Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Setting ACLs on Windows Server 2008 via the command line is giving me some problems. As per http://web2.minasi.com/forum/topic.asp?TOPIC%5FID=26907 I've tried all sorts of variations:

C:\Windows\system32>icacls "D:\Websites\site.com\Web\bin*" /grant 'NT A uthority\NETWORK SERVICE: (OI) (CI)M'

C:\Windows\system32>icacls "D:\Websites\site.com\Web\bin*" /grant "NETWORK SERVICE": (OI) (CI)M

And all variations in between. However, each try leads to i.e. "Invalid parameter "'NETWORK'"" depending on the variation above.

As per http://technet.microsoft.com/en-us/library/cc753525%28WS.10%29.aspx (see in comments), it appears that others have experienced the same issue where the same command works on Windows 7/Vista/etc., but not on Windows Server 2008.

What's the best way to apply permissions to Network Service account on a directory and/or files via the command line in Windows Server 2008? Especially as there's no way to do multiple file permissions at once via the GUI (see http://serverfault.com/questions/30991/windows-server-2008-change-security-settings-for-multiple-files-at-once).

share|improve this question

3 Answers 3

up vote 1 down vote accepted

This line worked for me:

icacls testdir /grant "NT AUTHORITY\NetworkService":(OI)(M)

and

icacls testdir /grant "NT AUTHORITY\NetworkService":(CI)(M)

Update: And this too:

icacls testdir /grant "NT AUTHORITY\NetworkService":(OI)(CI)(M)
share|improve this answer
    
Igal: thx for the quick response. Turns out NetworkService (vs. Network Service - just like cacls) does the trick. However, although "Successfully processed" there's no change to the directory/file ACLs?!? Am I missing something obvious here? Did with another user and still no dice. –  Ted Sep 22 '09 at 20:36
    
Of course, I'm running in an elevated cmd prompt. –  Ted Sep 22 '09 at 20:41
    
Will mark your answer as correct and make a new question regarding how the cmd "successfully processes", but doesn't in fact make any changes. –  Ted Sep 22 '09 at 21:16

You need to add OI and CI to effect the change to folder permission settings.

Example setting Modify permission to test folder for Network Service account:

icacls C:\Test /grant "NT AUTHORITY\NetworkService":(OI)(CI)(M)
share|improve this answer

You can use the sid for network service like so:

icacls testdir /grant *S-1-5-20:(OI)(M)
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.