Fix 'Access Control Entry Is Corrupted' in Windows 11

You’re staring at a folder. Maybe it’s your Xbox saves, a game installation directory, or the elusive WindowsApps folder. You right-click, navigate to Properties, and hit Security. Instead of your familiar list of users, you see a single, blinking red warning: “This access control entry is corrupted. Delete it and create a new one.” The “Add” and “Remove” buttons are greyed out. You’re an administrator. You should have rights. But Windows is locking you out.

This is the "this access control entry is corrupted windows 11" error, and it’s more common than you’d think after a failed Windows Update or a botched UWP app installation. It’s not a virus, and it’s not a sign that your hard drive is failing. It’s a specific NTFS file system permissions issue where the ACL (Access Control List) for a folder has become invalid. The security descriptor—the database that tells Windows who can access what—has broken links.

In this guide, I’ll walk you through exactly how to fix this. We’ll start with the quick GUI fixes that work for 80% of users, then move to command-line repairs for the stubborn cases. Crucially, I’ll explain why you might be stuck despite having admin rights, and how to back up your data before you start deleting things. Because as I’ve learned from fifteen years of troubleshooting these kinds of ACL nightmares: if you delete a corrupt entry without proper ownership, you can end up with a folder that even you can’t access.

Why Is This Access Control Entry Corrupt?

Before we start clicking buttons, let’s understand what’s actually broken. This context helps you decide which fix to apply.

The Role of NTFS ACLs and Inheritance

In Windows, every file and folder has a security descriptor. Think of it as a bouncer’s list at a club. The list (the ACL) contains entries for specific users or groups (like "Administrators" or "Users") and their permissions (Full Control, Read, Write).

The issue with "corrupted" entries usually stems from how Windows handles Inheritance rules. When you create a new folder inside C:\Users\Public, it automatically inherits the permissions from the parent folder. However, if a Windows Update fails halfway through changing system permissions, or if a registry hive update gets interrupted, the link between the parent security descriptor and the child ACL can break. The entry remains, but its SID (Security Identifier) no longer points to a valid user or group object.

I often see this happen after the 23H2 and 24H2 updates in Windows 11, where the TrustedInstaller account interacts with the WindowsApps folder. If the update process is interrupted, the ACL can be left in a state where it references a SID that doesn’t exist or is malformed. Microsoft’s documentation on security descriptors confirms that when an ACE (Access Control Entry) fails validation checks for SID integrity, the UI displays this corruption warning to prevent you from applying invalid permissions that could lead to system instability.

Is It Safe to Ignore? Risks of Leaving Corrupt Entries

A common question in support forums is, "Can I ignore this access control entry corruption error?" The short answer: no.

While your computer might seem to run fine initially, ignoring a corrupt ACE is like leaving a loose screw in a door hinge. It works for a while, but eventually, the door sticks. In technical terms, if the corrupt entry belongs to the "Users" group or "Everyone," and the system tries to apply a new permission that depends on that inheritance chain, the entire operation fails.

I’ve seen real-world examples where users ignored the error in their Xbox App folders. Three weeks later, the Microsoft Store would randomly crash, and the Xbox app would refuse to launch, throwing a "Permission Denied" error. In one case I handled, a user ignored the warning on a shared network folder. When they tried to back up their data using Windows Backup, the process failed silently because the backup service couldn’t validate the ACLs on the source folder. The result? They lost access to two years of photos. Manual deletion of a corrupt entry without proper ownership transfer is risky; if you delete the entry and it was the only entry granting you access, you become locked out of your own data.

Method 1: GUI Fix for General Users

If you’re comfortable using the mouse and don’t mind following a multi-step dialog process, the GUI method is usually sufficient. The goal here is to reset the Directory ownership and then recreate a clean ACL entry.

Step 1: Verify Administrative Privileges

Before you do anything, make sure you are logged in with an account that has administrative privileges. This is a prerequisite for 90% of ACL fixes.

Go to Settings > Accounts > Your info. You should see "Administrator" or "Member of the Administrators group" under your name. If you don’t see this, you’ll need to log into a different account or use the built-in Administrator account (which is usually disabled by default). Without these rights, the "Owner" fields in the Security tab will be read-only, and you won’t be able to proceed.

Step 2: Take Ownership and Reset Permissions via Properties

This is where it gets tricky. You need to take ownership of the folder before you can edit its permissions.

1. Right-click the affected folder (e.g., C:\Program Files\WindowsApps) and select Properties.
2. Click the Security tab, then click the Advanced button at the bottom.
3. Look at the top of the new window. Next to "Owner," you will likely see "TrustedInstaller" or a garbled SID. Click Change.
4. In the "Select User or Group" box, type Administrators (or your specific username).
5. Click Check Names. It should resolve to COMPUTERNAME\Administrators. Click OK.
6. Critical Step: Back in the Advanced Security Settings window, check the box labeled "Replace owner on subcontainers and objects." This ensures that every single file inside the folder changes ownership, not just the folder itself.
7. Click Apply. You will need to type your password to confirm the UAC prompt. Wait for the progress bar to finish. This can take a while on large folders.

