Access Denied using TakeOwn.exe

Question

I have got this file that I can't delete. It happened after a system crash, so the CHKDSK kicked in upon next reboot. After that, I can't delete the file. This is on Windows Home Server, and the file is one of those hidden Thumbs.db, and my Windows Home Server reports a "File conflict" on the file, the reason: "Access Denied"

What I have tried so far, running as an Administrator:
Delete: Access Denied
TakeOwn.exe : Access Denied
Attrib.exe -s -h : Access Denied
cacls.exe : Access Denied (even whe trying to display the current owner)
Rename: File not found (its hidden)
Re-boot in to safe mode and tried the above: Access Denied
Running the above commands as Local System: Access Denied

Tizer Unlocker: Fail (Doesn't find anything locking the file)
File Assasin: Crashes ("FindRemoteFileHandles returned NULL value.")

I have used the CHKDSK /f again, rebooted since some suggestions is that the file has been corrupted, but that didn't change anything.
Any suggestions ?

Update: In a totally different scenario, I experienced a similar situation; Access Denied when trying to take ownership of a file. It turned out that the file was owned by TrustedInstaller, which is not possible to override just by being an Administrator. In this case, one can use psexec /ids cmd to elevate yourself to System and then TakeOwn.exe /a

@Hugh. 1. Can't be determined. CACLS.EXE gets Access Denied when trying to display owner. 2. I can't get any higher in the hierarchy than Administrator. 3. Rename can't find the file, since its hidden. — Magnus, Apr 12 '10 at 19:14
Have you tried using Process Monitor to see what the low-level error is? http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx — Hugh Allen, Apr 14 '10 at 07:12
(in Process Monitor, so as not to be overwhelmed with a flood of info, add an Include filter for "Path contains Thumbs.db". An Include filter excludes everything else.) — Hugh Allen, Apr 14 '10 at 07:15
I have a similar problem with a acouple of files I need to delete. I tried CACLS, ICALCS, and TakeOwn all running as Administrator and then System using psexec. I also tried Unlocker. Nothing has worked. — Fred, Sep 10 '13 at 00:40
and when psexec then takeown ALSO results in an "access denied" ? How do I use process monitor to find this low level error? — frumbert, Jul 02 '15 at 06:26

vgru · Accepted Answer · 2022-08-02T00:34:59.453

23

[Update 2022] Please note that, as @Henke noticed in the comments below, apparently Unlocker is being flagged as unsafe by a bunch of antivirus engines. Not sure if it's the bundled adware or something more malicious, but perhaps it would be best to try the LockHunter tool that is recommended in this related thread.

So a big disclaimer, since most likely the steps outlined in the other thread will do the trick, please use at your own risk as a last resort only.

I had the same problem earlier today and fixed it using Unlocker. I don't know if it's any different from the tool that Nicu Zecheru recommmended, but I thought I'd share it here for future reference.

At first didn't believe that the folder could actually be locked, I restarted my PC several times since I first discovered that I am unable to access it, and none of these things worked:

chkdsk /f - scanned the disk but found nothing
takeown - access denied
fileacl /force - access denied
cacls.exe, xcacls.exe - no luck

Unlocker found that Windows Media Player was locking the file. If I remember correctly, I did have a video file in that folder, but I don't think I ever tried to open it using WMP. I copied the folder from a network location initially, and it's possible WMP might have accessed it during its background library crawling.

NOTE: it seems that older versions of Unlocker were bundled with adware (nothing nasty thought, some e-bay shortcuts from what I've seen). I simply unchecked these items during installation and everything was smooth.

edited Aug 02 '22 at 00:34

answered Jul 13 '10 at 07:40

vgru

1,146

Well, I'll be darned. This software reported no issues and no locking handle found. However, it had an option to delete/rename/move the folder anyway, which I did. And that ugly file went away... poof. Thanks. – Magnus Jul 17 '10 at 12:06
Same for me, it reported no locks, tried to delete it, could not, offered to schedule a delete on next system restart - and that did it. So I guess it was locked and owned by some system process. Of this is on Win10 by the way. – Alexander Abramov Jan 21 '17 at 17:50
9

That is crapware... Why dont use the better, standard and builtin resmon.exe?? Resource Monitor>CPU>Associate Handles>Search Handles> Write in the text field the name of the locked file or folder, and press, "Search". Voila. – Brethlosze Aug 29 '17 at 05:29
@hyprfrcb: seems like a better option indeed, so add this as an answer, it's better than posting it as a comment. Perhaps OP can even accept is as the correct answer since mine is rather outdated. – vgru Aug 29 '17 at 08:18
Just ran accross this with exactly the same symptoms, similar solution, although Unlocker didn't find the lock; Process Explorer did when using its search function. Apparently I deleted the folder (late in the evening), but left a terminal open with it's current path in the problematic folder. The folder was thus in limbo deleted state and windows wasn't having any of it. Until I closed the terminal > lock gone > folder disappears in explorer. – Gunther Struyf Jan 28 '21 at 08:01
1

