. I closed this box and thought I could get back and alter the permission settings for "everyone" but can't access the drive to change anything.

My OS is Windows 7 Ultimate and the External HD is a 2TB WD Book.

I then reboot the main HP computer to see if this would reset something only to find that the External Drive no longer shows up in Windows Explorer except under 'Network'. I can click on the drive there but can't access it to change anything - getting the same "Access Denied" error message.

After trying everything else I could think of I moved the external HD to another Windows 7 computer but it wouldn't show up there at all in Explorer so I moved it back to the system where this mistake was made.

It's been many years since I've done any DOS commands but did find one named SUBINACL.exe - but the instructions for this command only showed how to use it for an internal drive not an external drive, so this explanation confused me. Which may mean I need more specific instructions because DOS is now almost like a foreign language to me.

When trying to access this External Hard Drive I can get to the Properties box and it appears like I can alter permissions and add back an Admin profile, but when I go to close these boxes the access denied comes back and nothing is changed. All that shows up now is Everyone, and this only has Read Permission...nothing else is left.

I can't afford to pull out anymore of my hair , can anyone help me please?

Thanks in advance.

Instead of left-clicking on the external drive (on the original problem machine) and getting "Access Denied", have you tried right-clicking and going through the "change ownership" steps?

You can easily add "change ownership" to the context menu using this tutorial.

Then right-click on the drive in Explorer and see if you can get that external drive back under your control.

Hi, I was right clicking on the external drive in Windows Explorer each time, but just in case I missed something I will try again. Thanks for responding so quickly.

Hi DSPERBER,

I was so hopeful that registry key "Take Ownership" was going to help but alas, it did not. It is now in my right-click Menu but to no avail.

After installing the file you suggested I was able to do all the same things I'd tried before which includes going through the steps in the External HD Properties Box, but when I go to Apply the Changes (giving all permissions back) I get this same error message - Windows Cannot Access/...Drive...

Is this because I can only see the external drive under Network and not in My Computer like it used to be?

Are there any other ideas that might work?!?

Thanks for the suggestion.

I don't know if this adds anything to this problem, but here is the other error message I get after attempting to change pemissions - 'An error occurred while trying to modify share<drive name>. Access denied.'

*Heavy sigh...thanks for offering a solution.

dsperber said:

Instead of left-clicking on the external drive (on the original problem machine) and getting "Access Denied", have you tried right-clicking and going through the "change ownership" steps?

You can easily add "change ownership" to the context menu using this tutorial.

Then right-click on the drive in Explorer and see if you can get that external drive back under your control.

Can you not simply right-click on the drive and add "EVERYONE" with "FULL CONTROL" permission?

1. Right-click the file or folder or drive, and then click Properties.
2. Click the Security tab, and then click Edit.
3. To set permissions for a user that is not listed under Group or user names, click Add, type Everyone as the name of the user or group, click OK, select the permissions (full control), and then click OK.







I have done this for all of my drives, so that I can access any folder on any drive from either of my two machines on my home LAN, no matter whether I'm booted to Win7 or WinXP at either machine.

Setting up access for "Everyone" as a user, with "full access", eliminates any headaches.

If only it were that simple. I have tried what you suggested several times, going back to those same steps after trying something new (example: after adding TAKE CONTROL) and after going through those step when I try and save the changes (or "apply" them) I get this error - 'An error occurred while trying to modify share<drive name>. Access denied.'

Initially what showed up after I mistakenly stopped changing permission process midway was - only 1 user showing, which was Everyone with attribute Read-Only.
The Admin user had disappeared, as did my User name.

So I've tried adding one or more users back and granting them & 'Everybody' User all access, and I just can't apply or save any such changes.

As you suggested, this external HD was set so Everyone/Anyone could do anything so I could move the drive around to different computers without running into ownership an/or permission issues. So why on earth I elected to change these settings and then stop the process mid-way is anybody's guess. I must have had my head screwed on elswhere because it was all working fine before I did this, thinking to simply make the drive access a little more secure. As in - this was really really dumb.

Point being, the drive lost two users leaving only Everyone with Read-Only access. I guess because this was the lowest common denominator to what I was doing?!

Also, when I get in and try to see who has ownership of this drive, the user(s) in box below are grayed out. Messing around with it this way leads me to the same error message, which ends up not saving any changes.

Open to any more ideas that may exist out there.

I'm guessing that maybe the problem then lies with only 'Everyone' having only Read permision and there being no other User listed with anything else?

Sorry to be so long winded...

I realize this is frustrating, and that you have essentially irreplaceable data on that drive... which unfortunately has no secondary backup (e.g. to DAT tape as I have, for my invaluable data backups, along with external USB drive for everyday recovery convenience).

