Is it possible to discover the current owner of a folder?

Question

I am running the Windows 8 Enterprise x64. Here are the current security settings for a folder on an NTFS volume:

Advanced Security Settings

I have access neither to the folder contents, nor to its security settings nor its current owner. Because I am an administrator, I could take the ownership and give myself necessary permissions, but then information about the current owner would be lost.

Is there a way to discover the current owner without changing permissions, or at least to know who was the owner before I took the ownership?

Is there any difference with using `cmd` and entering `dir /Q foldername`? That should show you the owner (under normal considerations). — nerdwaller, Jul 19 '13 at 17:24
A somewhat similar question: http://superuser.com/questions/356295/how-do-i-give-administrators-access-to-a-folder-without-destroying-current-permi — Vladimir Reshetnikov, Jul 19 '13 at 19:38

score 1 · Answer 1 · answered Jul 19 '13 at 18:32

The Windows security model being as recondite as it is, it's entirely possible to find yourself without the permissions necessary either to find out which user owns an object, or to grant yourself the necessary permissions to find out which user owns that object. In such cases, your options are reduced to either a) wrap a runas ... dir /Q command in a loop that iterates over all known account names on the system (and type in each password in turn, assuming you know it), or b) just bite the bullet, take ownership, and possibly blow away whatever ACL exists on the object in the process.

score 1 · Answer 2 · answered Jul 24 '13 at 00:45

I was able to get the following to work on Windows 7. Naturally, YMMV. From an elevated (administrator) Command Prompt, do

icacls E:\Logs /grant nik:f

where f means full control. This seems to add an access control entry (ACE) giving you full control without changing anything else. Do that, then look at the properties again; and then, if you want, delete your ACE. If you want to be particularly careful about restoring the ACL to what it was before you tampered with it, try this:

icacls E:\Logs /save Z-acl
icacls E:\Logs /grant nik:f

(Go look at the directory.)

icacls E:\ /restore Z-acl

Note the weird syntax of the last command. Z-acl is just an arbitrary filename. Note: in my experience, it must be just a simple filename; I tried

icacls \mys\ter\y_f\ile /save \Users\scott\Documents\acl

and it didn’t work; apparently because I specified a path for the output file.

By the way, I had a problem getting dir /Q to work correctly. It often incorrectly said that the owner was SYSTEM. Windows Explorer (file properties) is more informative.

Is it possible to discover the current owner of a folder?

2 Answers2

Linked