Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

icacls in windows 7 does not give full permission to write files in root drive.

We have a very old application based on Omnis7 that needs to create and read/write files on drive C: when running as a restricted user. In Windows XP to give this permission is quite trivial using cacls.

cacls C:\ /G Everyone:(C)

The equivalent icacls in Windows 7 will not work.

icacls C:\ /Grant Everyone:(M)

I have also tried the following.

icacls C:\ /Grant Everyone:(F)
icacls C:\ /Grant Domain\user:(F)

trying to create file with a restricted user gives this

C:\>copy nul text.txt
Access is denied.
0 file(s) copied.

After applying the icacls permissions above the result changes to this.

C:\>copy nul text.txt
A required privilege is not held by the client.
    0 file(s) copied.

Is this an issue with the way I am applying the permissions? Or is Window 7 being extremely strict?

share|improve this question
Have you disabled UAC on the Windows 7 machine? – Driftpeasant Nov 28 '11 at 22:26
The person is running as a restricted account, I have no intention of turning off UAC. I want to avoid things like giving the user admin rights. Minimum access to create/read/write some text files in c: is all the application needs. – Menuta Nov 29 '11 at 3:15
Also in case anyone mentions running the app from a scheduled task that has admin rights. This does not work as the app will not run in the foreground unless it is currently logged in user. – Menuta Nov 29 '11 at 3:17
I think that avoiding those rights will be difficult. The reason I ask about UAC is that a lot of Windows 7 actions require UAC confirmation regardless of permission set. So though you may not want to turn off UAC, it may be the only way to run the app short of giving the user admin rights. I'd give it a shot in test, at least. – Driftpeasant Nov 29 '11 at 4:00

If it's the users writing to the C:\ drive...

icacls.exe C:\ [Users or group...]:(M,RX,W)

Be aware it will let them write anything to the root of C:\ though.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.