Fix Windows boot — bootrec /fixboot "Access Denied"

Windows CMD Recovery

Fix Windows boot — bootrec /fixboot "Access Denied"

Complete solution for the "Access denied" error when running bootrec /fixboot on UEFI/GPT systems. Rebuilds the EFI partition and boot files (BCD) from a Windows 10 / 11 installation USB or recovery environment.

SystemsWindows 10 / 11 (UEFI/GPT)

RequiresInstall USB / WinRE

Time10 – 20 min

RiskLow — no data loss

Step 0 — Boot from a Windows installation USB On the "Install now" screen → Repair your computer → Troubleshoot → Command Prompt. You can also press Shift + F10 on any installer screen to open CMD directly.

Step 1 — Identify the EFI partition with diskpart

Enter diskpart

diskpart

List disks — identify the disk holding Windows (usually 0)

list disk

Select the system disk

select disk 0

List partitions — the EFI one is FAT32, ~100 MB, type "System"

list partition

Step 2 — Assign a letter to the EFI partition

Select the EFI partition — replace N with the System partition number

select partition N

Assign letter Z: (any unused letter)

assign letter=Z

Exit diskpart

exit

Step 3 — Format the EFI partition

Quick-format Z: as FAT32 — this resolves the "Access denied" error

format Z: /FS:FAT32 /Q

Step 4 — Rebuild boot files with bcdboot

First confirm the actual Windows drive letter (it can be C:, D: or E: in WinRE)

dir C:\Windows

Recreate the BCD and UEFI boot files on Z:

bcdboot C:\Windows /s Z: /f UEFI

Expected output: "Boot files successfully created"

Step 5 — Complementary bootrec commands

Rewrite the MBR (does not affect pure-GPT disks)

bootrec /fixmbr

Scan for Windows installations

bootrec /scanos

Rebuild the BCD store

bootrec /rebuildbcd

Step 5b — bootsect alternative (MBR / Legacy BIOS systems)

Rewrites the boot sector code compatible with BOOTMGR. Useful when bootrec /fixboot fails with "Access denied" on MBR disks. Apply to the active system partition

bootsect /nt60 SYS

Apply to all partitions (full scan)

bootsect /nt60 ALL /force /mbr

Apply to a specific drive — replace C: with the correct letter

bootsect /nt60 C:

On UEFI/GPT systems bootsect does not apply — use Step 4 (bcdboot), which serves the same purpose.

Step 6 — Reboot and remove the USB

exit

Choose Continue → Exit and continue to Windows. Pull the USB out before the next boot.

If the machine still won't boot

• In BIOS/UEFI, make sure the boot order points to the correct disk and that Secure Boot is enabled.
• If the disk is MBR but the firmware is pure UEFI, convert it with MBR2GPT (see the card in this KB).
• If bcdboot fails with "BFSVC Error", the EFI partition may be corrupted — repeat Steps 2 and 3.

Back up your data first — always run from WinRE/USB

Microsoft Docs