Skip to main content

How to Get the File Owner in a Batch Script

Knowing the owner of a file is a crucial task in security auditing, permission troubleshooting, and system administration. The owner of a file is the user account that has ultimate control over it and can change its permissions. While you can see this information in the GUI by right-clicking a file, a script needs a command-line method to retrieve this information.

This guide will teach you the two primary built-in methods for finding a file's owner. We'll start with the classic and simple DIR /Q command, and then cover the modern and more powerful WMIC method, which is often more suitable for scripting.

The Challenge: No Direct "Get-Owner" Command​

There is no single command like GETOWNER file.txt. A script must use a more general-purpose tool that can list file properties and then parse its output to extract the owner's name.

Method 1 (Simple): The DIR /Q Command​

The standard DIR command has a special switch, /Q, that adds an extra column to its output showing the owner of each file and directory.

Command: DIR /Q

The output is a standard DIR listing, but with a new column between the <DIR> marker and the file size, showing the owner.

 Volume in drive C is Windows
 ...
 Directory of C:\Users\Admin\Documents

10/27/2023  09:00 AM    <DIR>          MY-PC\Admin     .
10/27/2023  09:00 AM    <DIR>          MY-PC\Admin     ..
10/26/2023  03:00 PM             1,234 MY-PC\Admin     report.txt
10/25/2023  10:00 AM            56,789 BUILTIN\Administrators system_file.log

This is fast and easy for a human to read, but the variable column positions make it difficult for a batch script to parse reliably.

The WMIC (Windows Management Instrumentation) utility is the definitive tool for querying system objects. It can get the owner of a file, but the process is more complex: it requires a WMIC call to get the owner's SID (Security Identifier), and then a second call to translate that SID into a human-readable username.

While more complex to write, it is more robust for automation.

The WMIC Logic:

  1. Use WMIC GET on a file object to get the Owner property (which is the SID).
  2. Use WMIC USERACCOUNT to look up that SID and get the Name.

However, a simpler (though slightly slower) WMIC method is to call the GetOwner method directly on the file object.

Command: WMIC PATH CIM_LogicalFile WHERE "Name='C:\\Path\\to\\file.txt'" CALL GetOwner

This command returns the owner and the domain in a clean format that is easier to parse than DIR /Q.

Example Script: Capturing the File Owner with DIR /Q​

Despite its parsing challenges, the DIR /Q method is very common due to its simplicity. This script demonstrates how to parse its output to get the owner of a single, specific file.

@ECHO OFF
SET "TargetFile=C:\Windows\System32\kernel32.dll"
SET "FileOwner="

ECHO --- Finding the owner of a file ---
ECHO File: "%TargetFile%"
ECHO.

REM The 'findstr' filters the DIR output to just the line for our file.
REM 'tokens=4' is a best guess for the column where the owner is.
FOR /F "tokens=4" %%O IN ('DIR /Q "%TargetFile%" ^| findstr /I /C:"kernel32.dll"') DO (
    SET "FileOwner=%%O"
)

IF DEFINED FileOwner (
    ECHO The owner is: %FileOwner%
) ELSE (
    ECHO Could not determine the owner.
)
warning

The Flaw: This works for this specific file, but if the date/time format changes, the owner might shift to tokens=5, breaking the script. This is why DIR /Q is brittle.

Common Pitfalls and How to Solve Them​

  • Parsing DIR /Q is Unreliable: As mentioned, the number of tokens (columns) before the owner can change based on whether it's a file or a directory, and the date/time format.

    • Solution: The WMIC method is the only truly robust solution for parsing, even though it is more complex to write. For simple, quick checks where the format is known, DIR /Q is acceptable.

  • Administrator Rights: A standard user can usually see the owner of files they have read access to. However, to query the owner of system files or files in other user profiles, you must run the script as an Administrator.

  • SID vs. Name: WMIC often works with SIDs. While it can translate them, be aware that the underlying owner information is the SID. If you are on a machine that cannot contact a domain controller, a domain user's SID might not be resolved to a friendly name.

Practical Example: A File Ownership Report Script (WMIC Method)​

This script uses the more robust WMIC method to iterate through all .exe files in a folder and generate a report of their owners. This is a common security audit task.

@ECHO OFF
SETLOCAL ENABLEDELAYEDEXPANSION
SET "TargetFolder=C:\Windows"
SET "ReportFile=Ownership_Report.csv"

ECHO --- Generating File Ownership Report ---
ECHO This may take a few moments...
ECHO.
ECHO "File Name","Owner" > "%ReportFile%"

FOR %%F IN ("%TargetFolder%\*.exe") DO (
    SET "Owner=Unknown"
    
    REM WMIC paths require double backslashes
    SET "WmicPath=%%~fF"
    SET "WmicPath=!WmicPath:\=\\!"
    
    REM Use WMIC to get the owner for each file
    FOR /F "tokens=1,2 delims==," %%A IN (
        'WMIC PATH CIM_LogicalFile WHERE "Name='!WmicPath!'" GET Owner /VALUE'
    ) DO (
        FOR /F "tokens=*" %%O IN ("%%B") DO SET "Owner=%%O"
    )
    
    ECHO "%%~nxF","!Owner!" >> "%ReportFile%"
)

ECHO [SUCCESS] Report generated: %ReportFile%
ENDLOCAL
note

This WMIC approach gets the owner's DOMAIN\User format directly and is much more reliable than parsing DIR /Q in a loop.

Conclusion​

Knowing a file's owner is key for security and permission management.

  • The DIR /Q command is the quickest and easiest method for a human to visually inspect a file's owner. However, it is not reliable for parsing in a script.
  • The WMIC command is the powerful, robust, and recommended method for any automation script. While more complex, it provides structured data that can be parsed reliably.
  • Always run your script as an Administrator for the most accurate and complete ownership information across the entire file system.

Table of Contents