To access an administrator account and regain control of file permissions on Windows 11, use one of these approaches depending on what is available on the PC.
- Check if the current account is already an administrator
- Go to Start > Settings > Accounts.
- Under Your info, check whether the account is listed as Administrator.
- If it is an administrator but actions are blocked with messages like “your organisation forbids it,” the device may be joined to a work/school organization or managed by a client’s Microsoft 365 tenant. In that case, the organization’s admin controls those restrictions.
- Sign in with another existing admin account
If another local administrator account exists but is not visible on the sign-in screen, it may be disabled.
To enable a built‑in Administrator account (for example, after an upgrade or if it was disabled):
- Open Computer Management:
- In the search box on the taskbar, type computer management, then select Computer Management (Desktop app).
- In the left pane, select Local Users and Groups > Users.
- In the middle pane, look for the user named Administrator:
- If the icon has a down arrow, the account is disabled.
- Double‑click Administrator to open Properties.
- Clear the Account is disabled check box and select Apply.
- Sign out and then sign in again using the Administrator account.
Once signed in as Administrator, file system permissions and security settings can be adjusted, and restrictions on saving files locally can be reviewed.
- If locked out of all admin access on the device
If there is no way to access any administrator account (for example, no admin password is known and no admin account is available), the supported path is to reset the device, which will remove existing accounts and policies and let a new administrator be configured. For local accounts, see the guidance under Reset your PC from the password-reset article.
Note: Resetting the PC can remove apps and data depending on the chosen reset option, so important files should be backed up first if possible.
- When the device is managed by an organization
If the device is joined to a client’s work or school environment and shows messages like “your organisation forbids it,” the organization’s Microsoft 365 or Entra ID administrator controls policies that can block:
- Saving data to certain locations
- Copying data to personal devices
In that case, changes to those restrictions must be requested from the organization’s administrator or IT support. If unsure who that is, contact the client’s internal help desk, IT department, or the person who provided the work account.
References: