Reset the Permissions on a User Profile Folder

An access denied on your own Documents folder is the symptom. Reading the ACL shows whether the owner entry is missing or explicitly denied.

icacls "C:\Users\bob"
(Get-Acl 'C:\Users\bob').Access | Select-Object IdentityReference,FileSystemRights,AccessControlType,IsInherited
Get-Acl 'C:\Users\bob' | Select-Object Owner

The affected profile cannot repair itself while it is loaded. Sign in as a second admin so the files are not locked by the current session.

whoami
Get-LocalGroupMember -Group Administrators | Select-Object Name
Get-Process explorer | Select-Object Id,SessionId

**takeown** grants the administrator the right to change permissions. Without it, icacls fails on files owned by a deleted SID.

takeown /F "C:\Users\bob" /R /A /D Y
takeown /F "C:\Users\bob\Documents" /R /A /D Y
icacls "C:\Users\bob" | Select-Object -First 10

**/reset** replaces explicit entries with inherited ones from the parent folder. **/T** applies it to the tree, **/C** continues past errors such as files in use.

icacls "C:\Users\bob" /reset /T /C /Q
icacls "C:\Users\bob\Documents" /reset /T /C /Q
icacls "C:\Users\bob"

The profile folder belongs to the user, not to Administrators. Setting the owner back is the last step, and it decides whether the profile loads normally.

icacls "C:\Users\bob" /setowner "PC01\bob" /T /C /Q
icacls "C:\Users\bob" /grant "PC01\bob:(OI)(CI)F" /T /C /Q
Get-Acl 'C:\Users\bob' | Select-Object Owner
Get-CimInstance Win32_UserProfile | Select-Object LocalPath,SID,Loaded

Sign in as the affected user and open the usual folders. A prompt to create a temporary profile means the profile entry itself is broken, which is a different repair.

Get-WinEvent -LogName Application -MaxEvents 50 | Where-Object ProviderName -match 'User Profile Service' | Select-Object TimeCreated,Id,Message -First 3
Get-ChildItem "C:\Users\bob\Documents" -ErrorAction SilentlyContinue | Select-Object -First 5 Name