NTFS Permission

Handian Sudianto 7,361 Reputation points
2026-06-23T13:33:28.3866667+00:00

I login to my server using my account and i create 2 folders name hs and hs2 but when i click that folder then why i not have permissions?

User's image

When I check using who am i and even my account is member of local admin then why the attributes is Group used for deny only?User's image

Windows for business | Windows Server | Devices and deployment | Other
0 comments

Answer accepted by question author

Harry Phan 27,085 Reputation points Independent Advisor
2026-06-23T14:25:32.8633333+00:00

Hi!

What you’re seeing is expected behavior caused by UAC token filtering, not a permissions corruption.

When you log on with an account that is a member of BUILTIN\Administrators, Windows does not give you a full admin token by default. It creates a filtered standard user token, and that’s why whoami /groups shows BUILTIN\Administrators as “Group used for deny only”. In that state, your admin rights are not active, so NTFS evaluates you like a normal user, which is why you get “You don’t currently have permission”.

The moment you click Continue, Explorer elevates and re-accesses the folder using the full administrator token, which matches what you’re observing.

If you want to validate this, run whoami /groups inside an elevated Command Prompt (Run as Administrator); you will see the Administrators group marked as enabled instead of deny-only.

If you need consistent access without prompts, you either run tools elevated or explicitly grant NTFS permissions to your user account (not relying on Administrators group), or disable UAC filtering via policy (Local Security Policy > Local Policies > Security Options > User Account Control: Run all administrators in Admin Approval Mode), though disabling UAC is not recommended on servers.

Harry.

Was this answer helpful?

1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-06-23T13:33:47.8866667+00:00

    The behavior is caused by User Account Control (UAC) and how Windows handles access to folders when the current token does not yet have explicit NTFS permissions.

    When a folder is created, its permissions are inherited from the parent folder. In this case, the parent folder’s ACL does not grant your current (non‑elevated) user token access, even though the account is a member of Administrators. With UAC enabled, membership in Administrators does not automatically give full access until elevation occurs.

    Therefore, when opening the folder in File Explorer, Windows shows:

    You don’t currently have permission to access this folder. Click Continue to permanently get access to this folder.

    If Continue is selected, UAC elevates the operation and a background process modifies the NTFS ACL on that folder (and its subfolders/files) to grant your user account access (in newer Windows versions, Full Control). This is by design and not an error.

    Regarding whoami /groups showing Group used for deny only for some groups: that flag indicates those groups can only be used for deny ACEs in the security token, not for allow ACEs. It does not prevent elevation via UAC or the ACL change described above; it simply reflects how the token is constructed under UAC.

    To avoid the prompt, either:

    • Take ownership and explicitly grant your user account permissions on the parent folder, or
    • Work in an elevated context (e.g., elevated command prompt or tools) when creating and managing folders where administrative access is required.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.