Get-ChildItem : Access denied

The “Get-ChildItem : Access denied” error occurs when your user account lacks permission to enumerate the targeted files or system directories.

What It Means

Get-ChildItem recursively traverses the filesystem, attempting to read every directory and file. When it encounters a directory whose security descriptor denies your user the Read or List permission, .NET throws an UnauthorizedAccessException. This is especially common when scanning system directories like C:\Windows\System32\config, C:\ProgramData, or C:\Users\*\AppData — some subdirectories are protected even from administrators.

Why It Happens

• Your user account lacks read or list permissions on the target directory.
• The directory is owned by SYSTEM or TrustedInstaller and is not accessible.
• A child directory inherits restricted permissions from a parent.
• The file or directory is encrypted with EFS and you are not the encrypting user.
• Antivirus software intercepts file system access and blocks enumeration.
• You are accessing a network share where the remote permissions are insufficient.
• The directory is a reparse point (junction, symlink) pointing to a protected location.

How to Fix It

1. Use -ErrorAction SilentlyContinue to skip inaccessible paths

# Skip directories you cannot access
Get-ChildItem -Path "C:\" -Recurse -ErrorAction SilentlyContinue

2. Run PowerShell as Administrator

# Right-click PowerShell and select "Run as administrator"
# Or start a new admin session
Start-Process powershell -Verb RunAs

3. Exclude known system directories

# Skip protected directories explicitly
Get-ChildItem -Path "C:\Windows" -Recurse -ErrorAction SilentlyContinue |
    Where-Object { $_.FullName -notmatch "\\System32\\config|\\WinSxS" }

4. Target only specific directories

# Instead of scanning the entire drive, scan known-accessible paths
$targets = @(
    "C:\Users\$env:USERNAME\Documents",
    "C:\Program Files\MyApp",
    "D:\Data"
)

$targets | ForEach-Object {
    Get-ChildItem -Path $_ -Recurse -ErrorAction SilentlyContinue
}

5. Check and modify directory permissions

# Check current ACL
Get-Acl -Path "C:\RestrictedFolder" | Format-List

# Grant read access (requires admin)
$acl = Get-Acl "C:\RestrictedFolder"
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
    "$env:USERNAME", "Read", "ContainerInherit,ObjectInherit",
    "None", "Allow"
)
$acl.SetAccessRule($rule)
Set-Acl -Path "C:\RestrictedFolder" -AclObject $acl

6. Use -Depth to limit recursion depth

# Only go one level deep
Get-ChildItem -Path "C:\Users" -Depth 1