On several of our developer workstations, we've been getting the dreaded "This access control list is not in canonical form and therefore cannot be modified." error when we try and set permissions on certain folders. We haven't been able to figure out what is corrupting these ACLs.
Right now, the only way I know to fix it is to right-click the corrupted folder/file, choose Properties and click the Security tab. Windows will then notice the corruption and offer to fix it. I don't like this because it is manual and requires the user to do some investigations to figure out what folder/file is corrupt.
Is there a script or program somewhere that will do this automatically? I see that icacls
has a /verify
parameter, but it just shows me that the ACLs on a file/folder are corrupted. It doesn't offer to fix anything.