Access is Denied in CMD? 11 Proven Fixes for Windows 10 & 11

You type a simple command like del or mkdir, and instead of executing, the screen flashes back with the cryptic message: Access is denied. No explanation. No hint about what went wrong. Just three words that stop your workflow dead in its tracks.

I've been there more times than I care to count—whether it's a batch script failing halfway through, a net user command refusing to cooperate, or trying to delete a stubborn file that Windows has decided you're not allowed to touch. The frustration is real.

But here's the thing: this error isn't a dead-end. It's a security feature doing its job, often triggered by insufficient permissions, file ownership issues, or system policies. The good news? Every single cause has a fix.

This guide walks you through 11 proven solutions, from the basic "run as administrator" trick to advanced icacls and takeown commands. Whether you're on Windows 10 or Windows 11, you'll find the right fix for your specific situation. Let's dig in.

---

Why Does 'Access is Denied' Appear in Command Prompt?

Before we start throwing commands at the problem, it helps to understand what's actually happening under the hood. The "Access is denied" error in CMD isn't random—it's Windows telling you that your current security context doesn't have the necessary rights to perform the operation.

Understanding User Account Control (UAC) and Elevated Command Prompt

Think of User Account Control (UAC) as a bouncer at a nightclub. When you open a standard Command Prompt, you're getting the "general admission" wristband. You can look around, run basic commands, but you can't go backstage. An elevated command prompt—one run as administrator—gives you the "all-access pass."

Here's a simple way to visualize it:

Standard Command Prompt (Limited)          Elevated Command Prompt (Admin)
─────────────────────────────────          ─────────────────────────────────
✓ dir, cd, echo                            ✓ Everything on the left
✓ Copy files within your user folder       ✓ net user /add
✓ Run basic scripts                        ✓ ipconfig /flushdns
✗ Modify system files                      ✓ sc config (change services)
✗ Change network settings                  ✓ Regedit modifications
✗ Access other users' folders              ✓ Takeown / icacls commands

Many commands—like net user, ipconfig /flushdns, or sc config—require elevation because they modify system-level settings. If you're running them in a standard prompt, Windows will shut you down with "Access is denied."

Common Causes: File Ownership, Permissions, and System Policies

Over the years, I've narrowed down the culprits behind this error to four main categories:

1. Lack of 'Full Control' NTFS permissions – The file or folder's Access Control List (ACL) doesn't grant your user account the necessary rights. This is the most common cause, especially after Windows upgrades or migrations.

2. File or folder owned by another account – If the file is owned by SYSTEM, another user, or an old account from a previous Windows installation, you'll get denied even if you're an admin. Ownership and permissions are separate things in Windows.

3. Group Policy restrictions – Your system administrator (or a previous you) may have set policies that block specific commands or even Command Prompt entirely.

4. Third-party security software interference – Antivirus or endpoint protection tools sometimes lock down CMD operations they deem suspicious, even when you have legitimate admin rights.

One scenario I see frequently: after a Windows upgrade, file ownership can silently shift. You're suddenly locked out of folders you've been accessing for years. Encrypted files (EFS) can also trigger this error if you lack the decryption certificate—that one's a bit trickier to solve.

---

Basic Fixes: How to Run CMD as Administrator and Bypass UAC

Let's start with the simplest solutions. In my experience, about 60% of "Access is denied" errors in CMD are resolved by simply running the command with elevated privileges.

Method 1: Launch Command Prompt as Administrator (Windows 10 & 11)

This is the first thing you should try. It's quick, it's free, and it solves a surprising number of problems.

For Windows 10:

1. Click the Start button
2. Type cmd in the search box
3. Right-click Command Prompt from the results
4. Select Run as administrator
5. Click Yes when the UAC prompt appears

For Windows 11:

1. Right-click the Start button (or press Win + X)
2. Select Terminal (Admin) from the menu
3. Click Yes on the UAC prompt

Once you're in the elevated prompt, test it with a command that was failing before. Try ipconfig /flushdns—if it runs without complaint, you're good to go.

Method 2: Enable the Built-in Administrator Account

Windows has a hidden super-admin account that bypasses UAC entirely. It's disabled by default for security reasons, but you can enable it temporarily when you need full system access.

1. Open an elevated Command Prompt (using Method 1 above)

2. Type the following and press Enter:

   net user administrator /active:yes
   

3. Log off from your current account

4. Log in to the Administrator account

5. Run CMD from there—you'll have unrestricted access

Important security warning: Once you're done troubleshooting, disable this account immediately. Leaving it active is like leaving your front door unlocked. Run this command to disable it:

net user administrator /active:no

I've seen too many people forget this step and leave a gaping security hole in their system. Don't be one of them.

