Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to reference the "Domain-Admins" group in a batch file. The line in question looks like this:

icacls "test\folder" /grant\Domain-Admins:F

... and works as expected.

But how do I reference the "Domain-Admin" group in general? My german windows server tells me something about "Domänen-Admins", the Italians call ist "Amministratore-Admins" (or whatever) and I dont want to know what the russian Domain Admins call themselves. I did not want to offend any international names, there must just be a solution for a generic adressing of roles. I need a solution for everybody - like Microsoft had in mind (hopefully) when they used SIDs.

I know the SID of the domain admin group looks like S-1-5-21mydomainsid-512, but icacls does not understand S-1-5-21*-512.

How do I use icacls wisely when I need to reference international group names?

share|improve this question

migrated from Feb 28 '13 at 15:17

This question came from our site for professional and enthusiast programmers.

ask yourself first how you ask wisely to an international group of people. And, no, I am not italian. – PA. Feb 28 '13 at 14:43
You are right, I am very sorry. I did not want to offend anyone (especially italians in this case). Again,s orry for this (and thanks PA for pointing this out to me). I do know that different countrys have their own names (for groups here) and I am (very) angry over my own stupidity to 'catch' the SID-concept in icacls. Dou you have an idea about how to handle international names in batch files? (or how to use SID-MAsks correctly in icacls) – bjoster Feb 28 '13 at 14:51
I have a english domain and a dutch client. On this client I can use "mydomain\domain admins" (between quotes and with a space) without any problems. – ZEDA-NL Mar 1 '13 at 8:15

You should be able to grant by SID with icacls. Microsoft documentation even has an example granting permissions by SID.

Is each international locale a different domain/sid? You would need to add the sid or icacls separately for each domain into the batch file.

share|improve this answer
I think the OP may be trying to use a wildcard "*" in the SID? – jscott Feb 28 '13 at 15:36
Yes, wildcards are the thing I need (I think). SIDs with wildcards like S-1-1-0: do work, but not if the wildcard is -in- the SID´, like S-1--0:. The Domain-SID is the middle part of the complete SID (following the documentation), so wildcard do not work here (in icacls). – bjoster Feb 28 '13 at 16:27
Every domain has its very own SID and this script should work in a lot (if not all :-) of them. – bjoster Feb 28 '13 at 16:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.