Help: Vista won't let me write to my external hard drive

This is becoming a very common question as people move to Windows Vista. You have an external or extra hard drive formatted under Windows XP. In Windows XP you were running as a member of the Built-in Administrators Group, and you could write to it just fine. In Vista, you are also a member of the Built-in Administrators group, but now you can't write to it.

The reason is permissions, but the reason they become a problem is because of User Account Control (UAC). If you run whoami /all /FO list on Vista you get a printout of your token. It will have a few lines that look like this:

Group Name: BUILTIN\Administrators
Type:       Alias
SID:       
Attributes: Group used for deny only

You are a member of Administrators, but your security token does not actually have the Administrators group in it in the normal way. UAC marks that group as a "deny" which means it is never used to grant access, only to deny it. If you now look at the Access Control List (ACL i.e. the permissions) for the drive:
C:\Users\foo>icacls d:\
d:\ NT AUTHORITY\SYSTEM:(OI)(CI)(F)
    BUILTIN\Administrators:(OI)(CI)(F)
    BUILTIN\Users:(OI)(CI)(RX)


The parts causing you trouble are the last two lines. The second line grants Administrators full control. You are an administrator, but because you are running under a non-elevated token, you do not have Administrators in your token, so that membership doesn't help you. The second line grants users read. You are also a member of users. Thus, when running in admin approval mode under UAC, your total rights to this drive is read.

To fix this, you need to grant Users modify privileges to the drive. Really simple to do. Option one:

  1. Right-click the drive letter in Explorer and select properties
  2. Click the security tab
  3. Click "Edit." You will be asked to elevate. Remember, until you do you are still in admin approval mode and for all practical purposes you are not an admin
  4. Select "Users" and check the Modify box
  5. Click OK enough times to get back to where you were.

The other option is to do it from an elevated command line.

  1. Click the Window circle
  2. Click All Programs: Accessories
  3. Right-click on Command Prompt and select "Run as administrator"
  4. Elevate
  5. Run this command: icacls d:\ /grant BUILTIN\Users:(OI)(CI)(M)

Substitute whatever drive letter your external drive is mapped to for d:\. OI means "let objects (files) inherit this ACE". CI means "let containers (directories) inherit this ACE". M means "modify". An ACE is an Access Control List Entry, in other words, the entries in the ACL that grants or denies someone permission to the object.

Once you do this regular users will be able to read and write to the drive. As long as you have not broken inheritance somewhere along the directory hierarchy of the drive you will not need to modify any more ACLs on this whole drive.

 If you want an ACL that mirrors the default ACL in Windows Vista, that turns out to be a bit more complicated. I'll address that another time.

 BTW, I should mention that this is all going to be mentioned in the book.

Published 16 January 2007 09:22 AM by jesper
Filed under: ,

Comments

# tina said on 14 February, 2007 07:05 AM

That's just one of the many things that Vista won't let users do :) Don't throw your PC or curse Bill whenever Vista is giving you a migraine. Chances are is that it's only a driver problem. Just try installing the appropriate driver. If you don't know where to look for them, try this site --  http://www.radarsync.com/vista.

# Keith Hill said on 21 February, 2007 08:37 PM

How about a third option.  Add just *your* user account to the ACLs with modify permissions.  Opening the drive up to all Users with modify perms is a big hammer kind of solution.

# Jimmy Alderson said on 03 March, 2007 04:09 PM

This still doesnt solve my issue with a similar item.  I *AM* running as Administrator and do not need to elevate privileges at all.  I am copying images across the network from my old XP to my new Vista install.  However, image1.jpg might be allowed, whereas image2.jpg is not, and this is to my own Pictures folder.  I just dont get it, why one and not the other?

jimmy.alderson@gmail.com

# vampyrus said on 06 March, 2007 04:13 PM

I have the same problem by copying files across the network from XP computers.

blade_vampyrus@yahoo.com

# nathan said on 12 April, 2007 06:04 PM

I'm having a simliar issue...I am running as an administrator & I have full acces to the drive, but each folder/file is read & read/execute only...this all happened when I updated my laptop to Vista from XP...if I hook the external drive up to my desktop that is still running XP, everything is fine...I need to be able to update these files from the laptop though...HELP!