Here's yet another "recipe" for trying to acquire permissions and control over the drive, from another MS article:

Grant ownership and permission to the administrator and to the system

To assign permissions to the system:

1. Open Windows Explorer. To do this, click Start, click Programs, and then click Windows Explorer.
2. Expand My Computer.
3. Right-click the system drive (this is typically drive C), and then click Properties.
4. Click the Security tab, and then click Advanced to open the Access Control Settings for Local Disk dialog box.
5. Click the Owner tab, click to select the Replace Owner on Sub containers and Objects check box, and then click Apply.
   
   If you receive the following error message, click Continue: An error has occurred applying security information to %systemdrive%\Pagefile.sys
6. If you receive the following error message, click Yes: You do not have permission to read the contents of directory %systemdrive%\System Volume Information - Do you want to replace the directory permission - All permission will be replaced granting you Full Control
7. Click OK to close the dialog box.
8. Click Add.
9. Add the following users, and then grant them the Full Control NTFS permission:
   
   • Administrator
   • System
   • Creator Owner
   
   
10. After you have added these NTFS permissions, click Advanced, click to select the Reset permission on all child objects and enable propagation of inheritable permissions check box, and then click Apply.
11. If you receive the following error message, click Continue: An error has occurred applying security information to %systemdrive%\Pagefile.sys
12. After you have reset NTFS permissions, click OK.

Now I would modify this recipe in step 9 to also add EVERYONE.

Does this also fail, the same way your other attempts have failed?

Here's yet another suggested idea..

1. Right click on the drive on which the folder resides which you want to recover on the ntfs drive and go to properties.

2. Click on the tools tab>>Backup now ,a wizard will get started which you can customize to select the folder which you want to back up.

In case of windows either with windows xp or windows vista there are some default user groups which are on different levels according to the respective privileges.


One of these groups is the Power Users Group and all the administrator’s of the operating system are a part of the power users by default so any administrator of the operating system which is not able to access those ntfs protected data but can take the customized back up and then after restore the back to obtain the files on some other location or drive.

So by following the procedure above you will be able to create a backup file which you can restore as the files you want on any other drive. I think that the restore process may allow you to NOT RESTORE ACL PERMISSIONS to the new location.

I don't know if this will really work, and that "backup" will actually be able to read these folders which currently have permissions problems, but maybe yes!

Depending on how much space you have available on your external drive and/or internal drives, if you use Partition Wizard (standalone boot CD) to repartition your external hard drive you can create a second "target" partition on that drive. Then after the backup is complete restore it to the newly allocated second empty partition, opting to NOT restore ACL permissions.

I'm kind of just thinking out loud here, reading ideas from the web, and have never actually used them myself.

Yet one more idea from a "guru"...

I am sure that his reference to manipulating a specific folder (and sub-folders) can be extrapolated up, to apply to the drive itself.



I'm a command-line kinda guy, and thus I use the Windows Command Prompt.

The first step is to get one with Administrative privileges. Typically, that means you can right click on the icon and click on Run as administrator.

If the icon is in your Windows 7 Taskbar, right click on it, then right click on the Command Prompt in the popup many that appears to get the option:




Now you have a Windows Command Prompt with full administrative access.


"CD" to the location of the folder who's contents you want to access. In my example, case that's (keystrokes shown in blue):

Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>cd /d c:\dell

c:\dell>


There are two commands that are extremely useful in this scenario; often either one alone is sufficient, but both pretty much guarantee access:

c:\dell>takeown /F * /R

SUCCESS: The file (or folder): "c:\dell\drivers" now owned by user "NOTENXPS\LeoN".

...


The "takeown" command shown above takes ownership of the named folder, or in this case "/F *" means all files and folders in the current folder. Ownership is assigned to the account you are currently logged in as.

"/R" means to also recurse into any folders and keep assigning ownership to everything found in any and all subfolders. You'll see a long list of "SUCCESS" messages as ownership is reassigned.

"takeown /?" will display a full list of options.


The other approach is to use a more complicated program called "icacls". Icacls is a command line utility for managing access control lists - i.e. file access permissions. It has plethora of options that are fairly confusing.

Here's what I use:

c:\dell>icacls * /grant:r everyone:f /t
processed file: drivers
...

Successfully processed 66 files; Failed processing 0 files

Once again "*" means all the files and folders in the current folder, "/grant" means we're granting permissions, ":r" means we're replacing any existing permissions, "everyone" means that everyone gets the permission we're about to grant, ":f" indicates that we're granting full control, and finally "/t" means to perform the operation on all subfolders as well.

"icacls" without any arguments at all will print the lengthy list of things you can do with it.

ICacls should be used with caution. It's very easy to accidentally remove or assign permissions that boil down to no permission at all. If you do that to the wrong files or folders you could cause some serious problems.