Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am on Windows Server 2008.

I'm trying to set deny permissions for a certain user on the Windows folder with the following command:

    cacls Windows /E /D sneakyUser

I get the error message "Access is denied." I'm running Command Prompt as Administrator.

I also tried ICACLS -- no luck.

    icacls Windows /deny sneakyUser:f

These commands work on individual files within the Windows folder, but not on the folder itself. Is this behavior by design, or am I doing something wrong?

Edit: Interestingly enough, the command works fine in Windows Server 2003.

share|improve this question
what about using the GUI method? – mdpc Apr 27 '12 at 20:31
@mdpc - I'm scared to use it because it automatically applies permissions to subfolders. – anonymous Apr 27 '12 at 20:33
use the "Advanced" dialog. In there, you can specify whether the permissions apply to "This folder, subfolders, and files", or "Subfolders and files only". – pepoluan Apr 28 '12 at 2:45

Access to a lot of stuff in the Windows folder is restricted to the TrustedInstaller account. This is by design.

share|improve this answer
So there's no way to change the permissions? In my example, "sneakyUser" is actually one of the anonymous IUSR accounts. I'm trying to protect system files from being read by untrusted code. – anonymous Apr 27 '12 at 21:06

If you have UAC still enabled, log in as the Local Admin (non-domain account) to see if it works. Running as Administrator may not be enough, even thought it should be.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.