How to Fix Access denied
Error message
Access is denied.
If you're seeing "Access denied", you're not alone. Here's what it means, why it happens, and the steps to resolve it.
What this error means
The action was understood but blocked because the security context running it does not have permission.
Why this happens
Most common: not running elevated, an NTFS/share ACL excludes the user, UAC token filtering, a Group Policy restriction, or (in cloud contexts) a missing Entra role.
Step-by-step fix
Re-run the action from an elevated PowerShell or Command Prompt (Run as administrator).
Check effective NTFS permissions on the target.
commandicacls "C:\path\to\target"If acting against a remote machine, confirm the user is in the local Administrators group there too.
Look in Event Viewer → Security for an Access Denied audit event with the failing user/SID.
Affected products
Windows Admin
Still broken? Try these
- Disable UAC token filtering only as a diagnostic — re-enable afterwards.
- Test the action as a different known-admin account to isolate the user vs. the resource.
- Check Group Policy → User Rights Assignment for restrictions that could apply.
Related errors
Frequently asked questions
What does "Access denied" mean?
The action was understood but blocked because the security context running it does not have permission.
What causes "Access denied"?
Most common: not running elevated, an NTFS/share ACL excludes the user, UAC token filtering, a Group Policy restriction, or (in cloud contexts) a missing Entra role.
How do I fix "Access denied"?
1. Re-run the action from an elevated PowerShell or Command Prompt (Run as administrator). 2. Check effective NTFS permissions on the target. 3. If acting against a remote machine, confirm the user is in the local Administrators group there too. 4. Look in Event Viewer → Security for an Access Denied audit event with the failing user/SID. Always test changes in a non-production environment first.
Browse more errors in Windows Admin: Fix Windows administration errors. Access denied, RPC server unavailable, trust relationship failures, Group Policy errors, and network path issues. Or paste your own error into the error decoder tool to find a match. You can also go back to the homepage to browse common errors by topic.