Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

During a beta test, a customer installed some software of ours which accidentally modified the permissions of the All Users/Application Data folder on about 500 computers. They deployed the software using Altiris. The permissions got changed and began causing issues for applications like antivirus software which wanted to write data to that folder.

The permission change was not recursive. As a test we created a version of the software they could install as a patch which gave the "everyone" user full control. This resolved the issues with antivirus software but now the permissions are insecure.

In my MSI tool creator (Advanced Installer) I can get really close to replicating the default windows settings with the exception being the entry indicated by the green arrow below.

alt text

Any advice from the system admins on how they would go about resetting the permissions? The customer can use the Altiris management software to execute a utility of sorts if someone knows of one.

share|improve this question
Out of curiosity .. how come the developers who wrote the bad installer aren't being tasked with writing a program to fix their error? – tomjedrz Oct 9 '09 at 3:23
@tomjedrz -- We are the developers and we are taking full responsibility hence why i'm asking System Admin's for advice. – blak3r Oct 9 '09 at 14:26
I actually shuddered out loud when I read the title of this post... – BenGC Aug 9 '11 at 2:24
up vote 2 down vote accepted

Try xcacls.vbs ( It is a free VBScript command-line utility from Microsoft that is similar to the cacls command, but with more options. It has the ability to apply more fine-grained permissions than cacls, but read the instructions (displayed by typing the command without any options: cscript xcacls.vbs) carefully; they are quite complex! It does have the ability to apply permissions only onto "This folder and subfolders"; I've used it before to do exactly that.

If you are running Windows Vista or later, the included icacls utility ( might be more appropriate.

Once you have crafted the proper command (using either tool), put it into a *.cmd script, and then add the script to a Group Policy Object in order to apply it to the machines via Group Policy. Note that you will also have to somehow load xcacls.vbs onto every machine if you go that route. This could be accomplished by including a command to download the xcacls.vbs script from a file share and save it locally in the same *.cmd script where your permission-setting command resides (or you could perhaps try running it directly from a file share).

share|improve this answer

You can correct this using a GPO pretty easily.

If they want to use Altiris, then setup a job to use cacls.exe to reset the rights on the folder.

share|improve this answer
cacls.exe is a utility provided by windows for command line permission changes. It is pretty straight-forward to use .. execute it with no arguments to get the help info. – tomjedrz Oct 9 '09 at 1:41
+1 - Using Group Policy for this would be the easiest way to do it. I have never understood why users have "Write" at that folder, BTW. I'm seeing malicious software tucking itself away there, since non-Administrator users can write there. – Evan Anderson Oct 9 '09 at 1:42
I read the docs on cacls.exe and it doesn't appear to be able to "Apply to" only "This folder and subfolders" like is needed. Neat tool though. Could you explain how a GPO would be applied? The permissions weren't changed on every computer across the campus. – blak3r Oct 9 '09 at 2:10
?? cacls /E /R <<user/group>> (or some variant) looks like it will do what you need. – tomjedrz Oct 9 '09 at 3:21
Create or edit a GPO. Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > File System. Create a new object. Give it the path you need to correct and set the permissions correctly. You can apply it to all workstations, as the ones which haven't been screwed up won't have any change made to them as what you set should match what they already have. The users will need to either run gpupdate, reboot there workstations or wait ~28 hours (or whatever the gpo reapply settings are) for the setting to be downloaded. You can filter with WMI to apply to a subset. – mrdenny Oct 9 '09 at 5:01

Here is the resulting code based on Jay Michaud's suggestion.

I ended up adding a custom action to my installer. That ran after files were copied over. If you do that you'll want this code below and you'll want to pipe in as arguments: APPDIR|CommonAppDataFolder. (yes that's a pipe delimiting them)


' SET XCACLS_EXEC and APPDATAFOLDER variables some other way.
actdata = Session.Property("CustomActionData")
tokens = Split( actdata, "|", -1)
XCACLS_EXEC = tokens(0) & "XCACLS.vbs"

WindowStyle=0 '0 for hide, 1 for show.
set objShell = CreateObject("WScript.Shell")

'MsgBox  XCACLS_EXEC & " " & APPDATAFOLDER & " " & Session.Property("CustomActionData")

objShell.Run "cscript """ & XCACLS_EXEC & """ """ & APPDATAFOLDER & """ /SPEC C /G users:W", WindowStyle, True
objShell.Run "cscript """ & XCACLS_EXEC & """ """ & APPDATAFOLDER & """ /E /G users:X", WindowStyle, True
objShell.Run "cscript """ & XCACLS_EXEC & """ """ & APPDATAFOLDER & """ /E /G ""Power Users"":M", WindowStyle, True
objShell.Run "cscript """ & XCACLS_EXEC & """ """ & APPDATAFOLDER & """ /E /G ""CREATOR OWNER"":F", WindowStyle, True
objShell.Run "cscript """ & XCACLS_EXEC & """ """ & APPDATAFOLDER & """ /E /G Administrators:F", WindowStyle, True
objShell.Run "cscript """ & XCACLS_EXEC & """ """ & APPDATAFOLDER & """ /E /G Administrator:F", WindowStyle, True
objShell.Run "cscript """ & XCACLS_EXEC & """ """ & APPDATAFOLDER & """ /E /G SYSTEM:F", WindowStyle, True
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.