# jesper said on 12 April, 2007 06:40 PM

Nathan, more than likely the ACL on those files has Administrators as the only group with read/write permission. Go through the steps in the post and see if that doesn't solve your problem.

# Freaksken said on 04 June, 2008 06:07 PM

When i go through the steps in the post and come to the point i press ok (Click OK enough times to get back to where you were) i get an error that i can't change the permissions because i can't write to the drive.

# reluctant windows user said on 25 July, 2008 10:31 PM

I would just like to say that windows stinks.

# Dog said on 26 August, 2008 08:45 PM

Can Not perform either of your 2 methods. I have Vista Home Premium - therefore no security tab under folder properties (or file properties). No "elevate" option (don't know what or where that would be). Tried option #2 minus "elevate" and it crashed the command function.

I had complete access to my external drive for about 2 days, tonight I lost it without warning. I can read and copy. I can not delete or rename (the function is now missing from the right click menu). I can create a new folder, but not name it. Nowhere have I found an answer - just echos of the useless (to me) information I see here. The drive was used on an XP machine before this one and is using the format that was on it when I purchased it (FAT 32). I am considering copying the contents (about 350GB) onto my new drive and formatting the external with NTFS then sending it back. (boy will I be frustrated if this happens again after that) CAN  WE DO BETTER THAN THAT?

# Felix said on 08 September, 2008 05:41 AM

I agree to reluctant.

I have to use windows, so here is my access question:

I develop java programs that access the disk. they get an access denied error all the time. even tomcat, started from an administrator shell. it sucks.

# Stormy said on 12 September, 2008 02:21 AM

RE: Dog

I had the same issue.  We got around it by enabling sharing on the drive and giving my account full access.  After that I could rename and delete.  A crappy workaround, but better than having to move all the content and reformat the drive (which, as you noted, may or may not work)

# Dog said on 22 September, 2008 05:06 PM

I tried enabling sharing and giving my account full access. It worked for about a week and reverted back to its former status. I then looked on the internet again more intensively and found one that works:

1. Basically you create a folder on your local hard drive somewhere, eg. "c:\external_HDD1"

2. Then Right click my computer and select manage

3. Select disk management (under storage)

4. Right click your external drive and select "change drive letter and paths"

5. Click ADD

6. Browse to your folder your created in step one . i.e. c:\external_HDD1

7. click ok and you are done.

Then whenever you insert your external drive or usb drive into your pc, you will always be able to access it in the same place, c:\external_HDD1, regardless of what drive letter windows decides to assign to it.

Then, to have windows remember shares and permissions on the usb drive, simply go to c:\external_HDD1\folder_to_share and set it to be shared and whenever you plug the drive into the computer that folder will be shared on the network.

# Guy said on 27 September, 2008 08:50 AM

I have a similir Problem (but a bit diffrent)!

I have a USB Drive connected to my Network Router (which allows sharing it accros a network using Netbios) Any way, If I access the drive in XP and try to delete a folder that is not empty it works Fine!

but Vista is a differnt story! it pops a window "You need permition to perform this action" (with only try again or cancel).

If I delete every thing that in that folder I can delete it!

tried disabling/enabling UAC, No help!

(I cannot modify permitions on that drive...)

I'm feeling I'm lost with that Visat CR**P...

Please if someone can help???

Thanks!

# John said on 05 October, 2008 12:03 PM

I actually seem to have a more fundamental proble. I can map my external hard drive (formatted under XP) and see the first level of folders within it. However, I cannot actually open these folders. No error message comes up or anything, it just spends ages thinking about it, then explorer stops responding and I have to restart. This also happens when I try to have a look at the properties. Is this a similar problem to the others quoted on this page or am I really being a dumbass. By the way, its a wirelessly connected. A direct LAN connection does not seem to help

# Alex said on 11 October, 2008 11:36 AM

I tried going through the steps, but when I go to "apply" my new security settings, it says "access is denied" to all the files on my external hard drive.

