There are many times when I wish to set a permission on a folder only, but all the programs i've tried will recurse through all sub files and folders during the process. As this is slow, is there any way to avoid this?

Things i've tried:

  • Windows Explorer: fails, as you can see in the gui, it will loop through all subobjects.

  • SetAcl.exe from Helge Klein: fails, as revealed by a nifty tool called ProcessMonitor

    SetACL.exe -on "PATH" -ot file -actn ace -ace "n:USER;p:read_ex;i:np;m:set" -rec no

    For those who don't know, the "i:np" clause means the permission shall apply to "this folder only".

  • icacls: fails (Process Monitor)

    icacls "PATH" /grant USER:(NP)RX (does the same thing as the setacl command above)

(command lines just examples)

  • Incidentally, you don't actually need the (NP) flag in those examples, so long as you don't say (OI) or (CI) then the permission will not be inherited. (NP) is meant to be used in combination with (CI) to limit the inheritance to a single level - it means that only the direct children of the object should inherit the permission, rather than the entire tree. (It isn't often used.) May 2 '19 at 1:46

The modern Windows API automatically recurses through the directory tree when a program changes the permissions on a directory, there is no option to prevent this from happening. Nor is Windows quite smart enough to realize when a particular change has no effect on the child objects.

However, if a program uses the older SetFileSecurity function this does not happen.

So you might try looking for old utilities, e.g., written for Windows 2000 or earlier.

Or you can use the built-in cacls command line tool, it is not as convenient to use as icacls and is officially deprecated, but it does not affect child objects unless you pass the /t option.

  • Beautiful. Saved me a lot of time.
    – iPherian
    Apr 30 '19 at 23:41
  • From my experience "cacls" will set permissions with inheritance (OI)(CI), despite not recursing subdirectories. That is not what we want.
    – LatinSuD
    Jan 26 at 17:15
  • This is funny. If I start changing the permission from explorer and cancel the task, the permission will get set. But if I do the same with icacls it won't. There has to be some difference between explorer and icacls.
    – LatinSuD
    Jan 26 at 17:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.