Questions tagged [icacls]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
17 votes
2 answers
94k views

How to replace permissions and everything inside with icacls on Windows Server 2012?

Using Windows Server 2012 R2 AND Windows Server 2008 R2. I have a folder called C:\temp\test and I want to grant access to SYSTEM and a user and all files and subdirectories, and remove everthing ...
Mark Allison's user avatar
  • 2,198
12 votes
1 answer
12k views

NTFS ACL's: What is the difference between object and container inhertiance?

I am looking at using icacls.exe. However, before proceeding, I wanted clarification on the difference between these two ACL's: (OI) - object inherit (CI) - container inherit
Belmin Fernandez's user avatar
12 votes
2 answers
42k views

Unable to assign group permissions with ICACLS on Windows Server 2012

I cannot get icacls to accept my group for adding permissions. I am using an elevated power shell with the following command: icacls 'C:/foo' /grant:r 'Group Foo':f I get the following error: ...
user319862's user avatar
7 votes
1 answer
39k views

Replace permission entries on all child objects using icacls

I'm trying to set Replace permission entries on all child objects using icacls but I can't seem to do it. I want new folders/files to receive the permissions as well so I want to check the box Replace ...
never_odd_or_even's user avatar
6 votes
1 answer
6k views

ICACLS IIS AppPool\DefaultAppPool = invalid parameter

The following command: icacls c:\inetpub\wwwroot\ /grant "IIS AppPool\DefaultAppPool":F Constantly returns Invalid parameter "IIS AppPool\DefaultAppPool" For any app pool name on any folder, I'm ...
DannyT's user avatar
  • 235
5 votes
1 answer
1k views

NTFS: User can edit/delete files without rights

I have a very strange NTFS rights phenomenon on a fileserver and I cannot find my mistake, pulling my hair out for hours now. What am I missing? My goal is: User from Group-A should be able to write ...
bjoster's user avatar
  • 4,907
5 votes
2 answers
18k views

ICACLS Substitute Failing "No mapping between account names and security IDs was done."

Running a really simple ICACLS command after I copied a directory over to a new server with permissions intact. I need to change a SID from an old server user group to a new server user group. ...
Brad's user avatar
  • 165
4 votes
2 answers
17k views

Finding files/folders with write/full control permissions for Everyone on Windows 2003

Trying to clean up permissions on this IIS6 w/ PHP CGI server, it seems that several files/folders have write permissions for Everyone. (You can probably guess what is happening, repeatedly.) So, ...
Josh Y.'s user avatar
  • 280
4 votes
3 answers
89k views

Grant MODIFY on "All Subfolders and Files" with icacls, but only give Read to top level folder

One of our Windows servers that has some user folders on it has some pretty screwed up permissions. What I want it for SYSTEM and Domain Admins to have full control of all folders. I want the users to ...
MDMarra's user avatar
  • 101k
4 votes
1 answer
21k views

change ownership using Icacls on windows

On a windows 7 enterprise 64 bit OS - I want to change ownership of a folder inherited to all sub-folders using ICACLS I am logged in as standard user. The folder is owned by an administrator user, ...
user1874594's user avatar
4 votes
2 answers
9k views

CACLS "Access is denied"

I am on Windows Server 2008. I'm trying to set deny permissions for a certain user on the Windows folder with the following command: cacls Windows /E /D sneakyUser I get the error message "...
anonymous's user avatar
3 votes
1 answer
11k views

icacls Command regaining Permission by Administrator and Everyone

Accidentally I gave Deny permission to 'Everyone' folder which points to my website. I am using Windows 2012. Now I get access denied for Administrator and Website shows 500 error. Can anyone give ...
Himadri's user avatar
  • 33
3 votes
1 answer
731 views

NTFS Access Control Entries difference between icacls output and GUI

When I add/edit NTFS permissions for a user/group from command line via icacls application, i get multiple ACE entries in the list for the same thing, while from the GUI every ACE (since they are all ...
m4dm4n's user avatar
  • 31
2 votes
1 answer
41k views

Remove file permission using icacls [closed]

Could someone help me to remove particular security groups from a file using icacls? The file has all security settings inherited from the folder, where the file resides. So I would like to remove ...
carous3l's user avatar
2 votes
2 answers
3k views

How to setup NTFS ACL with Acces Based Enumeration

We're in the process of migrating from Novell Netware to Windows 2K8 R2 infrastructure (AD, File server, print server... etc) My question is about ACL. While Netware and Windows are totally different,...
Patrick Pellegrino's user avatar
2 votes
2 answers
10k views

