# Error applying security: failed to enumerate objects in the container > Source: https://netray.co/erp-help/error-applying-security-failed-to-enumerate-objects-in-container > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: ERP Help ## Short answer This Windows error means you tried to change permissions on a folder and Windows could not read everything inside it. It is almost always caused by missing ownership or permissions on a child item, so take ownership of the folder tree as an administrator and then reapply permissions. It shows up in SyteLine and Mongoose installs when app folders, IIS content or share folders were created by another account. ## Kind error ## System syteline ## Erp Windows Server (Infor SyteLine / CSI installs) ## Module Windows file permissions / install ## Query error applying security failed to enumerate ## Alternate Queries - error applying security information failed to enumerate objects in the container - failed to enumerate objects in the container access is denied - syteline folder permissions error applying security ## Applies To Windows Server 2016 to 2022 and Windows 10/11. Applies to any folder, including Infor SyteLine, Mongoose, IIS and report folders. ## Steps ### Fix the error **Items:** - Open an elevated prompt (Run as administrator). Do this even if you are a member of the Administrators group. - Take ownership of the tree: takeown /f "D:\path\to\folder" /r /d y - Grant the Administrators group full control: icacls "D:\path\to\folder" /grant Administrators:(OI)(CI)F /t - Retry the change in Properties > Security > Advanced, or apply the permission you need with icacls instead of the UI. - If it still fails, find a single bad item: run icacls on subfolders one by one, or check for paths longer than 260 characters. - Stop services or IIS app pools that hold files open (for example the application pool of the SyteLine web client) and retry. - Check antivirus or backup agents that lock files or deny access, and exclude the folder temporarily if your policy allows. - Reset the inheritance and ACL cleanly if the tree is broken: icacls "D:\path" /reset /t /c ## Sections ### What the message really says **Body:** The full text is usually 'Error applying security. An error occurred while applying security information to: path. Failed to enumerate objects in the container. Access is denied.' Windows is trying to apply a permission change to a folder and all children, and it cannot list a folder it has no right to read. So the fix is about rights on the offending subfolder, not about the folder you right-clicked. Ownership is the key, because an owner can always rewrite the ACL. ### Why it happens in ERP environments **Body:** ERP servers accumulate folders created by installers, service accounts, former administrators and domain accounts that no longer exist. Restoring from backup, moving folders between servers and copying install media all produce items with orphaned owners. In SyteLine environments you see it on IIS content folders, report output and attachment shares, and the Mongoose or application folder when changing the service account that runs it. **Code:** takeown /f "D:\Infor\Sample" /r /d y icacls "D:\Infor\Sample" /grant Administrators:(OI)(CI)F /t /c icacls "D:\Infor\Sample" /grant "DOMAIN\svc-app":(OI)(CI)M /t /c ### Special cases **Body:** Network shares: you need the share permission and the NTFS permission. If the share is on a NAS, make the change on the NAS or as the right account, because the Windows UI cannot always edit it. Long paths and reserved names can also block enumeration. Shorten the path or use the extended path prefix. Mounted volumes, junction points and system-protected folders such as System Volume Information should not be edited this way. ### Do not just disable security **Body:** - A common shortcut is to grant Everyone full control. That fixes the error and creates an audit finding, especially for ERP data and attachment folders that hold financial or export-controlled documents. - Use a named service account with the minimum rights the application documents, and keep the change in your change log. ## Pitfalls - Using the Properties dialog from a non-elevated session and getting the same error again. - Granting Everyone full control as a quick fix on an ERP or document folder. - Recursing over a share root or system folder instead of the application folder. - Forgetting to restart the service or app pool after changing its account permissions. - Ignoring antivirus or backup agents that hold locks on the files. ## Ai Angle A private, on-prem assistant can walk an administrator through this on the actual server without any file path or folder name leaving the network. It can read the icacls output you paste, spot the orphaned owner and draft the exact commands. Execution stays with the administrator. ## Faq ### What does 'failed to enumerate objects in the container' mean? **Answer:** Windows could not list the contents of a folder when applying permissions to it and its children. Usually the account running the change lacks rights on a subfolder or an item has an orphaned owner. ### Why do I get it even as administrator? **Answer:** Your session may not be elevated, or the item has an owner and ACL that exclude Administrators. Run an elevated prompt and use takeown first, then icacls. ### Is it safe to run takeown on an application folder? **Answer:** Generally yes for application and data folders you administer, since it only changes ownership. Do not run it on system folders, and note it in your change log. ### Does this error come from SyteLine itself? **Answer:** No. It is a Windows permissions error. It appears around SyteLine installs because of the folders, services and IIS content they use. ## Search terms error applying security, failed to enumerate objects in the container, access is denied takeown icacls, windows folder permissions error, syteline install permissions, iis folder permissions, error applying security information --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json