---

Advanced Solutions: Fixing File and Folder Permission Errors in CMD

If running as administrator didn't solve the problem, the issue is likely deeper—file ownership or NTFS permissions. These next methods are where the real power lies.

Method 3: Take Ownership of the File or Folder Using takeown

The takeown command does exactly what it sounds like: it transfers ownership of a file or folder to the current user. This is your go-to fix when you're dealing with files inherited from an old Windows installation or another user account.

Syntax:

takeown /f <full_path> /r /d y

• /f – Specifies the file or folder path
• /r – Recursively applies to all subfolders and files
• /d y – Automatically answers "Yes" to the prompt about folder permissions

Practical example:

takeown /f C:\Users\Public\Documents /r /d y

This command gives you ownership of everything in the Public Documents folder. In my experience, this is particularly effective for files that were migrated from an old Windows installation or restored from a backup.

Method 4: Reset Permissions with the icacls Command

While takeown handles ownership, icacls deals with permissions—specifically, the Access Control List (ACL) that determines who can do what with a file or folder.

To grant full control to a specific user:

icacls <full_path> /grant <username>:F /t

To reset all permissions to inherited defaults:

icacls <full_path> /reset /t /c /q

Real-world example:

icacls D:\Data /grant John:F /t

This grants John full control over everything in D:\Data, including subfolders. The /t flag applies the change recursively, /c continues even if errors occur, and /q suppresses success messages.

This is the solution I recommend when you're getting "Access denied" while trying to delete or move files. It's also the command I use most often when clients call me with permission nightmares.

Method 5: Delete Stubborn Files with CMD After Fixing Permissions

So you've got a file that refuses to be deleted—even in Explorer, even as admin. This is a classic scenario, and here's the complete fix:

Step 1: Open an elevated Command Prompt

Step 2: Take ownership and grant yourself full control in one go:

takeown /f C:\Temp\oldfile.exe && icacls C:\Temp\oldfile.exe /grant %USERNAME%:F && del C:\Temp\oldfile.exe

This combined command does three things in sequence:

1. Takes ownership of the file
2. Grants your user account full control
3. Deletes the file

⚠️ Warning: Be absolutely certain you want to delete the file before running this. There's no undo button for system files. I always recommend double-checking the path and making sure you're not deleting something critical to Windows operation.

---

System-Level Fixes: Group Policy, Registry, and Safe Mode

Sometimes the problem isn't with individual files—it's with system-wide policies or software conflicts. These methods address those deeper issues.

Method 6: Modify Group Policy to Allow CMD Access

If Command Prompt itself is being blocked, Group Policy might be the culprit. This happens more often on corporate machines or systems where someone previously tightened security settings.

1. Press Win + R, type gpedit.msc, and press Enter
2. Navigate to User Configuration > Administrative Templates > System
3. Find Prevent access to the command prompt in the right pane
4. Double-click it, set it to Not Configured or Disabled
5. Click OK and restart your computer

Note: The Group Policy Editor (gpedit.msc) is not available in Windows 10/11 Home editions. If you're on Home, skip to Method 7.

Method 7: Fix CMD Access Denied via Registry Editor

For systems where Group Policy Editor isn't available, the registry offers an alternative route. This is essentially the same fix, but applied directly to the registry.

1. Press Win + R, type regedit, and press Enter

2. Navigate to:

   HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System
   

3. Look for a DWORD value named DisableCMD

4. If it exists, set its value to 0 (which enables CMD)

5. If it doesn't exist, right-click, select New > DWORD (32-bit) Value, name it DisableCMD, and set it to 0

6. Restart your computer

Registry path reference:

HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System
DisableCMD = 0 (enables Command Prompt)

Method 8: Use Safe Mode to Bypass Third-Party Software Interference

Sometimes the problem isn't Windows at all—it's a third-party security tool that's overly aggressive. I've seen antivirus programs block CMD operations they deemed suspicious, even when the user had full admin rights.

To enter Safe Mode:

1. Restart your PC
2. Press F8 repeatedly during boot (or use Shift + Restart from the login screen)
3. Select Safe Mode from the boot options
4. Once in Safe Mode, open CMD as administrator and try the failing command

If the command works in Safe Mode, the issue is almost certainly a background application. Common culprits include:

• Antivirus suites (Norton, McAfee, Bitdefender)
• Endpoint protection software (CrowdStrike, SentinelOne)
• System optimization tools that lock down certain operations

Uninstall or disable the conflicting software, then test again in normal mode.

