Windows CLI tool to take full ownership of a file

Question

I do auditing of Windows Systems, I need a simple and robust CLI tool that can take ownership of any file to the full extent.

I've dabbled with takeown and icacls but they seem to be quite limited, especially with system files.

While I do have success most of the time, there are certain files that just won't budge.
And those files most of the time require the machine to be rebooted into a separate environment to actually make the changes needed.

Any tools like chmod that changes ALL permissions on a resource, not just partial entries.

Answer 1

After thorough research I've come up with this script:

@echo off

rem Copyright (C) 2017-2023 Nurudin Imsirovic
rem ownfile - Take full ownership of a resource
rem Created: 2017-04-21 11:23 AM
rem Updated: 2023-08-16 04:49 PM

rem Developer notes
rem
rem  takeown's /SKIPSL option only applies
rem  if recursion is used.  Meaning that
rem  setting the ownership on a symlink
rem  will affect its target.

set file=%1
set recursive=%2
set skip_symlinks=%3
set quiet=%4

if /I [%file%] equ [] goto usage

set suffix_t=
set suffix_i=

if [%recursive%] equ [1] (
    set suffix_t=/d y /r
    set suffix_i=/T
)

if [%skip_symlinks%] equ [1] (
    set suffix_t=%suffix_t% /SKIPSL
    set suffix_i=%suffix_i% /L
)

if [%quiet%] equ [1] (
    set suffix_t=%suffix_t% ^>nul 2^>^&1
    set suffix_i=%suffix_i% ^>nul 2^>^&1
)

goto process

:process
@takeown /f %file% /a %suffix_t%
@takeown /f %file% %suffix_t%
@icacls %file% /grant Administrators:(F,MA) /c %suffix_i%
@icacls %file% /grant Users:(F,MA) /c %suffix_i%
@icacls %file% /grant SYSTEM:(F,MA) /c %suffix_i%
@icacls %file% /grant "LOCAL SERVICE":(F,MA) /c %suffix_i%
@icacls %file% /grant "NETWORK SERVICE":(F,MA) /c %suffix_i%
@icacls %file% /grant "RESTRICTED":(F,MA) /c %suffix_i%
@icacls %file% /grant "ALL APPLICATION PACKAGES":(F,MA) /c %suffix_i%
@icacls %file% /grant "ALL RESTRICTED APPLICATION PACKAGES":(F,MA) /c %suffix_i%
@icacls %file% /grant TrustedInstaller:(F,MA) /c %suffix_i%
@icacls %file% /setintegritylevel L /c %suffix_i%
@icacls %file% /inheritance:r /c %suffix_i%
@icacls %file% /inheritance:d /c %suffix_i%
@icacls %file% /setowner "%username%" /c %suffix_i%
@icacls %file% /grant "%username%":(F,MA) /c %suffix_i%
goto exit

:usage
echo.ownfile ^<file^> ^<recursive^> ^<skip symlinks^> ^<quiet^>
goto exit

:exit
exit /B 0

If the script is outdated you may find the latest changes here.

I don't know how good of an idea this is but it works for me.