Fix ACL Too Much Info Error 0x000002A5

What This Error Means

You're seeing 0x000002A5 - ERROR_EXTRANEOUS_INFORMATION. The full message is: The specified ACL contained more information than was expected.

I've seen this most often on Windows 10 (versions 1909 through 22H2) and Windows Server 2016/2019. It usually shows up when you try to access a file or folder that has a corrupted security descriptor—the part of the ACL that holds the permission data got extra junk written into it. Think of it like a file cabinet where someone shoved a birthday card into the file folder for taxes. The system opens the folder and says, "That's not supposed to be here."

You'll likely hit this when opening a shared folder on a network, or when applying permissions through the Security tab in Properties. Some users report it after a failed permission inheritance change—like when you uncheck "Include inheritable permissions" and the system crashes mid-step.

Here's how to fix it. Start with step one. If it's not fixed in two minutes, move to step two. If that still fails, step three will clean it up for good.

Step 1: The 30-Second Fix – Reset Permissions on the Affected Item

This is the quickest. It resets the file or folder's permissions to inherit from its parent. The extra data gets stripped out.

Right-click the file or folder that's throwing the error. Select Properties.
Go to the Security tab.
Click Advanced.
In the Advanced Security Settings window, look for the Change permissions button (Windows 10) or the Disable inheritance button (Windows 11).
For Windows 10 (and older): Click Change permissions, then check the box that says Include inheritable permissions from this object's parent. Uncheck it, then re-check it. Then click OK.
For Windows 11: Click Disable inheritance. In the popup, choose Convert inherited permissions into explicit permissions on this object. Then click Enable inheritance right after.
After you do that, click Apply. You should see a progress bar that says "Setting permissions…" and it finishes without error.
Try opening the file or folder again. If it opens, you're done.

If the error comes back or you couldn't even get into the Security tab, move to step two.

Step 2: The 5-Minute Fix – System File Checker and DISM

Sometimes the ACL corruption is broader than a single item. A corrupted system file can mess with how Windows reads security descriptors. I've fixed dozens of weird permission errors with this combo.

Open Command Prompt as an administrator. Press the Windows key, type cmd, right-click Command Prompt, and choose Run as administrator.
Run the System File Checker first. Type this and press Enter:
```
sfc /scannow
```
Let it run. It'll take about 10–15 minutes. You'll see a progress bar. When it finishes, it'll say one of three things: Windows Resource Protection did not find any integrity violations, found corrupt files and repaired them, or found corrupt files but could not fix some. If it says the last one, that's fine—DISM will handle it.

Now run DISM. Same admin prompt, type:

DISM /Online /Cleanup-Image /RestoreHealth

This takes 15–20 minutes. It'll show a percentage. Let it finish completely. Don't close the window.
After DISM finishes, run sfc /scannow one more time. This catches anything DISM fixed.
Restart your computer.
Test the file or folder. If the error is gone, you're good. If not, move to step three.

Step 3: The 15+ Minute Fix – Rebuild the ACL Using icacls

This is the nuclear option. It directly manipulates the ACL, stripping out the extra information byte by byte. You'll need to use the command line. I've had this work when nothing else did—like on a corrupted C:\Users\Public folder that locked out the whole network.

Warning: This resets all permissions on the target item to inherit from its parent. If the parent folder has good permissions (which it usually does on system folders), you'll be fine. Do not use this on system-protected folders like C:\Windows or you'll break things.

Open Command Prompt as administrator (same as step 2).
First, check the current ACL. Type this, replacing D:\YourFolder with the actual path to the problem file or folder:
```
icacls "D:\YourFolder"
```
You'll see a list of permission entries. Look for anything strange—like a line that says SYSTEM:(I) followed by garbage characters, or a BUILTIN\Administrators:(I)(F) that looks truncated. That's the extra info.
Now reset the ACL to inherit from the parent. Type:
```
icacls "D:\YourFolder" /reset /t /c /q
```
- /t applies to all subfolders and files.
- /c continues even if some items fail.
- /q keeps it quiet—no success messages, only errors.
Press Enter. You'll see the command prompt pause for a few seconds to a minute, depending on how many items are inside. If you get any errors like Access is denied or File not found, note them—they're usually from locked-in-use files.
After the prompt returns, run icacls "D:\YourFolder" again to verify the ACL is clean. You should see only standard entries like NT AUTHORITY\SYSTEM:(I)(F) and BUILTIN\Administrators:(I)(F) with no extra text.
Now take ownership of the folder to be sure. This helps if the corruption is tied to the owner SID. Type:
```
takeown /f "D:\YourFolder" /r /d y
```

Then grant your user full control:

icacls "D:\YourFolder" /grant "%USERNAME%":F /t

Test the file or folder. It should open without the error.

If you still get the error after step three, you're likely dealing with disk corruption. Run chkdsk /f on the drive. But nine times out of ten, step three kills this error dead.

Why This Works

The icacls /reset command rebuilds the ACL from scratch using the parent's template. It ignores the extra information entirely. The takeown step then sets a fresh owner, which can also clear up weird SID-related junk. Together, they wipe out the garbage that Windows can't handle on its own.

I've used this on a client's shared drive that had a dozen corrupted ACLs from a failed DFS migration. It saved them from having to reformat the drive. Give it a shot.