On windows 2008 file server, I have huge folder, where some of subfolders do not inherit ACL from the parent object. I would like to add single permissions entry (full control for local administrators group) to the whole folder, and to propagate this entry even to folders which does not inherit ACLs from above. All existing permissions entries should be kept as it is. By default, if I just add single permission entry at the root folder, subfolders which does not inherit ACLs won't inherit new entry. If I turn on "Replace all child object permissions with inheritable permissions from this object", this will reset all existing ACL entries on folders which does not inherit ACLs. Is there any method available to solve my problem ?
-
1Are you comfortable w/ Powershell?– MDMoore313Apr 7, 2015 at 15:23
-
1Yeah, your solution is a command-line utility and looping through all the sub folders. I, too, recommend PowerShell, but the older cmd-based utilities would work as well.– HopelessN00bApr 7, 2015 at 15:25
-
Not so comfortable with powershell, but thanks for pointing me in right direction.– buggy08Apr 7, 2015 at 15:28
2 Answers
It's not possible in GUI, but should be with icacls
, see Command-Line Reference.
There, you can see how /grant
works:
Grants specified user access rights. Permissions replace previously granted explicit permissions.
Without
:r
, permissions are added to any previously granted explicit permissions.
As switch /t
makes the command recursively, combination of these should do the trick.
So I'd suggest something like icacls "X:\PATH\TO\FOLDER\" /grant DOMAIN\group:(f) /t
but please see the documentation whether it matches your goal (and as always try it first on a test directory).
You could use SetACL if you're not comfortable with PowerShell (as BigHomie and HopelessN00b have suggested).
You should read the full documentation and test your command on a dummy location, but the syntax you'd use would be something like:
setacl -on <PATH> -ot file -actn ace -ace "n:Administrators;p:full;i:so,sc;m:grant;w:dacl" -rec cont_obj -ignoreerr