Now that you own the folder, you can edit the permissions. Stay in the Security tab and click Edit.

• The "Greyed Out" Workaround: In many cases, the "Add" and "Remove" buttons are still disabled because the ACL is fundamentally broken. Here is a lesser-known trick I’ve found reliable in my experience. Instead of trying to add a new user, click on the Auditing tab in the Advanced Security Settings window. Click Add. Select "Select a principal." Choose "Administrators" or "Users." Click OK.
• When you switch back to the Permissions tab, the interface often "unlocks." The Add/Remove buttons become active. You can now delete the corrupt entry (which might just say "Unknown" or have a red X) and add a fresh entry for your user account with "Full Control" checked.

If the Auditing trick doesn’t work, skip to Method 2.

Step 3: Recreate the Corrupt Entry

Why do we delete and recreate instead of "repairing"? Because Windows ACLs are structured data. A corrupt entry is like a row in a database where the primary key is broken. There is no "repair" button in the UI. You have to delete the invalid reference and create a new, valid one.

1. Select the corrupt entry in the list.
2. Click Remove.
3. Click Add.
4. Type your username or "Administrators."
5. Check Full Control for both Allow and Deny (actually, just check "Full Control" under Allow).
6. Click OK and Apply.

The corruption warning should disappear.

Method 2: Command Prompt & PowerShell Repair for Advanced Users

When the GUI refuses to budge, or when you’re dealing with the WindowsApps folder which is heavily protected by UWP (Universal Windows Platform) architecture, command-line tools are your best friend. This method uses takeown and icacls to force Windows file integrity repairs on the ACLs.

Backup Strategy Before Running Repair Commands

Before you type a single command, stop and think. If you modify permissions on a folder containing critical data (like a game save folder or a development project), a mistake in the command line can lock you out permanently.

• Checklist:
  • Identify the folder path.
  • Copy the folder contents to an external drive or a different partition (e.g., D:\Backup\ ).
  • Keep the original folder until you are 100% sure the repair worked.
  • Create a System Restore point: Search for "Create a restore point" in Start, click "Create," and label it "Before ACL Fix."

If the repair goes wrong, you can revert. If it doesn’t and you’ve backed up your files, you can just delete the folder and restore from backup.

Using Takeown and Icacls to Force Ownership

Open Command Prompt as Administrator. You can do this by right-clicking the Start button and selecting "Terminal (Admin)" or "Command Prompt (Admin)."

1. Take Ownership: The takeown command grabs ownership of the folder and all its subfiles.

takeown /f "C:\Program Files\WindowsApps" /r /d y

• /f: Specifies the file or folder path.
• /r: Processes subdirectories recursively.
• /d y: Answers "Yes" to any prompts automatically (prevents the command from pausing on every file).

2. Grant Full Control: Now that you own it, use icacls to grant your user account full control. This overwrites the corrupt ACL with a clean one.

icacls "C:\Program Files\WindowsApps" /grant %username%:F /t /c

• %username%: This variable expands to your current username. You can replace this with "Administrators" if you prefer to grant the group control.
• :F: Grants Full Control.
• /t: Applies the change to all subdirectories and files.
• /c: Continues on errors (prevents the command from stopping if one file fails to update, which is common with locked system files).

3. Specific WindowsApps Fix: If you are specifically trying to fix the YourPhone or Xbox app, the path is more specific. Use this variant:

icacls "C:\Program Files\WindowsApps\Microsoft.YourPhone*" /grant %username%:F /t /c

Note the asterisk * to catch all versioned subfolders of the app.

Running SFC and DISM to Repair Windows File Integrity

Sometimes, the ACL corruption is a symptom of deeper Windows file corruption. SFC (System File Checker) scans for and repairs corrupted Windows files.

1. In the same Admin Command Prompt, type:

   sfc /scannow
   

2. Wait for it to complete (this can take 15-30 minutes).

3. If SFC reports "Windows Resource Protection found corrupt files but was unable to fix some," run DISM:

   DISM /Online /Cleanup-Image /RestoreHealth
   

4. Restart your computer.

Does sfc /scannow fix access control entry corruption? It’s a nuanced answer. SFC fixes system files, which may include the security templates that generate ACLs. However, it will not fix a corrupt ACL on a user data folder or a specific app folder that has already been broken by a failed update. For that, you need the icacls commands above. Think of SFC as fixing the blueprint, while icacls fixes the actual bricks on the wall.

Specific Workaround: Fixing WindowsApps & Xbox Store Errors

The WindowsApps folder is the most common source of this error in Windows 11. It requires a slightly different approach because of how UWP apps are managed.

