Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a file server role utilizing an Active Directory Domain on Windows Server 2012 and I'm attempting to replace one User Object with another User Object across all existing file server share ACLs.

Essentially user A departed from the company and user B is to take over their responsibilities while maintaining their previous ACLs. User A was a department manager so had Ownership on multiple directories and was manually added to several other department directories for different projects.

Is there a way to replace user A with user B while maintaining user B's ACL's?

share|improve this question
up vote 7 down vote accepted

You can script this with icacls or set-acl.

As an aside, this is why you use security groups in ACLs and not individual users.

share|improve this answer
I was hoping with WS-2012 I could avoid having to script anything in powershell. I agree using domain groups unless denying permission for a specific user is best practice. I am not able to control other users who explicitly define a user as opposed to a group when defining permissions, despite being informed to use groups. For this specific issue the domain groups user B is being added to does not have Full Control, but does have read/write. – fyrye Jun 20 '14 at 14:16
Don't avoid scripting. Embrace it. Sysadmins that can't script or write code will be jobless dinosaurs or at the bottom rung of the industry shortly if they aren't already. – MDMarra Jun 20 '14 at 14:18
Sorry poor wording I am capable, I didn't mean avoid scripting all together. Though I am happy that this will provide a bit of job security rather than allowing my superiors to be able to do it using an MMC snap-in interface via remote server admin tools. Thanks :) – fyrye Jun 20 '14 at 14:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.