Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Very frustrating problem, as the title suggests, I am trying to deny the user from executing the file, although I want to allow them to be able to delete the file

icacls bat.exe /grant *S-1-1-0:(D) /deny *S-1-1-0:(RX,WDAC) 

I have tried a good few combinations, but having no luck :(

Any help would be greatly appreciated

share|improve this question
Anyone? I am really stuck – Ben Jun 15 '11 at 17:54
Only been 15 minutes. Give it some time – Nixphoe Jun 15 '11 at 17:55
@Nixphoe Shall do, very new to these Q&A sites :) – Ben Jun 15 '11 at 17:58
icacls bat.exe /deny *S-1-1-0:(X) – Ben Jun 15 '11 at 18:33

You just need to use /deny and X.


icacls bat.exe /deny *S-1-1-0:(X)

This will allow a user to delete the file but not execute it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.