How to fix Error 1391 on Windows 11

by

Windows 11 Troubleshooting Guide: Error 1391

Why This Error Happens

Error 1391 occurs when the Access Control List (ACL) on a file, folder, or registry key is missing the inheritance flags required to propagate permissions down to child objects. This typically happens after a corrupted permission migration, a failed security descriptor update, or manual editing of ACLs that stripped out the “Inherit” attributes. It can also surface when third-party backup or permission-management tools write raw ACLs that omit the CONTAINER_INHERIT_ACE or OBJECT_INHERIT_ACE flags.

Step-by-Step Resolution Guide

Step 1: Identify the Affected Object

  • Open Event Viewer (eventvwr.msc) and locate the exact file path, folder, or registry key referenced in the Error 1391 log entry.
  • Right-click the object in File Explorer or Registry Editor and select Properties > Security > Advanced to inspect the current ACL.
  • Note whether the “Inherited from” column shows “None” for all entries — this confirms the broken inheritance chain.

Step 2: Reset Permissions Using icacls

  • Open Command Prompt or PowerShell as Administrator.
  • Run the following command to reset the ACL and re-enable inheritance:
  icacls "C:\Path\To\Affected\Folder" /reset /T /C
  • The /T flag applies the reset recursively to all subfolders and files, while /C continues past any access-denied errors instead of halting.
  • For registry-based errors, use regini.exe or manually re-add inheritance via Advanced Security Settings > Enable Inheritance.

Step 3: Rebuild the Security Descriptor

  • If icacls /reset does not resolve it, take ownership first:
  takeown /F "C:\Path\To\Affected\Folder" /R /A
  • Then grant SYSTEM and Administrators full control with inheritance explicitly restored:
  icacls "C:\Path\To\Affected\Folder" /grant SYSTEM:(OI)(CI)F /T
  icacls "C:\Path\To\Affected\Folder" /grant Administrators:(OI)(CI)F /T
  • The (OI) and (CI) flags stand for Object Inherit and Container Inherit, which restore the missing inheritable components.

Step 4: Run System File and Component Checks

  • Execute sfc /scannow to repair any corrupted system files that may be contributing to broken default ACL templates.
  • Follow up with DISM /Online /Cleanup-Image /RestoreHealth to fix underlying Windows image issues affecting security descriptor defaults.

Alternative or Verification Steps

  • Verify the fix by reopening Properties > Security > Advanced on the object — the “Inherited from” column should now show the parent path instead of “None.”
  • If the error persists on a specific folder, use secedit /export /cfg config.cfg to compare the current security policy against a known-good baseline, then reapply the correct template with secedit /configure.