I have a directory structure 4 subdirectories deep: [Department] -> [Job #] -> [Docs] -> [EMail]

At the [Docs] level I have 4 groups inherited from root and one group (st_JobDocs) explicit. All inherit to subfolders.

st_JobAdmin: grant F
st_Job_R: grant RX
st_JobDocs: grant F
st_ITStorageAdmin: grant F
st_GlobalDeny: deny F

At level [Email] I want to remove st_JobDocs and st_Job_R groups; keep st_GlobalDeny, st_ITStorageAdmin, and st_JobAdmin; and add st_JobDocsEmail:(OI)(CI)(F).

To do that I run from the [Department] level:

for /D %%D in (*) do for /D %%F in (%%D\Docs) do icacls "%%F\E-Mail" /inheritance:d
for /D %%D in (*) do for /D %%F in (%%D\Docs) do icacls "%%F\E-Mail" /remove:g "st_Job_R"
for /D %%D in (*) do for /D %%F in (%%D\Docs) do icacls "%%F\E-Mail" /remove:g "st_JobDocs"
for /D %%D in (*) do for /D %%F in (%%D\Docs) do icacls "%%F\E-Mail" /remove:d "st_GlobalDeny""
for /D %%D in (*) do for /D %%F in (%%D\Docs) do icacls "%%F\E-Mail" /grant:r "st_JobDocsEmail":(OI)(CI)(F)
for /D %%D in (*) do for /D %%F in (%%D\Docs) do icacls "%%F\E-Mail" /deny "st_GlobalDeny":(OI)(CI)(F)

I thought by removing st_GlobalDeny and adding it at the end I would maintain compliance with permission precedence: Explicit Deny, Allow, Inherited Deny, Allow. But for some reason when I check the security tab of one of the folders I get the error:

The permission on [dir] are incorrectly ordered, which may cause some entries to be ineffective.

Can someone help me understand the ordering and why mine is incorrect? Also, is there a command line tool that will correct the order?

As a side question, is it possible to remove only the inheritance on one group instead of all with icacls and /inheritance:d?


  • 1
    What version of Windows? I'm thinking your best bet is to do everything on one command line (you can include multiple options at once) and use /inheritance:r but try it out in a test environment first, if you lock yourself out by mistake it can be difficult to recover from. – Harry Johnston Feb 20 at 3:52
  • 1
    Also, what does icacls show for one of the broken folders? – Harry Johnston Feb 20 at 3:54
  • @Harry icacls is showing my st_GlobalDeny twice. Odd. Once at the top of the list and than once in the middle. Obviously why I am getting the error. Almost like my /remove:d st_GlobalDeny isn't working. When I reorder from the security tab the st_GlobalDeny in the middle is removed. As for inheritance:r, so you think remove everything and then readd everything? I hadn't tried that because I was afraid I'd lose access. I will try. Thank you! I'll get back with updates when I have them. – Albion Feb 20 at 13:50
  • I feel stupid. :( After bringing up my script in notepad I used the horizontal scroll bar and noticed a second quote at the end of my /remove:d line that was being hidden off the page. Sorry to bother you all. – Albion Feb 20 at 14:17

Global Deny is not being removed. In the script example on the /remove:d "st_GlobalDeny" line there is an extra quotation mark at the end.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.