I can open them but I can't copy to my laptop, which I need to do. Help would be great...!

# Constantine said on 18 October, 2008 03:14 AM

Any updates on this?  

I have an Unknown account on my list and the hard drive's owner is the Unknown Account so i completely have no privilege.  Both the Unknown Account and Creator has no privileges

Even in Safe Mode and in Administrator's account I cannot change the Security settings even though it clearly says that Administrator and Sytem has Full Control of the Ext HD.  It is connected to USB and it won't fix itself even if I turn it off, unplug it, or restart the computer.

HELP PLEASE!

# jesper said on 18 October, 2008 11:24 AM

Constantine, the unknown account you are seeing is from the old computer that you used to use this drive with. It is unknown because it does not exist on the new computer.

You should be able to follow the directions in the post to grant yourself access again. When you go to the Security tab it should ask you to grant yourself permission.

# Freddy said on 18 October, 2008 05:29 PM

Hi, I think i had a similar problem. This evening i suddenly couldn't delete files or folders from my external harddrive (even though i have been running Vista for many months now without any problems). I could creat new files, but not rename them. After searching on the internet i ended up here, but didn't try the trick posted here. Instead i opened up windows explorer. I did a right click on the drive which is my external hardrive and chose 'rename' to rename the drive. I didn't rename but just pressed ENTER. Then i got a popup (access denied) window telling me that i need administrator priviliges to change the name of the drive. I clicked on 'continue' and after that i was able to delete and rename files and folders on my drive again. Hope this works for you as well.

# Constantine said on 19 October, 2008 07:35 PM

I followed it but it still would not work because the whole drive is write protected, even in safe mode on admin, I could not change the security properties of it AT ALL.

CMD Step seemed to do something but it did not help me in accessing it.

When I plugged in my pocket usb drive, for some reason, I was able to access and modify my files again in the Big Ext HD.

So what I did is when I got the access, I deleted ALL of the Objects (Groups and User Names) in the list.  I then proceeded to just add my User Name, System, Administrator, and Administrators in the list.

I gave it all full access and I haven't had a problem since.

It seems that because the non-existent user name (the one with random numbers) had ownership of the drive, and CREATOR OWNER and the non-existent user name had no rights or roles whatsoever in the security list.  It did not allow me to access the files at all even though I was logged in as ADMIN and in Safe Mode and Admin had complete rights to the drive but NO ownership.  I have no idea why it was contradicting itself and why these were the settings on the drive as I have never touched it.

So if you ever access again to the HD, I suggest doing this first for the HD Security before it Magically goes away again.  I hope it works for everyone.

I was 2 minutes away from reformatting 500GB of files because it was pissing me off, good thing I decided to plug my little HD in and saved my day.  =)

Good Luck to whoever has this problem.  I don't think MS has ANY clue that this problem is happening to people.  I certainly do think that this is an OS issue.

# Jeremy Gagliardi said on 03 November, 2008 01:07 PM

Windows Vista Home Premium

When a file is created by a user with no modify permission for others and that user is then deleted, how can another user take ownership to modify or just delete the file?

In Vista (at least in the Home Premium copy that I have), you cannot rely on Explorer to just know

what to do, you cannot rely on the fact that your present user account is a member of the infamous

Administrators group, and you cannot even rely on executing Windows Explorer with "Run as

administrator" privileges.

The problem is most likely that the Administrators (or any other) group was not granted any rights to

the file, or at least was not granted the modify right, and Windows blissfully goes about its

business denying anyone but the owner the ability to modify the file.  Unfortunately, you already

deleted that user account, and you can't get it back.

Solution?

- Start -> All Programs -> Accessories -> Windows Explorer

- Right-click on the file.

- Click on the "Security" tab.

- In the "Group or user names" box, observe the following:

 - Your user account is not listed or does not have modify rights.

 - The Administrators group and other groups that you are a member of are not listed or do not have

modify rights.

