Section 5: Ownership

The Big Picture: Every Object Has an Owner

Besides the guest list, every file and folder has one more piece of security data: an owner. Think of a house. The guest list says who may enter. The owner is the person who holds the deed, and the deed holder can always change the guest list, even if they wrote themselves out of it.

  File: Budget.xlsx
  ┌────────────────────────────────┐
  │ Owner:  Harshil   ◄── the deed │
  │ ACL:    (guest list)           │
  │   Finance → Read               │
  │   Boss    → Modify             │
  └────────────────────────────────┘

5.1 File/Folder Owner Concept

What it is: The owner is a single SID (a user or a group, most often a user) saved in the file's security data. It is set at the moment the file is created.

Who becomes the owner?

• Normally, the user who creates the file or folder.
• If an administrator creates it, the owner is often the Administrators group instead of the person. (This depends on a policy setting; on a default Windows PC, items created in an elevated session may show Administrators as owner.)
• Files created by Windows setup or by the system can be owned by SYSTEM or TrustedInstaller.

Where to see the owner:

1. Right-click → Properties → Security → Advanced.
2. At the top you see Owner: with the name, and a Change link.

Or in PowerShell:

(Get-Acl "C:\Users\Public").Owner

What the owner can always do: The owner holds two implicit rights that are not listed in the ACL:

(Windows has a newer feature, a special entry called OWNER RIGHTS, that an administrator can add to remove these implicit rights. That is rare, so just remember the normal rule.)

What this means in practice: Being owner does not give you the right to read the file's contents. It gives you the right to change the guest list and write yourself in. So the owner can always fix their own mistake:

  Owner locks himself out → owner opens Properties → Security
        → Advanced → edits the ACL → adds himself back in  ✔

Why ownership matters for security: It stops a problem like this: "I made a file and set it up carefully. Now a clever user changes the ACL and takes it over." Only the owner (or someone with a special privilege) can change who is allowed in.

CREATOR OWNER. A special entry named CREATOR OWNER (Section 6) lets a folder say: "Whoever creates a file here gets these rights on it." Windows replaces the name with the real creator's SID when the file is made.

5.2 Taking Ownership

What it is: Taking ownership means making yourself the owner of an item you did not create. It is the way to recover files that nobody can open: for example, files from an old Windows install, or from a user account that no longer exists.

Who may take ownership?

• Anyone who has the Take ownership special permission on the item (Full control includes it).
• Any account that holds the Take ownership of files or other objects privilege (in short, SeTakeOwnershipPrivilege). By default, Administrators hold it. (A privilege is a system-wide right in your token, from Chapter 24. Unlike a permission, it is not tied to one file.)

You can only make yourself (or a group you are in) the owner. Windows will not let you give ownership to a random third user, except when you hold a special privilege for it.

The usual two steps:

  1. Take ownership      → you become owner (can't read yet, perhaps)
  2. Edit the ACL        → give yourself the permissions you want

Method 1: File Explorer.

1. Right-click the item → Properties → Security → Advanced.
2. Next to Owner, click Change.
3. Type your user name, click Check Names, then OK.
4. For a folder, tick Replace owner on subcontainers and objects if you want it to reach everything inside.
5. Click OK. Close and re-open Properties. Now you can add yourself to the ACL.

Method 2: Command line. Run these in an elevated prompt (Section 7), and only on your own test folder:

(The paths above are examples. Use your own test folder. Never run these on system folders; see Section 8.)

Windows tip: When an admin takes ownership of a file whose owner is gone, the old owner's rights vanish too. The file is not "stolen"; the ACL is the only thing that decides who can get in.

Recovery. If you lock yourself out of your own folder:

Warnings:

• Do not take ownership of system folders (C:\Windows, C:\Program Files, drive roots such as C:\). Doing so can break Windows protections and updates, and it is hard to undo (Section 8).
• Taking ownership of a whole drive with /r can touch thousands of files and take a long time.
• On a shared or work PC, taking ownership of someone else's files may break company rules. Ask first.

Summary