PowerShell Icacls permissions with domain group

I am trying to use icacls to set permissions for a domain group, but for some reason it is not working. icacls "C:\Temp\ACL" /T /C /grant ("Everyone"+':F') ("System"+':F') ("Administrators"+':F') ("...
ChaChaPoly's user avatar
2 votes
1 answer
11k views

icacls reset inherited permissions on multi folders

Looking to find a better way to script this for multiple folders. Right now I have a icacls script that is reseting permissions on files/folder from a parent folder: icacls "e:\FTP_Root\user1\*" /q /...
Jay501's user avatar
  • 23
2 votes
1 answer
825 views

icacls equivalents of explorer basic permissions

I am using icacls to set permissions on a large number of directories for various groups. I want to assign what icacls help refers to as "modify access". It seems to do this correctly. However when ...
John Fitzpatrick's user avatar
2 votes
2 answers
6k views

icacls variable not working in powershell script

I am configuring a new fileserver running on nanoserver 2016 datacenter edition. Right now i am working on a powershell script to create user folders. But I get an error when using the icacls command ...
Gerald's user avatar
  • 23
2 votes
1 answer
2k views

Resetting Windows' File Security Permissions

I'm trying to find the correct commands to reset each of my hard drives permissions to remove all of the incorrect, outdated groups/usernames that have built up on folders over time and reset the ...
Ryflex's user avatar
  • 139
2 votes
1 answer
848 views

Locking directory structure

As the title suggests, I'm trying to lock the directory structure for a folder-hierarchy. Multiple (W7) users access shared projects on a (QNAP) SMB NAS (ACL & Auth against AD). When new ...
Jakes's user avatar
  • 21
2 votes
2 answers
2k views

ICACLS in powershell script 50% working

I have an ICACLS command running within a powershell script. The script creates a new folder on a server share, creates a new security group in AD and then runs ICACLS to provision the folder. When I ...
Sid's user avatar
  • 21
1 vote
1 answer
592 views

Give exclusive AD access to Mapped Drive via GPO

I want to know how to provide a user with exclusive access to a folder, but not other folders. The folder root is located here: DC1\\UserFolders\%username% I use a GPO to map that user's folder. ...
billsecond's user avatar
1 vote
2 answers
739 views

Windows Server 2003 redirected folder permissions cannot be altered

I have a Windows SBS 2003 SP2 DC that is severely messed up. This system has 55 users and they are all using redirected "home" folders to "e:\Users Shared Folders" I need to backup the files in each ...
Dan M.'s user avatar
  • 143
1 vote
2 answers
15k views

Force ownership of folder structure without replacing other permissions - Windows Server 2008 R2 - takeown is erasing all other permissions

Logged on as local Administrator. Trying to put Administrator as owner of all files and folders on a drive. The drive contains an existing folder structure with securities/permissions/acls copied from ...
jaymitt's user avatar
  • 41
1 vote
1 answer
6k views

Error using iCacls

I saved an ACL using icacls using this command icacls File.zip /save aclsFile That worked fine, but whenever I try to restore the file I get an error message: icacls * /restore aclsFile Not all ...
RedPheonix's user avatar
1 vote
1 answer
2k views

NTFS permissions inheriting incorrectly as "this folder only"

I have a full directory tree that was migrated from another server. I've created top level folders with the necessary permissions that I wish to propagate to all descendant files and folders. However, ...
Nilpo's user avatar
  • 123
1 vote
1 answer
273 views

icacls : create private directory (full control for user and no listing for others except admins)

I would like to create a folder with permissions similar to my home directory. I tried giving myself full control etc. but I managed to get locked out and had to use the takedown tool to be able to ...
pyb's user avatar
  • 216
1 vote
3 answers
6k views

icacls variables in batch file

I'm moving users to a new domain, file server and user name format. I'm trying to write a simple DOS batch to copy the data and set the permissions. X: is mapped to the old server and E: is the local ...
SteveH's user avatar
  • 11
1 vote
0 answers
178 views

How to save ACLs of a directory tree and then restore it on another server, as SID mapping is not guaranteed?

ICACLS can save ACL of a tree with the command below, where a_dir_root is the root of this tree: icacls a_dir_root\ /save AclFile /T /C /Q Of course, groups are identified as SIDs. I want to restore ...
Amessihel's user avatar
  • 113
1 vote
0 answers
185 views

ACL of Folders on Domain-joined Host for Local Account Holders

I have a domain-joined server, Windows Server 2012 R2 Standard, with a folder tree that is common to multiple users. Some users have domain accounts and some have only local Windows accounts. All ...
boynoid's user avatar
  • 11
0 votes
1 answer
10k views

icacls to make folder read-only

I'm just learning about icacls to set permissions to a folder. Better yet, I want to make sure that a folder is readonly. Anyone have any ideas? C:>icacls.exe C:\TEMP\Reports [switches]
coson's user avatar
  • 111
0 votes
1 answer
1k views

Setting inheritance on folder structure with iCACLS

New to this forum. I am trying to finish up a script that creates a folder structure and assigns permissions via icacls. I have the script working correctly except for one thing. When setting ...
Dan's user avatar
  • 1
0 votes
1 answer
698 views

How to set limited permissions using command line on windows?

user want to delete all permissions and keep only modify permission for everyone and full permission to system. Like this. But present with icacls command icacls "%ProgramData%\myfolder\...
user2331760's user avatar
0 votes
2 answers
283 views

How to restrict all but defined accounts to access folders on MS server?

