How to reset NTFS permissions with ICACLS

File and folder permissions are critical in Windows environments. A misconfigured ACL – whether caused by a botched migration, a faulty script, or an accidental manual change – can prevent software from running correctly, block users from accessing their data, or in the worst cases make parts of the operating system behave unexpectedly.

The built-in ICACLS command is the right tool to fix these situations quickly, directly from the command line, without touching the GUI. It works on all modern versions of Windows and Windows Server.

If you also manage storage limits on the same volumes, see our guide on configuring NTFS quotas for users.

Understanding the flags

Before running any command, it’s worth knowing what each flag does:

• /RESET: replaces the explicit ACL entries on the target with those inherited from the parent folder. It does not apply new permissions; it simply removes overrides and restores inheritance.
• /T: traverses all subfolders and files recursively.
• /C : continues processing even if access denied errors are encountered on individual files.
• /Q: suppresses success messages, keeping the output clean.

For the complete syntax reference, see the official ICACLS documentation on Microsoft Learn.

Use case 1: Reset a single folder (non-recursive)

When only one folder has broken permissions and its contents are unaffected, target it directly without /T:

icacls "C:\Path\To\Folder" /reset /C /Q

This resets only the ACL of the folder itself, leaving subfolders and files untouched.

Use case 2: Recursive reset

To reset permissions on a folder and everything inside it – including the folder itself – omit the wildcard and let /T handle the recursion:

icacls "C:\Path\To\Folder" /T /C /Q /reset

Use the wildcard variant (\*) only if you intentionally want to skip resetting the root folder’s own ACL.

Use case 3: Reset permissions and take ownership

Sometimes a broken ACL also locks out the current Administrator account, causing ICACLS to return Access is denied errors even when running elevated. In this case, take ownership of the tree first:

takeown /F "C:\Path\To\Folder" /R /D Y
icacls "C:\Path\To\Folder" /T /C /Q /reset

The /R flag makes takeownrecursive; /D Y auto-confirms the prompt on each item. After taking ownership, ICACLS will have the access it needs to rewrite the ACLs.

Common errors

“Access is denied” even as Administrator The account running the command is not the owner and has been explicitly denied access. Run the takeownsequence above before retrying ICACLS.

“No mapping between account names and security IDs” The ACL contains orphaned SIDs – references to deleted or domain-removed accounts. This is harmless: /RESET will clear them along with all other explicit entries.

Files become inaccessible after reset /RESET removes explicit permissions and restores inheritance. If the parent folder has no permissions configured correctly, the contents will inherit nothing and become unreachable. Before running a recursive reset, check the parent folder’s ACL with:

icacls "C:\Path\To\Folder"

Confirm that BUILTIN\Administrators andSYSTEM appear with (F) (Full Control) before proceeding.

A word of caution

Never run a recursive ICACLS reset against system directories such as C:\Windows or C:\Program Files. Resetting inherited permissions in those trees can break system components, services, or installed software. Always target specific user-data or application directories, and when in doubt, back up the existing ACLs first with:

icacls "C:\Path\To\Folder" /save acl_backup.txt /T

This saves the current ACL tree to a file that can be restored later with /restore if needed.

Note that /save stores relative paths. To restore, run the /restore command from the parent directory of the saved path:

icacls "C:\Path\To" /restore acl_backup.txt