Fix STATUS_NO_SECURITY_ON_OBJECT (0XC00000D7) in Windows

I know this error is infuriating. One minute you're opening a file or running a program, the next you're staring at STATUS_NO_SECURITY_ON_OBJECT (0XC00000D7). The short version: the file or folder you're trying to access has lost its security descriptor — basically, Windows doesn't know who can touch it. This happens a lot with corrupted downloads, old USB drives, or files copied from a Linux ext4 drive.

The Quick Fix: Use icacls to Reset Permissions

Skip the GUI, it won't help here. Open Command Prompt as Administrator. Right-click Start, pick "Command Prompt (Admin)" or "Terminal (Admin)" on Windows 11.

Let's say the problem file is C:\Users\YourName\Downloads\broken.pdf. Run this:

icacls "C:\Users\YourName\Downloads\broken.pdf" /reset /t /c /q

Breakdown of the flags:

/reset — replaces the ACL with default inherited permissions
/t — applies to all subfolders and files (if the error is on a folder)
/c — continues even if there are errors (keeps you from getting stuck)
/q — quiet mode, no spam in the console

Wait a few seconds, then try opening the file again. This works about 80% of the time.

If the File Is on a Network Share

For SMB shares or mapped drives, the error usually means the share itself has no security permissions. On the server hosting the share, run:

icacls "D:\SharedFolder" /grant "Everyone:(OI)(CI)F" /t

This gives full control to everyone on that folder. Yes, it's wide open — but you can tighten it after. The real fix is to set proper NTFS permissions on the server. Also check that the share permissions in the Sharing tab are set to at least "Read" for the user group.

Why This Happens

Every file in Windows NTFS has a Security Descriptor. It's a tiny data structure that lists who can read, write, or delete it. When that descriptor gets corrupted or is missing entirely, Windows throws 0xC00000D7.

Common triggers:

Corrupted downloads — a partial download leaves a file with no ACL
Files from Linux or macOS drives — those systems don't use NTFS security, so when you copy them over, the descriptor is blank
Malware damage — some ransomware wipes ACLs to block recovery
Windows update glitches — seen after KB5000802 on Windows 10 v2004
Old USB drives formatted as FAT32 — FAT32 doesn't support security descriptors, so files moved to NTFS afterward can inherit nothing

Less Common Variations

Variation 1: The Error Appears on System Files

If the error hits a Windows system file like ntoskrnl.exe or a DLL in C:\Windows\System32, don't mess with icacls there. Run System File Checker instead:

sfc /scannow

This replaces corrupted files with cached copies. After it finishes, reboot. If sfc says it can't fix something, run DISM first:

DISM /Online /Cleanup-Image /RestoreHealth

Then run sfc again. This combo fixes most system-level 0xC00000D7 errors.

Variation 2: The Error in Event Viewer (Kernel General)

Sometimes the error shows up in Event Viewer under System log with source "Kernel-General" and ID 12 or 17. That usually means a driver tried to open a file with no ACL. Update your chipset drivers — especially Intel RST or AMD SATA drivers. On Windows 11 22H2, I've seen this with old Realtek audio drivers.

Variation 3: Error on a Registry Key

If 0xC00000D7 happens when you're editing the Registry, the key itself might have no security. Open regedit, right-click the key, pick Permissions, and give yourself Full Control. If that option is grayed out, you need to take ownership first — right-click the key, choose "Permissions", then click "Advanced" and change the owner to your user account.

Prevention: Keep Security Descriptors Healthy

Once you fix it, here's how to stop it from coming back:

Always use safe ejection for USB drives. Yanking them out mid-write corrupts ACLs.
Format removable drives as NTFS if you use them only on Windows. ExFAT is okay for sharing, but FAT32 is a no-go for security.
Run regular integrity checks — chkdsk C: /f once a month. Bad sectors can corrupt security descriptors.
Keep your antivirus active. Some ransomware strains target ACLs specifically.
After a major Windows update, run sfc /scannow proactively. Takes 10 minutes, saves you headaches.

That's it. You should be back to work in under five minutes. If icacls doesn't fix it, the file is likely beyond repair — delete it and download again from the source. Happens to all of us.