Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using icacls to set permissions on a large number of directories for various groups. I want to assign what icacls help refers to as "modify access". It seems to do this correctly. However when the rights are viewed with Windows Explorer permissions tab on Windows 2008 the group shows up with no rights at all (no check boxes checked in the "Allow" column). One must click "Advanced -> Change Permissions -> Edit" to actually see that the group has been granted all permissions except "Full", "Delete Subfolders and Files", "Change Permissions" and "Take Ownership".

Now, from a purely functional point of view this is acceptable. The group has the desired rights. However, from an administrative point of view this could be confusing to someone further down the road when they see the group in the list on the first screen of the permissions tab but no rights appear to be assigned until you look at advanced permissions.

So my question is: Is there some way with icacls to assign the Modify right in such a way that it shows up on the first screen of the security tab as being so? In other words, with check marks in the allow column for "Modify", "Read & Excecute", "List folder contents", "Read" and "Write"?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

What is the command line you are using to assign the permissions?

Try this one:

icacls <directory> /grant <user>:(CI)(OI)(M)
share|improve this answer
    
Oops! I meant to include the command. Unfortunately I closed the cmd.exe window and don't have it anymore but it was more or less icacls <directory> /t /grant user:m –  John Fitzpatrick Jun 19 '12 at 15:38
    
Brilliant! It worked. So the inheritance flags are required for Windows Explorer to consider it a "non-special" privilege? –  John Fitzpatrick Jun 19 '12 at 15:42
    
there's a syntax error in the example. It should be a space, not a colon, after /grant. –  matt wilkie Oct 10 '13 at 22:09
    
@mattwilkie you are correct. Updated the answer –  Rex Oct 10 '13 at 22:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.