On windows 2008 file server, I have huge folder, where some of subfolders do not inherit ACL from the parent object. I would like to add single permissions entry (full control for local administrators group) to the whole folder, and to propagate this entry even to folders which does not inherit ACLs from above. All existing permissions entries should be kept as it is. By default, if I just add single permission entry at the root folder, subfolders which does not inherit ACLs won't inherit new entry. If I turn on "Replace all child object permissions with inheritable permissions from this object", this will reset all existing ACL entries on folders which does not inherit ACLs. Is there any method available to solve my problem ?

  • 1
    Are you comfortable w/ Powershell? – MDMoore313 Apr 7 '15 at 15:23
  • 1
    Yeah, your solution is a command-line utility and looping through all the sub folders. I, too, recommend PowerShell, but the older cmd-based utilities would work as well. – HopelessN00b Apr 7 '15 at 15:25
  • Not so comfortable with powershell, but thanks for pointing me in right direction. – buggy08 Apr 7 '15 at 15:28

It's not possible in GUI, but should be with icacls, see Command-Line Reference.

There, you can see how /grant works:

Grants specified user access rights. Permissions replace previously granted explicit permissions.

Without :r, permissions are added to any previously granted explicit permissions.

As switch /t makes the command recursively, combination of these should do the trick.

So I'd suggest something like icacls "X:\PATH\TO\FOLDER\" /grant DOMAIN\group:(f) /t but please see the documentation whether it matches your goal (and as always try it first on a test directory).


You could use SetACL if you're not comfortable with PowerShell (as BigHomie and HopelessN00b have suggested).

You should read the full documentation and test your command on a dummy location, but the syntax you'd use would be something like:

setacl -on <PATH> -ot file -actn ace -ace "n:Administrators;p:full;i:so,sc;m:grant;w:dacl" -rec cont_obj -ignoreerr     
  • The term 'setacl' is not recognized as the name of a cmdlet, function, script file,... I probably need some additional library ? – buggy08 Apr 7 '15 at 15:35
  • Why download 3rd party tools when Windows has its own? – Esa Jokinen Apr 7 '15 at 15:36
  • It's a whole other command, not part of PowerShell. Click the link above for details. – GregL Apr 7 '15 at 15:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.