Unlocker at virustotal.com : 30(!) security vendors [...] flagged this file as malicious !!! virustotal.com/gui/file/… ~ * ~ DON'T install malware in your computer!! – Henke - Нава́льный П с м Jul 30 '22 at 12:55
1

@Henke thanks, I had a disclaimer at the bottom about the adware that you had to exclude manually during install, but it's possible that newer versions are nastier so I'll include a warning – vgru Aug 01 '22 at 13:28
Tizer Unlocker (suggested by Nicu Zecheru) is already reported by the asker not to find anything. But you might want to mention LockHunter that I suggest in this post. ~ * ~ VirusTotal verdict of LockHunter version 3.4.3. – Henke - Нава́льный П с м Aug 01 '22 at 16:54

score 5 · Answer 2 · answered Apr 12 '10 at 22:45

I can't get any higher in the hierarchy than Administrator

Sure you can. The local System account has higher privileges than Administrator. To start a command prompt under the System account, issue the command

at (time) /interactive cmd.exe

Where (time) is the current time plus 1 minute. Alternatively, download Sysinternals' PSTools and use

psexec -i -s cmd.exe

The elevated command prompt will start in a different directory from usual, which for me is

C:\WINDOWS\system32>

@Hugh. Nope, sorry Local System didn't do anything. Question updated. — Magnus, Apr 14 '10 at 05:16

score 1 · Answer 3 · answered Apr 12 '10 at 16:53

You can try using Tizer Unlocker (freeware)

Here are some of the error messages that can be dealt with Tizer:

The file is in use by another program or user. Cannot delete file: It is being used by another person or program. Cannot delete folder: It is being used by another person or program. Cannot delete file: Access denied. The source or destination file may be in use. The process cannot access the file because it is being used by another process. There has been a sharing violation. Close any programs that might be using the file and try again. Make sure the disk is not full or write-protected and that the file is not currently in use. Error deleting file or folder. Cannot delete file or folder: The file name you specified is not valid or too long. Specify a different file name.

Thanks, but there is nothing locking the file. – Magnus Apr 12 '10 at 20:49 — Magnus, Apr 12 '10 at 20:49

score 1 · Answer 4 · answered May 10 '22 at 21:16

I cam across a similar situation where I had a file like this where every command would fail with some type of access denied message even when I should have had adequate rights to access it.

In my case, it turned out that it had actually had been deleted and there is a way on a Windows NTFS file system that it can go into a STATUS_DELETE_PENDING state that most tools will detect as "Access Denied" Stackoverflow - Why does Windows return Error Access Denied when I try to Open a Delete Pending File.

This situation is very frustrating and difficult to diagnose with existing tools (I had to use Sysinternals Procmon and scan through lines of logs), so I made my own tool to detect this condition as well as other file opening problems. Hopefully it will be useful for someone. Github - Detect-ghost-file

Exactly my case! I created a file on a Windows share, mounted on Linux, using ‘cat > myfile’ command. Later I tried to delete it on Linux, then repeated on Windows host – no luck (Access denied). I tried to check the file permissions and even get ownership, but there was the same answer. Finally I forced to disable the share and the file disappeared! The reason was a bit tricky: after ‘cat > myfile’ command I pressed ‘Ctrl-Z’ instead of ‘Ctrl-C’, so the ‘cat’ process was not terminated, but put in ‘Stopped’ (suspended) state, with still opened ‘myfile’, preventing it from being deleted. — Eugene K, Jul 22 '22 at 10:37

score -1 · Answer 5 · answered Apr 14 '10 at 06:16

A caution: If the file is in the Windows directory or somewhere sensible, be careful about deleting it.

First, try booting in Safe mode to delete the file.

Second, sometimes the file is locked by explorer.exe itself. To solve such a problem:

In Safe mode, launch a Command Prompt (cmd) as administrator
Navigate in cmd to the directory in question and enter (but do not execute) a "del" command for the file in question
Use Task Manager to kill explorer.exe
Quickly press Enter in the cmd window to delete the file, before Windows restarts explorer

Third, the free utilities MoveOnBoot or Unlocker can be used to schedule delete of the file at boot time.

Access Denied using TakeOwn.exe

5 Answers5

Linked

Related