Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Can it be done without downloading subinacl.exe at all?

share|improve this question

migrated from Apr 28 '10 at 18:34

This question came from our site for professional and enthusiast programmers.

2 Answers 2

up vote 1 down vote accepted

Have you looked at icacls.exe and cacls.exe? (both in the System32 folder, at least on Win7)

share|improve this answer
These do NTFS, not shares AFAIK – gbn Apr 28 '10 at 18:01
I've discovered that the "best practice" is to just set the share permissions to "Everyone" (which it is by default), and instead refine the NTFS permissions using cacls.exe. I did not realize NTFS permissions also affect users accessing the share, so this answer gives me exactly what I need. Thank you! – BlueRaja Apr 30 '10 at 15:26

Maybe, on Windows 2003. I haven't tried it...

net share /grant 

Edit, after comment, from a Win 7 x64 machine.

Note the [/GRANT:user,[READ | CHANGE | FULL]]

C:\Users\gbn>net share /?
The syntax of this command is:

          sharename=drive:path [/GRANT:user,[READ | CHANGE | FULL]]
                               [/USERS:number | /UNLIMITED]
                               [/CACHE:Manual | Documents| Programs | BranchCach
e | None]
          sharename [/USERS:number | /UNLIMITED]
                    [/CACHE:Manual | Documents | Programs | BranchCache | None]
          {sharename | devicename | drive:path} /DELETE
          sharename \\computername /DELETE

share|improve this answer
"The /grant option is unknown" – BlueRaja Apr 28 '10 at 18:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.