How to set permissions on external hard drive in Windows 7

Question

How do I set permissions/ownership on my external USB hard drive in Windows 7 in such a way that I have write access to it at any Windows 7 machine?

Current situation is quite strange to me - the directories are owned by HOSTNAME\Administrators, I am user TOMAS, I am within this group (I am an administrator), but I cannot write to the disk. Can you please explain why?

And how to set it in such a way that I can operate from any Windows 7 machine. If I change ownership to Tomas, I will likely have an issue on different computer, where I use different user....

Maybe the best way would be to give full access to HOSTNAME\Users or to Everyone?

Output of calcs for the drive:

C:\Users\Tomas>cacls e:
E:\ Everyone:R
    CREATOR OWNER:(OI)(CI)(IO)F
    NT AUTHORITY\SYSTEM:(OI)(CI)F
    NB-CSO-PC\Tomas:(OI)(CI)F
    BUILTIN\Administrators:(OI)(CI)F
    BUILTIN\Users:(OI)(CI)F

The Security/Owner dialogues:

Solution

The behaviour you see is probably due to User Account Control (UAC). Your user do not have Administrator access unless you press allow in the UAC prompt when you're doing operations that requires Administrator previleges. This includes reading/modifying files that can only be read/modified by the Administrator group. In this case, yes, granting full access to users will solve your problem.

Comments

[Tomas]

thanks @bill, but I don't understand well the UAC thing... I have 2 questions: 1) you say that I don't have administrator access, even if I clearly am an administrator? 2) How can I enable it? How do I run the UAC prompt?

[Tomas]

and no UAC prompt pops out when I try to write to disk... I think this is unrelated to UAC...

[billc.cn]

So to prevent malicious software from modifying system files/configuration, even users in the Administrator group runs programs with a access of a normal user under UAC. The program can then indicate to the system that it wants to do some operation with the full admin previlege (commonly identified with the little shield icon) and the system will show you the UAC prompt.

[billc.cn]

Then could you make a screen cap of the advanced dialogue in the security tab of the properties of that drive? Alternatively run cacls drive: and post the result (in the question or in pastebin.com or something).

[Tomas]

I've posted the information you wanted, please see my updated post. If you need to translate the dialogues from Czech, please ask me.

[Tomas]

please explain this a bit to me... I am a Windows 7 beginner. I have just default Windows 7 Home Edition installation and I am a basic user, and I don't know what Active Directory is... and if I am using it or not.

[surfasb]

If you aren't sure, then it is very unlikely that you are using Active Directory. I added a dead giveaway if you are using AD.

[Tomas]

So, if I follow your logic, I am not using AD, so I give full access to everyone. But this is a direct contradiction of my problem, that I couldn't write on the HDD.

[billc.cn]

Don't turn off UAC just for this problem though. It will seriously reduce the security of your system. Just grant full access to the "Users" group and tick the option in the advanced dialogue of the security tab to apply the settings to all files and sub-directories.

[Tomas]

I turned off UAC, what else should I do in this brain damaged system? Do you actually advise me to go trough my 5 disks and apply this to hundred thousands of directories? Es una locura! That would take one working day... I hate Windows 7!!

[Tomas]

I have now found a general guide that says I should run cacls X: /T /G Everyone:F. Should this help in my case? But I guess this is recursive due to /T will take very long on hundred thousands of directories? Is this just a command-line version of what you've been advicing me (except for group Users swapped for Everyone)?

[billc.cn]

Technically you don't have to recursively grant it to all objects (sub-directory or file) due to ACL inheritance, i.e. an object inherits all the ACL entries from parent by default, so you only have to set it on the root directory and it should apply to all the inheriting objects. However, it is difficult to know if there's any directory or file that overrides this inheritance. You can use icacls /reset /T to reset all the inheritance settings, but this will probably take the same about of time as the command you've found (just a bit cleaner).