Fix STATUS_PRIVILEGE_NOT_HELD (0xC0000061) on Windows

You're staring at STATUS_PRIVILEGE_NOT_HELD (0xC0000061) and it's a pain.

This error appears when you try to open a file, run a program, or even start a service and Windows says 'nope, you don't have the right privilege.' The real trigger is often a corrupted permission set or an ownership snafu after a Windows update, a file restore, or copying data from another drive. I've seen it most when someone uses a backup tool that doesn't preserve NTFS permissions correctly, or after a failed system restore.

The one fix that works 90% of the time: reset file permissions

Skip all the guesswork. You're going to take ownership of the file or folder that's causing the error, then reset its permissions with the built-in icacls tool. This works on Windows 10, Windows 11, and Windows Server 2016 through 2022. Let me walk you through it.

Step 1: Find the exact file or folder

Right-click the file or folder that throws the error. Pick Properties. Go to the Security tab. If you see 'You must have Read permissions to view the properties of this object' or similar, that's your cue.

Step 2: Take ownership

Click the Advanced button in the Security tab.
Next to Owner, click Change.
In the box that says 'Enter the object name to select', type Administrators and click Check Names. It should underline it.
Click OK. Check the box that says Replace owner on subcontainers and objects if you're fixing a folder.
Click Apply then OK. You should now see the owner changed to Administrators.

After this, close the Properties window and reopen it. If the Security tab still shows a mess, move to the next step.

Step 3: Reset permissions with icacls

Open Command Prompt as administrator. Search for 'cmd' in the Start menu, right-click it, and pick Run as administrator. Then run this command, replacing the path with yours:

icacls "C:\Full\Path\To\Your\File" /reset /t /c /q

/reset replaces all permissions with default inherited ones.
/t does it for all subfolders and files.
/c continues even if there are errors on some files.
/q keeps it quiet, no prompts.

After running it, you'll see 'Successfully processed X files' and maybe some failed ones. That's normal. The error should be gone now.

Why this works

The STATUS_PRIVILEGE_NOT_HELD error is Windows's way of saying 'the security descriptor on this object is broken or missing a required entry.' By taking ownership, you make sure the Administrators group can change permissions. The icacls /reset command then strips all the custom, often corrupted ACL entries and replaces them with the default inherited ones from the parent folder. This resets the privilege chain that Windows checks when any user or service tries to access the file.

Think of it like a lock that's been jammed by a wrong key. Ownership gives you the master key, and the reset cleans the lock mechanism. Without this, no amount of 'run as administrator' will help, because the underlying permission structure is the problem, not your user account's token.

Less common variations

If the first fix didn't work, you might be dealing with one of these twists:

Variation 1: Service account privilege missing

If the error comes from a Windows service (like SQL Server or a backup agent), the service account might be missing the SeBackupPrivilege or SeRestorePrivilege. To check this, open Local Security Policy (type secpol.msc in Run). Go to Security Settings → Local Policies → User Rights Assignment. Look for Back up files and directories and Restore files and directories. Add the service account there. Then restart the service.

Variation 2: File is on a network share with no delegation

If the file is on a network drive and you're accessing it from another computer, double-hop delegation might be blocked. The error appears because the remote server doesn't trust your credentials to pass through. Fix this by either mapping the drive with explicit credentials (net use \\server\share /user:domain\username) or by setting up Kerberos delegation in Active Directory. For most home users, just copy the file to your local drive first.

Variation 3: Corrupted user profile

Sometimes the error isn't about the file but your user profile's privilege token. Create a new local admin account and test with that. If the error goes away, migrate your data to the new profile. To do this, go to Settings → Accounts → Family & other users, add a new user, then sign out and into the new account.

Prevention tips

Once you've got the error fixed, here's how to keep it from coming back:

Never copy system files with a regular file copy tool. Use robocopy with the /COPYALL flag, or use a proper backup tool that preserves NTFS permissions.
Don't change permissions on system folders. If you accidentally modify permissions on C:\Windows or C:\Program Files, you'll break things. Use the sfc /scannow command to repair them if you do.
Run Windows Update regularly. Some privilege bugs get patched. The most recent one I saw was KB5034441 for Windows 10 22H2 that fixed a privilege escalation issue.
When in doubt, reset before you mess. If you need to give a user access to a file, use the GUI Security tab properly—don't just take ownership and leave it. Assign explicit permissions for the user or group.

That's it. You should be good now. If the error still shows up after all this, you might have a deeper system file corruption, and that's when you run an in-place upgrade repair install from the Windows Media Creation Tool. But I'm betting the ownership and icacls reset will have you sorted in under 10 minutes.