---

Windows 11 Specific: Resolving CMD Access Denied for Net User and Other Commands

Windows 11 introduced some changes to how Command Prompt and Terminal work. If you're on the latest OS, these fixes are tailored for you.

Method 9: Fix 'Access Denied' for Net User Command in Windows 11

The net user command is a common pain point on Windows 11. It requires elevated privileges, but even then, some users still hit "Access denied."

Here's the fix:

1. Right-click the Start button

2. Select Terminal (Admin)

3. Type your command, for example:

   net user username newpassword
   

4. If you still get denied, check if the account is locked or disabled:

   net user username /active:yes
   

The key difference on Windows 11 is that you should use Terminal (Admin) rather than the legacy Command Prompt. Terminal handles elevation more reliably in my testing.

Method 10: Use Windows Terminal (Admin) Instead of Legacy CMD

Windows Terminal is Microsoft's modern replacement for the legacy console. It hosts both CMD and PowerShell, and in my experience, it often bypasses permission quirks that plague the old console.

To use it:

1. Right-click the Start button
2. Select Terminal (Admin)
3. CMD commands work natively—just type them as you normally would

This isn't just a cosmetic upgrade. Windows Terminal handles UAC elevation differently and has resolved "Access denied" issues for several users I've worked with. It's worth trying before you dive into more complex fixes.

---

Prevention and Best Practices: Avoiding Future CMD Permission Errors

An ounce of prevention is worth a pound of cure. After helping dozens of users fix this error, I've noticed some patterns that can help you avoid it altogether.

Method 11: Regularly Check File Permissions and Ownership

Make it a habit to audit permissions on critical folders periodically. Here's a quick checklist:

• Review NTFS permissions on important folders using icacls <path> to see who has access
• *Avoid storing important files directly under C:* – the root directory has stricter permission requirements
• Keep your user account in the Administrators group – this prevents many permission-related issues
• After Windows upgrades, check ownership of your user folders—this is when permissions most commonly break
• Use a standard user account for daily work and only elevate when necessary—this reduces the attack surface

I've found that users who follow these practices rarely encounter "Access is denied" errors. It's the ones who store everything under C:\ and never check permissions who call me most often.

---

FAQ

How do I fix 'Access is denied' in Command Prompt?

Start with these three fixes in order:

1. Run CMD as administrator – Right-click Command Prompt and select "Run as administrator"
2. Use takeown and icacls to reset file ownership and permissions
3. Check Group Policy – Ensure "Prevent access to the command prompt" is disabled

Most users find their solution in step 1 or 2. See the detailed sections above for complete instructions.

Why does Command Prompt say 'Access is denied' when I run as administrator?

Even with an admin token, UAC can still block certain operations. The issue is often file ownership or NTFS permissions, not your admin status. Windows separates "running as admin" from "having permission to access this specific file." Use takeown and icacls commands to fix the underlying permission issues.

How do I delete a file that says 'Access is denied' in CMD?

Follow these steps:

1. Open an elevated Command Prompt
2. Take ownership: takeown /f <filepath>
3. Grant full control: icacls <filepath> /grant %USERNAME%:F
4. Delete the file: del <filepath>

You can combine all three commands on one line using && as shown in Method 5.

What does 'Access is denied' mean in CMD?

It's Windows' way of saying your current security context lacks the necessary permissions to execute the command or access the file. This can be due to:

• Insufficient NTFS permissions
• UAC restrictions
• File ownership issues
• Group Policy restrictions

---

Wrapping Up

"Access is denied" in CMD is frustrating, but it's rarely a dead-end. In most cases, running Command Prompt as administrator solves the problem immediately. If not, the takeown and icacls commands give you the power to reset ownership and permissions on any file or folder.

Here's a quick recap of the 11 methods:

1. Run CMD as administrator – The first thing to try
2. Enable built-in Administrator account – Full access without UAC
3. Use takeown – Take ownership of files/folders
4. Use icacls – Reset or modify NTFS permissions
5. Combined command for stubborn files – Take ownership + grant access + delete
6. Modify Group Policy – Unblock CMD if it's restricted
7. Registry Editor fix – Alternative to Group Policy
8. Safe Mode – Bypass third-party software interference
9. Windows 11 net user fix – Specific to the latest OS
10. Windows Terminal (Admin) – Modern alternative to legacy CMD
11. Prevention practices – Avoid future permission errors

Start with the simplest fix and work your way up. Most users find their solution in the first two methods. If you've tried everything and still face the error, share your specific command and Windows version in the comments below. Our community and experts are here to help you troubleshoot further.