Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We just upgraded our domain to Windows 2008. I was hoping there is a way to give modify rights to all files/folders on the file server to a group. I know that the administrators group (domain admins, etc)has full access everywhere, but i do not want this group to be able to change security settings. Is there any way to accomplish this?

We would like to create a group, and give this group the ability to modify all files/folders on the network (all folders on the network have different security permissions) without giving placing them in any admin group.


share|improve this question

There's no "shortcut" way to do what you're looking for. You're going to locate all the roots of permission inheritance in your various folder hierarchies and apply the "New Group / Change" permission to those hierarchies.

I suppose somebody could write something to seek out all folders where inheritance is blocked and automatically apply this permission change but I'm not aware of any such tool off the top of my head.


The script below will (in a very simplistic way, and probably not 100% reliably) locate the top of permission hierarchies using the icacls tool. Specify the starting directory on the command-line.

(The script is just looking for DACLs on files that have the SE_DACL_PROTECTED flag set, per

@echo off
if "%~1"=="" goto end


for /D %%i in ("%~1\*") do (
 icacls "%%i" /save %TEMPFILE% >NUL 2>NUL
 find "D:P" %TEMPFILE% >NUL 2>NUL
 if errorlevel 1 del %TEMPFILE%
 if exist %TEMPFILE% echo Top of permission hierarchy: %%i
 if exist %TEMPFILE% del %TEMPFILE%
 call "%0" "%%i"


You could easily add a condition to alter the permissions on the directories you find or just output the list to a file then iterate over the file.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.