Member Avatar for Nguyenthaonhi

Yesterday I followed a thread trying to learn to lock file folders using the cacls in the command window. I thought I'd use the temp file folder as my target, thinking that it was the most innocent folder I had. I was able to lock it, but now I can't unlock it.

Here is the code that I used to lock it:
cacls %temp% /G %username%:R

it asked me: Are you sure <Y/N> I replied Y, and it returned "processed dir: C:\DPCUME~1\HASLAM~4.AFT\LOCALS~1\Temp

I could confirm that I was unable to save anything to the temp folder. So I then wanted to unlock the folder. I used the following code:

cacls %temp% /E /T /C /G %username%:F .nul

It returns : Access is denied.

  • 2 Contributors
  • 1 Reply
  • 409 Views
  • 4 Hours Discussion Span
  • Latest Post Latest Post by Reverend Jim

Dani AI

Generated

Short summary and cause (context from and ): the Temp folder’s ACLs were overwritten with a restrictive entry, so the account lost write permission. That behavior is exactly what happens when the older cacls-style operation replaces ACL entries instead of editing them; modern Windows uses icacls as the supported tool. (learn.microsoft.com)

Recovery workflow (run from an elevated Administrator command prompt). First reclaim ownership, then restore inherited/default ACLs, then (only if needed) grant the user full control for the folder tree:

takeown /F "%TEMP%" /R /D Y

icacls "%TEMP%" /reset /T /C

icacls "%TEMP%" /grant "%USERNAME%:(OI)(CI)F" /T

The first command makes an admin the owner so permissions can be changed. The second replaces explicit ACLs with the folder’s inherited defaults. The third (optional) explicitly grants the current user full control across existing files and subfolders. See Microsoft documentation for TAKEOWN and ICACLS. (learn.microsoft.com)

Alternate GUI approach: open File Explorer, right‑click the Temp folder (usually under %USERPROFILE%\AppData\Local), Properties → Security → Advanced → Change Owner (select an admin) and check “Replace owner on subcontainers and objects”; then enable inheritance or click “Restore defaults” / re-add the user with Full Control. If permission repairs repeatedly fail, a System Restore to a point before the change or a short repair using an admin account can be safer than blindly granting Everyone:Full.

Notes and cautions: running these commands requires an elevated prompt and care — granting Everyone full control is a security risk. Test after each step and avoid modifying system folders other than the user Temp. (learn.microsoft.com)

Member Avatar for Reverend Jim

In an admin shell type

cacls %temp% /G everyone:f

/G replaces existing ACLs whereas /E edits (modifies) existing ACLs

Edited by Reverend Jim
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.