Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Using Windows Server 2012 R2 AND Windows Server 2008 R2.

I have a folder called C:\temp\test and I want to grant access to SYSTEM and a user and all files and subdirectories, and remove everthing else. I've tried this command but all the existing permissions remain:

Existing permissions are:

Access : NT AUTHORITY\SYSTEM Allow  FullControl
         BUILTIN\Administrators Allow  FullControl
         BUILTIN\Users Allow  ReadAndExecute, Synchronize
         BUILTIN\Users Allow  AppendData
         BUILTIN\Users Allow  CreateFiles
         CREATOR OWNER Allow  268435456

I want to remove all ACLs except SYSTEM, and add <DOMAIN>\<USER>

I tried this command:

icacls c:\temp\test /grant:r <DOMAIN>\<USER>:(OI)(CI)F /t

processed file: c:\temp\test
Successfully processed 1 files; Failed processing 0 files

When I look at the permissions afterwards, the <DOMAIN>\<USER> has the correct permissions but all the others remain. I thought /grant:r replaced all the permissions? Do you know what command I need to run to remove all the other permissions?

share|improve this question
This command does exactly what I want cacls c:\temp\test /t /g <DOMAIN>\<USER>:F but I've heard that icacls has superseded it, can someone show me the equivalent icacls version to produce the same behaviour? – Mark Allison Feb 25 '14 at 13:45
/grant:r only removes existing explicit permissions, not inherited ones from the folder above. You'd need to include /inheritance:r as well. – TheCleaner Feb 25 '14 at 14:35
If CACLS does the job then there's no reason you can't use it, whether it's been deprecated or not. – joeqwerty Feb 25 '14 at 15:25
@joeqwerty true but it feels so dirty. cacls itself even returns a message to use icacls, so there must be a very good reason. NOTE: Cacls is now deprecated, please use Icacls. – Mark Allison Feb 25 '14 at 16:26
@joeqwerty cacls.exe can set the ACL's in the wrong order, potentially causing problems (I'll leave this as an exercise for the reader). – Craig Sep 25 '15 at 7:59
up vote 11 down vote accepted

As mentionned is comments, you also have to use the /inheritance:r switch to remove inherited permissions.

/grant:r only removes explicit permissions.

icacls c:\temp\test /inheritance:r /grant:r <DOMAIN>\<USER>:(OI)(CI)F /T

To also grant SYSTEM :

icacls c:\temp\test /inheritance:r /grant:r <DOMAIN>\<USER>:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F /T
share|improve this answer

/grant:r didn't worked for me. I have to use /reset to revert permission to inherintance only and then remove inherited permissions. Don't forget to change subdirectories with /t flag.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.