Fix ERROR_NO_SECURITY_ON_OBJECT (0x00000546) on Windows

When you'll see this error

You're copying files to an external drive, running a backup job, or trying to change permissions on a shared folder in Windows 10 or 11. Then it hits: ERROR_NO_SECURITY_ON_OBJECT (0x00000546) — "Unable to perform a security operation on an object that has no associated security." It's most common with:

USB drives that were yanked out without ejecting
Old NTFS volumes that have seen a crash or power loss
SMB shares where the remote file system got corrupted
Backup software like Veeam or Acronis trying to snapshot a file

I've seen this on a client's external hard drive with a corrupted directory table. The real fix isn't a permission reset — it's file system repair.

What's actually happening

Every file and folder on an NTFS volume has a security descriptor — a little header that lists who owns it, what permissions apply, and what audit rules are in place. When that descriptor is missing or unreadable, the 0x00000546 error pops up. This isn't a permission problem — the object literally can't report its own security settings. Windows won't touch it until the descriptor is either repaired or rebuilt.

Fix 1: Run chkdsk to repair the volume

This is the first thing I try. Nine times out of ten, the issue is file system corruption on the drive where the object lives.

Open Command Prompt as Administrator. (Press Win+R, type cmd, press Ctrl+Shift+Enter.)
Type:
```
chkdsk D: /f /r
```
(replace D: with the drive letter showing the error)
Press Enter. If it says the volume is in use, agree to schedule the scan on next reboot.
Restart the machine and let chkdsk run. It can take 30 minutes to an hour on a large drive.

After reboot, try the operation again. If it works, you're done. If chkdsk finds no issues, move to Fix 2.

Fix 2: Force a permission reset with icacls

If chkdsk didn't help, we'll reset the security descriptor manually. This replaces the missing ACL with a fresh one based on the parent folder.

Open Command Prompt as Administrator.
Navigate to the parent folder:
```
cd /d D:\SomeFolder
```
Run:
```
icacls * /reset /t /q
```
- /reset replaces ACLs with the default inherited ones
- /t applies to all subfolders and files
- /q suppresses success messages — you'll see only errors
Wait for it to finish. On a big folder tree, this can take a few minutes.

After that, retry the operation. If icacls throws an access-denied error on a specific file, see Fix 3.

Fix 3: Take ownership first

Sometimes the file's owner is also corrupt. You'll need to take ownership before you can reset permissions.

Open Command Prompt as Administrator.
Take ownership recursively:
```
takeown /f D:\SomeFolder /r /d y
```

Grant yourself full control:

icacls D:\SomeFolder /grant administrators:F /t /q

Now run the icacls /reset command from Fix 2 again.

Fix 4: Delete and recreate the object

If the file or folder still refuses to play ball, it's toast. The security descriptor is gone for good at the MFT level. Delete it if possible, then recreate it. On a network share, that means asking the admin to delete it from the server side.

Try to delete it with:

del /f /q D:\BadFile.txt

rmdir /s /q D:\BadFolder

If that fails, boot into safe mode (press F8 during boot on older systems, or use Shift+Restart in Windows 10/11) and try again.
Once deleted, create a new folder or file with the same name. Permissions will inherit from the parent.

If nothing works

You're looking at a damaged NTFS volume. Run a surface scan with chkdsk D: /f /r /x (the /x forces the volume offline first). If that still doesn't find bad sectors, the drive may be failing. Back up everything you can immediately — even the corrupted files can often be moved using Robocopy with retry flags:

robocopy D:\ E:\Backup /E /R:3 /W:10 /COPY:DATSOU

The /COPY:DATSOU flag tells Robocopy to copy data, attributes, timestamps, security info, owner, and audit info — but if security is missing, it'll just copy the data and skip the ACL. That's fine. You can fix permissions on the copy later.

If the drive is under warranty, replace it. If not, it's time to move on. I've had to salvage data from a drive where the MFT was so trashed that only a raw sector reader could recover files. But that's a story for another article.