I've been trying to only allow defined members on Active Directory from accessing folders used for an IIS server. There are too many accounts to deny one by one leaving only one or two users to access ...
Jim's user avatar
  • 1
0 votes
1 answer
435 views

ICACLS for a remote group on a remote machine

This question concerned a local group. I'm trying to use icacls for a remote group. I've tried this way, but it didn't work : > icacls \\HOST\shared_dir\file.txt /grant "HOST\GROUP":F HOST\GROUP: ...
Amessihel's user avatar
  • 113
0 votes
1 answer
1k views

using icacls to set traverse/execute without setting change permissions

I'm having trouble with network shares. Specifically with mac clients accessing home shares on a NAS. The fix has been to remove certain permissions on the Library folder. in the past, i've used set-...
flow in's user avatar
  • 11
0 votes
1 answer
6k views

icacls in windows 7 does not give full permission to write files in root drive

icacls in windows 7 does not give full permission to write files in root drive. We have a very old application based on Omnis7 that needs to create and read/write files on drive C: when running as a ...
Matthew Rohrich's user avatar
0 votes
1 answer
1k views

How to deny execution of a file although allow deletion of it (XCACLS/ICACLS)

Very frustrating problem, as the title suggests, I am trying to deny the user from executing the file, although I want to allow them to be able to delete the file icacls bat.exe /grant *S-1-1-0:(D) /...
Ben's user avatar
  • 1
0 votes
1 answer
2k views

Hyper-v, missing .vhd file after reboot

After a (patch and) reboot, I got an error message reading something about corrupt recycle-bin for e:\ (where I store my virtual machines). Two of the virtual machines could not be started. On the ...
3molo's user avatar
  • 4,350
0 votes
1 answer
304 views

ICACLS escape asterisk character

Let's say I have managed to create a file named '*' (via MSYS or whatever) Is there a way to properly escape this such that I can call ICACLS and only list that single file? icacls * lists everything ...
LordAro's user avatar
  • 121
0 votes
0 answers
488 views

Granting permission to domain user for folder not working

I'm converting my code to use icacls and currently following this tutorial: https://ss64.com/nt/icacls.html. On this part, Grant the user jdoe rights to create, edit and delete files in the ...
rminaj's user avatar
  • 121
0 votes
1 answer
504 views

How do I properly order NTFS ACL using icacls?

I have a directory structure 4 subdirectories deep: [Department] -> [Job #] -> [Docs] -> [EMail] At the [Docs] level I have 4 groups inherited from root and one group (st_JobDocs) explicit. All ...
Albion's user avatar
  • 465
0 votes
1 answer
54 views

Windows Services Vulnerable to Tampering Mitigation

I am testing some software with Microsoft's Attack Surface Analyzer. I took a baseline and after installation scan of the software I am testing. When I create a report it shows that a certain service ...
0siris's user avatar
  • 13
0 votes
1 answer
2k views

how to reset original owner after assigning permissions to Windows specific folders using ICACLS and takeown?

For a specific requirement i need to assign permissions to "Starks" for C: and C:\Windows C:\Windows\System32 and few other windows specific folders on a Win7 machine without tampering existing ...
GhostSpeaks101's user avatar
0 votes
1 answer
92 views

Find permission of specific account and owner to replace with new account

Using Windows 2008R2. I have an ad account "fileadm" which have some permissions of many folders and files and for some it's a owner. I need to replace this account with another account (with the same ...
puffydee's user avatar
0 votes
1 answer
502 views

How do I provide read-only permission for a user on a Windows File Share?

I am trying to provide read-only permission to folder/sub-folders for particular users in windows NAS server with following scenarios: if user already has some permission remove all of that. provide ...
Hitesh Kumar's user avatar
0 votes
1 answer
1k views

icacls adding SID instead of friendly name [closed]

I need to apply the icacls command from a server in the network, for example, server001 to a folder that is on server002. The objective is to add a local security group of server002 on a folder that ...
Vito's user avatar
  • 101
0 votes
1 answer
364 views

Access denied on single file with explicit permissions set

I have a Windows 2008R2 server that has a weird permissions issue. I have a single file in a share that has inheritance disabled and explicit permissions set on the file. The only groups that have ...
eljasbo's user avatar
0 votes
0 answers
811 views

ICACLS not working from PowerShell

I created a BAT file that executes this C:\Windows\system32\icacls.exe "F:\Users\username" /inheritance:r /T /C /Q It works fine. When I copy the command within a PowerShell, I get error ...
GettingStarted's user avatar