Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My company has been utilizing the subinacl tool to fix SIDs that change unexpectedly. We are now switching over to Windows 7 and the subinacl tool is no longer utilized. I am trying to find the code equivalents of the subinacl functions for Icacls and so far the only one I have been unable to find has been /replace. The /substitute function seems similar but I can't tell if it is exactly what I need.

Does anyone know if the /substitute function in Icacls has the same functionality as /replace? If not, do you know what I can use to change the name of every instance of an SID to another?

share|improve this question
up vote 5 down vote accepted

The end result of substitute is the same as replace, but it works a bit differently. You can't just do:

icacls . /substitute oldsid newsid

Substitute is not a command on its own.

Instead, you need to save the acls for the file, then restore them using the subsitute param. As an example, this will save the acls for all the files in the current directory, then restore while replacing the sid:

icacls * /save acls.bak
icacls . /substitute oldsid newsid /restore acls.bak

Here is an article that walks you through the process.

share|improve this answer
Thank you very much. That helps me out greatly. – RedPheonix Feb 11 '10 at 18:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.