Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Setting ACLs on Windows Server 2008 via the command line is giving me some problems. As per I've tried all sorts of variations:

C:\Windows\system32>icacls "D:\Websites\\Web\bin*" /grant 'NT A uthority\NETWORK SERVICE: (OI) (CI)M'

C:\Windows\system32>icacls "D:\Websites\\Web\bin*" /grant "NETWORK SERVICE": (OI) (CI)M

And all variations in between. However, each try leads to i.e. "Invalid parameter "'NETWORK'"" depending on the variation above.

As per (see in comments), it appears that others have experienced the same issue where the same command works on Windows 7/Vista/etc., but not on Windows Server 2008.

What's the best way to apply permissions to Network Service account on a directory and/or files via the command line in Windows Server 2008? Especially as there's no way to do multiple file permissions at once via the GUI (see

share|improve this question
up vote 1 down vote accepted

This line worked for me:

icacls testdir /grant "NT AUTHORITY\NetworkService":(OI)(M)


icacls testdir /grant "NT AUTHORITY\NetworkService":(CI)(M)

Update: And this too:

icacls testdir /grant "NT AUTHORITY\NetworkService":(OI)(CI)(M)
share|improve this answer
Igal: thx for the quick response. Turns out NetworkService (vs. Network Service - just like cacls) does the trick. However, although "Successfully processed" there's no change to the directory/file ACLs?!? Am I missing something obvious here? Did with another user and still no dice. – Ted Sep 22 '09 at 20:36
Of course, I'm running in an elevated cmd prompt. – Ted Sep 22 '09 at 20:41
Will mark your answer as correct and make a new question regarding how the cmd "successfully processes", but doesn't in fact make any changes. – Ted Sep 22 '09 at 21:16

You need to add OI and CI to effect the change to folder permission settings.

Example setting Modify permission to test folder for Network Service account:

icacls C:\Test /grant "NT AUTHORITY\NetworkService":(OI)(CI)(M)
share|improve this answer

You can use the sid for network service like so:

icacls testdir /grant *S-1-5-20:(OI)(M)
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.