 - You see "Account unknown(x-x-x-xx-xxxxxxxxxx-xxxxxxxxx-xxxxxxxxx-xxxx)"

   ...where the "x"s are the former account's user id code, which is no longer valid.

- Click the "Advanced" button.

- Click the "Owner" tab.

- Under "Current owner" you should see "Account unknown(x-x-x-xx-xxxxxxxxxx-xxxxxxxxx-xxxxxxxxx-

xxxx)".

- Under "Change owner to" you should see (at least):

   Administrators (<HOSTNAME>\Administrators)

   <USERNAME> (<HOSTNAME>\<USERNAME>)

 ...where <HOSTNAME> is the Host Name of the PC and <USERNAME> is your user account name.

- Click the "Edit" button.

- Highlight the "<USERNAME> (<HOSTNAME>\<USERNAME>)" entry.

- Click the "OK" button.

- You should see a dialog box popup that reads as follows:

   If you have just taken ownership of this object, you will need to close

   and reopen this object's properties before you can view or change

   permissions.

- Click its "OK" button.

- Click "OK".

- Click "OK".

You now have ownership of the file.

However, if you go back into the "Security" tab, you still won't see your account listed in the

"Group or user names" box.  If you want to change additional permissions, you can do the following:

- Right-click on the file.

- Click on the "Security" tab.

- Click the "Edit" button.

- Click the "Add" button.

- Enter your user name and press <Enter>.

- Highlight your user name in the list.

- In the "Permissions for <USERNAME>" box, click on the Allow or Deny boxes as needed.

- Click "OK".

- Click "OK".

# Annoyed said on 08 November, 2008 10:12 AM

My Vista wont allow me too edit my security as i have done option 1 but clicking ok says that it cant change the security on anything  it says it has failed to apply security modify to anything!!! so it does absoulutely nothing! help

# kipkemboi llele said on 12 November, 2008 03:08 AM

I need to disable the UAC user priviledges assigne to Guest, that has disappeared from the screen. I think I may have deleted it by mistake, someone help. I can not even reinstall vista though I have the restoration disks, the thing denies access

# cuartzFSU said on 14 November, 2008 01:50 PM

I just build my new PC on 11/12/08 and my external drive started having the same issue. It was set to read only. I had disabled UAC since I find it extremely annoying and it interferes with RealVNC. I found this site and hoped it would solve my problems. While the instructions didn't directly solve my problems they did get me one step closer.

What I found out was after enabling UAC and restarting I opened up command prompt using "Run as Administrator" and entered in the line from method to, replacing "d:\" with the proper drive letter of my external. The command ultimately said "failed" but I figured, continue on anyways. Next, I unplugged the power cord from my WD external drive for about 10-15 seconds and then plugged it back in. Magically, i was able to modify files and allw as well.. until i had to unplug everything to install a new component in my pc.

The next day, same issue. Tried the exact same method again and after plugging in the power cord to my external it DIDN'T help at all. I managed to get it working but I ended up unplugging the power cord once more, restarting, then plugging the cord back in and it worked again. The question is, for how long? I added my username to the permissions and granted full control (the only other entry was "everyone"). I'm going to monitor everything for the next few days and see how things progress.

If anyone is stuck, try unplugging the power in the same manner I did, it may just work (temporarily).

# manuel m said on 01 December, 2008 11:56 PM

it says that "a problem caused the proram to stop working correctly. Windows will close the program and notify you if a solution is available".

when i try to command prompt

icacls f:\ /grant BUILTIN\Users:(OI)(CI)(M)

WHAT IS THE ISSUE?????

thanks

# Richard said on 14 December, 2008 02:11 AM

You are a champion - this has allowed me to regain control of a 931GB file that I was unable to access after reinstalling Vista x64 (had 2008 Server x64 before that).

I was really stumped - I have several such files each on a drive and all but this one worked fine after rolling back to Vista. After following your steps above about altrering user access it now works fine.

Thanks!

Leave a Comment

(required) 
(required) 
(optional)
(required)