Why WindowsApps Folders Are Unique

By design, the WindowsApps folder is owned by the TrustedInstaller service, not the Administrators group. This is a security measure to prevent standard admin users from tampering with system-installed apps. When a UWP app update fails, it can leave behind a "ghost" folder or a corrupt ACL that TrustedInstaller can’t clean up because the update transaction was interrupted.

This is why you often see the error after installing or updating Microsoft Store apps like Xbox, Minecraft, or Microsoft Photos. The app installer tries to modify the ACL, fails partway through, and leaves the entry in a corrupted state.

Targeted Fix for Xbox/Minecraft Launchers

If you are specifically stuck with the Xbox app or Microsoft Store errors, follow this sequence:

1. Try the Non-Invasive Reset First: Before touching permissions, go to Settings > Apps > Installed apps. Find "Xbox" or "Microsoft Store." Click the three dots > Advanced options > Reset. This clears the app’s cache without touching the ACLs. In many cases, this resolves the issue without needing icacls.

2. The Command Line Nuke: If Reset doesn’t work, use the commands from Method 2, but target the specific app package.

   For Xbox:

   icacls "C:\Program Files\WindowsApps\Microsoft.XboxApp_*" /grant %username%:F /t /c
   

3. Force Reinstall: If the app is still broken, you can safely delete the specific subfolder (e.g., Microsoft.XboxApp_...) after taking ownership. Then, open the Microsoft Store and reinstall the app. The Store will recreate a clean folder with valid ACLs.

   Warning: Never delete the entire WindowsApps folder. Always target the specific app subfolder.

Prevention: Stopping NTFS Permission Corruption in Future

You’ve fixed the immediate error. Now, how do you stop it from happening again? This is about maintaining Registry corruption prevention and general system health.

Update Maintenance and Registry Health

The vast majority of "this access control entry is corrupted" errors in Windows 11 are triggered by interrupted Windows Updates. The update service modifies security templates, and if the process is killed, the ACLs are left in a limbo state.

• Complete Your Updates: Don’t reboot mid-update. Let Windows 11 finish the installation process.
• Periodic SFC Checks: Run sfc /scannow once a month. It’s a low-cost way to ensure your Windows file integrity is solid.
• System Restore Points: Create a restore point before major updates or manual permission changes. If an update causes ACL chaos, you can roll back to a clean state in minutes.
• Avoid Third-Party "Permission Fixers": Many registry cleaners promise to "fix permission errors." In my experience, they often make things worse by stripping ACLs from system folders. Stick to built-in tools like takeown and icacls.

Registry corruption is a secondary cause. If you frequently use software that writes directly to the security hive (HKLM\SYSTEM\CurrentControlSet\Security), you’re increasing the risk of ACL mismatches. Keep your system clean.

Frequently Asked Questions

How to fix 'This access control entry is corrupted' in Windows 11? The most reliable quick fix is to take ownership of the folder via Properties > Security > Advanced > Owner, check "Replace owner on subcontainers and objects," and then recreate the permission entry. For stubborn cases, use takeown /f "Path" /r /d y and icacls "Path" /grant %username%:F /t /c in an admin Command Prompt.

Can I ignore this access control entry corruption error? No. While it might not crash your PC immediately, it will eventually cause "Permission Denied" errors, app instability, or backup failures. A corrupt ACE is a ticking time bomb for system integrity. Fix it when you see it.

What are the command prompt commands to repair corrupted NTFS permissions? Use these two commands in an elevated Command Prompt:

1. takeown /f "C:\Path\To\Folder" /r /d y (To claim ownership)
2. icacls "C:\Path\To\Folder" /grant Administrators:F /t /c (To grant full control) The /t flag applies the fix to all subfiles, and /c ensures the command continues if it encounters locked files.

Will a clean install of Windows 11 fix access control entry errors? A clean install will reset system ACLs, but it will not fix corruption in your user data folders (like your Documents or game saves). It is a last resort. If the error is on C:\Users\YourName\..., a clean install won’t help because your personal data remains. Try the GUI and CMD fixes first.

Conclusion

The "This access control entry is corrupted" error in Windows 11 is not a mystery. It’s a broken link in the NTFS permission chain, usually caused by interrupted updates or UWP app conflicts. It’s manageable, and it’s not a sign of catastrophic hardware failure.

The key to resolving it is combining GUI ownership changes with command-line repairs when necessary. The GUI gets you 80% of the way, but icacls is the sledgehammer you need for the remaining 20%. And always, always back up your data before you start modifying permissions. I’ve seen users lose years of photos because they skipped that one step of copying files to an external drive.

Did you resolve the issue using the GUI or the Command Prompt method? If you’re still stuck on a specific folder path, drop it in the comments. I can often point you to the exact icacls syntax you need. And if you found this guide helpful, subscribe for more deep-dives into Windows 11 troubleshooting. I publish new guides every week.