Getting 'Access Denied' when running Get-ChildItem even as an administrator

I'm trying to delete files like desktop.ini, Thumbs.db, etc, using the following powershell command to recurse over a root directory on an external hard drive:

Get-ChildItem -Path . -Include Thumbs.db, Picasa.ini, .picasa.ini, AlbumArt_*.jpg, AlbumArtSmall.jpg, desktop.ini, Folder.jpg -Recurse -Name -Force | Remove-Item -Force

But I keep getting the following error:

Get-ChildItem : Access is denied
At line:1 char:1
+ Get-ChildItem -Path . -Include Thumbs.db, Picasa.ini, .picasa.ini, Al ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [Get-ChildItem], UnauthorizedAccessException + FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.GetChildItemCommand

The command prompt in which I start powershell (to run the above command) is run as an administrator, so I don't know why I'm getting 'Access Denied' still.

Even if I remove the Remove-Item part to just list the files matching those filenames, I still get the above error.

I also tried adding -Verbose tag to see if the folder which is throwing 'Access Denied' gets listed, but it does not.

Any ideas how I can get the above command to work ?

1 Answer

Access Control can be set so tight that even a user with Admin privileges can view the contents of some folders. Under a UserProfile, the following paths will throw AccessDenied errors:

• $Env:UserProfile\AppData\Local\Application Data
  $Env:UserProfile\AppData\Local\History
  $Env:UserProfile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5
  $Env:UserProfile\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 $Env:UserProfile\AppData\Local\Microsoft\Windows\Temporary
  Internet Files
  $Env:UserProfile\AppData\Local\Temporary Internet Files
  $Env:UserProfile\Application Data
  $Env:UserProfile\Cookies
  $Env:UserProfile\Documents\My Music
  $Env:UserProfile\Documents\My Pictures
  $Env:UserProfile\Documents\My Videos
  $Env:UserProfile\Local Settings
  $Env:UserProfile\My Documents
  $Env:UserProfile\NetHood
  $Env:UserProfile\PrintHood
  $Env:UserProfile\Recent
  $Env:UserProfile\SendTo
  $Env:UserProfile\Start Menu
  $Env:UserProfile\Templates

These happen to be junctions, but ultimately, the behavior is due to permissions.

I generated the above list with the following bit of PowerShell code. It collects all the paths that throw an error when recursive iteration is attempted, along with the folder's attributes and Access Control List (ACL).

gci -ad -Force -Recurse -ev AccessErrors -ea silent | out-null
( $ForbiddenFolderInfo = $AccessErrors.TargetObject | get-acl | %{ [PSCustomObject]@{ 'Path' = ( $_.Path -split '::' )[-1] 'Attributes' = ( gi $_.Path -Force ).Attributes 'Access' = $_.AccessToString
}} ) | fl

When run from the root of the System Drive, the first couple of items will be:

Path : C:\Documents and Settings
Attributes : Hidden, System, Directory, ReparsePoint, NotContentIndexed
Access : Everyone Deny ReadData Everyone Allow ReadAndExecute, Synchronize NT AUTHORITY\SYSTEM Allow FullControl BUILTIN\Administrators Allow FullControl
Path : C:\ProgramData\Application Data
Attributes : Hidden, System, Directory, ReparsePoint, NotContentIndexed
Access : Everyone Deny ReadData Everyone Allow ReadAndExecute, Synchronize NT AUTHORITY\SYSTEM Allow FullControl BUILTIN\Administrators Allow FullControl
Path : C:\ProgramData\Desktop
Attributes : Hidden, System, Directory, ReparsePoint, NotContentIndexed
Access : Everyone Deny ReadData Everyone Allow ReadAndExecute, Synchronize NT AUTHORITY\SYSTEM Allow FullControl BUILTIN\Administrators Allow FullControl
Path : C:\ProgramData\Documents
Attributes : Hidden, System, Directory, ReparsePoint, NotContentIndexed
Access : Everyone Deny ReadData Everyone Allow ReadAndExecute, Synchronize NT AUTHORITY\SYSTEM Allow FullControl BUILTIN\Administrators Allow FullControl
Path : C:\ProgramData\Microsoft\Windows\SystemData
Attributes : Directory
Access : NT AUTHORITY\SYSTEM Allow FullControl NT SERVICE\TrustedInstaller Allow FullControl