7

Setting ACLs on Windows Server 2008 via the command line is giving me some problems. As per http://web2.minasi.com/forum/topic.asp?TOPIC_ID=26907 I've tried all sorts of variations:

C:\Windows\system32>icacls "D:\Websites\site.com\Web\bin*" /grant 'NT A uthority\NETWORK SERVICE: (OI) (CI)M'

C:\Windows\system32>icacls "D:\Websites\site.com\Web\bin*" /grant "NETWORK SERVICE": (OI) (CI)M

And all variations in between. However, each try leads to i.e. "Invalid parameter "'NETWORK'"" depending on the variation above.

As per http://technet.microsoft.com/en-us/library/cc753525%28WS.10%29.aspx (see in comments), it appears that others have experienced the same issue where the same command works on Windows 7/Vista/etc., but not on Windows Server 2008.

What's the best way to apply permissions to Network Service account on a directory and/or files via the command line in Windows Server 2008? Especially as there's no way to do multiple file permissions at once via the GUI (see Windows Server 2008 - change security settings for multiple files at once).

4 Answers 4

7

This line worked for me:

icacls testdir /grant "NT AUTHORITY\NetworkService":(OI)(M)

and

icacls testdir /grant "NT AUTHORITY\NetworkService":(CI)(M)

Update: And this too:

icacls testdir /grant "NT AUTHORITY\NetworkService":(OI)(CI)(M)
4
  • Igal: thx for the quick response. Turns out NetworkService (vs. Network Service - just like cacls) does the trick. However, although "Successfully processed" there's no change to the directory/file ACLs?!? Am I missing something obvious here? Did with another user and still no dice.
    – Ted
    Sep 22, 2009 at 20:36
  • Of course, I'm running in an elevated cmd prompt.
    – Ted
    Sep 22, 2009 at 20:41
  • Will mark your answer as correct and make a new question regarding how the cmd "successfully processes", but doesn't in fact make any changes.
    – Ted
    Sep 22, 2009 at 21:16
  • This didn't work on Win Server 2008 for me. I had to add space in "NetworkService" like "NT AUTHORITY\NETWORK SERVICE". Sep 7, 2016 at 14:39
3

You need to add OI and CI to effect the change to folder permission settings.

Example setting Modify permission to test folder for Network Service account:

icacls C:\Test /grant "NT AUTHORITY\NetworkService":(OI)(CI)(M)
2

You can use the sid for network service like so:

icacls testdir /grant *S-1-5-20:(OI)(M)
0

I had to install a private certificate and grant full access to Network User. Here is the script that worked for me.

$certPath = 'C:\Certs\pwd-aks-client_cert.pfx'
$plainPwd = 'MyPwrd1!'
$pwd = ConvertTo-SecureString -String $plainPwd -AsPlainText -Force 


#Install certificate to local machine
$cer = Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\LocalMachine\My\ -Password $pwd

#Get the private key of the uploaded certificate
$rsaCert = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($cer)

$fileName = $rsaCert.key.UniqueName
$path = "$env:ALLUSERSPROFILE\Microsoft\Crypto\Keys\$fileName"

#Grant Full Access permission to Network service user
icacls $path /grant 'NT AUTHORITY\NETWORK SERVICE:F'

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .