Questions tagged [icacls]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
100 views

Granting permission to domain user for folder not working

I'm converting my code to use icacls and currently following this tutorial: https://ss64.com/nt/icacls.html. On this part, Grant the user jdoe rights to create, edit and delete files in the ...
1
vote
1answer
57 views

icacls : create private directory (full control for user and no listing for others except admins)

I would like to create a folder with permissions similar to my home directory. I tried giving myself full control etc. but I managed to get locked out and had to use the takedown tool to be able to ...
0
votes
1answer
140 views

How do I properly order NTFS ACL using icacls?

I have a directory structure 4 subdirectories deep: [Department] -> [Job #] -> [Docs] -> [EMail] At the [Docs] level I have 4 groups inherited from root and one group (st_JobDocs) explicit. All ...
0
votes
1answer
43 views

Windows Services Vulnerable to Tampering Mitigation

I am testing some software with Microsoft's Attack Surface Analyzer. I took a baseline and after installation scan of the software I am testing. When I create a report it shows that a certain service ...
-1
votes
2answers
140 views

What prevents someone to use CACLS to modify any file? [closed]

I recently discovered the CACLS command, that allows someone to edit the ACL of a file. I saw it in a CTF write-up (hacking challenge) to get the root flag supposedly restricted to the Administrator: ...
2
votes
2answers
4k views

PowerShell Icacls permissions with domain group

I am trying to use icacls to set permissions for a domain group, but for some reason it is not working. icacls "C:\Temp\ACL" /T /C /grant ("Everyone"+':F') ("System"+':F') ("Administrators"+':F') ("...
2
votes
1answer
6k views

icacls reset inherited permissions on multi folders

Looking to find a better way to script this for multiple folders. Right now I have a icacls script that is reseting permissions on files/folder from a parent folder: icacls "e:\FTP_Root\user1\*" /q /...
2
votes
2answers
3k views

icacls variable not working in powershell script

I am configuring a new fileserver running on nanoserver 2016 datacenter edition. Right now i am working on a powershell script to create user folders. But I get an error when using the icacls command ...
1
vote
0answers
78 views

ACL of Folders on Domain-joined Host for Local Account Holders

I have a domain-joined server, Windows Server 2012 R2 Standard, with a folder tree that is common to multiple users. Some users have domain accounts and some have only local Windows accounts. All ...
0
votes
1answer
675 views

how to reset original owner after assigning permissions to Windows specific folders using ICACLS and takeown?

For a specific requirement i need to assign permissions to "Starks" for C: and C:\Windows C:\Windows\System32 and few other windows specific folders on a Win7 machine without tampering existing ...
0
votes
1answer
70 views

Find permission of specific account and owner to replace with new account

Using Windows 2008R2. I have an ad account "fileadm" which have some permissions of many folders and files and for some it's a owner. I need to replace this account with another account (with the same ...
0
votes
1answer
324 views

How do I provide read-only permission for a user on a Windows File Share?

I am trying to provide read-only permission to folder/sub-folders for particular users in windows NAS server with following scenarios: if user already has some permission remove all of that. provide ...
3
votes
1answer
414 views

NTFS Access Control Entries difference between icacls output and GUI

When I add/edit NTFS permissions for a user/group from command line via icacls application, i get multiple ACE entries in the list for the same thing, while from the GUI every ACE (since they are all ...
1
vote
1answer
466 views

Give exclusive AD access to Mapped Drive via GPO

I want to know how to provide a user with exclusive access to a folder, but not other folders. The folder root is located here: DC1\\UserFolders\%username% I use a GPO to map that user's folder. ...
0
votes
1answer
210 views

ICACLS for a remote group on a remote machine

This question concerned a local group. I'm trying to use icacls for a remote group. I've tried this way, but it didn't work : > icacls \\HOST\shared_dir\file.txt /grant "HOST\GROUP":F HOST\GROUP: ...
5
votes
1answer
742 views

NTFS: User can edit/delete files without rights

I have a very strange NTFS rights phenomenon on a fileserver and I cannot find my mistake, pulling my hair out for hours now. What am I missing? My goal is: User from Group-A should be able to write ...
2
votes
1answer
1k views

Resetting Windows' File Security Permissions

I'm trying to find the correct commands to reset each of my hard drives permissions to remove all of the incorrect, outdated groups/usernames that have built up on folders over time and reset the ...
1
vote
1answer
7k views

change ownership using Icacls on windows

On a windows 7 enterprise 64 bit OS - I want to change ownership of a folder inherited to all sub-folders using ICACLS I am logged in as standard user. The folder is owned by an administrator user, ...
0
votes
1answer
664 views

icacls adding SID instead of friendly name [closed]

I need to apply the icacls command from a server in the network, for example, server001 to a folder that is on server002. The objective is to add a local security group of server002 on a folder that ...
0
votes
1answer
164 views

Access denied on single file with explicit permissions set

I have a Windows 2008R2 server that has a weird permissions issue. I have a single file in a share that has inheritance disabled and explicit permissions set on the file. The only groups that have ...
2
votes
2answers
1k views

ICACLS in powershell script 50% working

I have an ICACLS command running within a powershell script. The script creates a new folder on a server share, creates a new security group in AD and then runs ICACLS to provision the folder. When I ...
1
vote
1answer
4k views

icacls Command regaining Permission by Administrator and Everyone

Accidentally I gave Deny permission to 'Everyone' folder which points to my website. I am using Windows 2012. Now I get access denied for Administrator and Website shows 500 error. Can anyone give ...
0
votes
0answers
584 views

ICACLS not working from PowerShell

I created a BAT file that executes this C:\Windows\system32\icacls.exe "F:\Users\username" /inheritance:r /T /C /Q It works fine. When I copy the command within a PowerShell, I get error ...
0
votes
1answer
4k views

icacls for a local group of a remote machine

I'm trying to use icacls to adjust permissions on a remote folder, when the grantee is the local group of the remote server. From machine Foo, I'm trying to grant modify rights for group Bar\Users to ...
1
vote
3answers
5k views

icacls variables in batch file

I'm moving users to a new domain, file server and user name format. I'm trying to write a simple DOS batch to copy the data and set the permissions. X: is mapped to the old server and E: is the local ...
0
votes
1answer
863 views

using icacls to set traverse/execute without setting change permissions

I'm having trouble with network shares. Specifically with mac clients accessing home shares on a NAS. The fix has been to remove certain permissions on the Library folder. in the past, i've used set-...
2
votes
1answer
654 views

Locking directory structure

As the title suggests, I'm trying to lock the directory structure for a folder-hierarchy. Multiple (W7) users access shared projects on a (QNAP) SMB NAS (ACL & Auth against AD). When new ...
0
votes
1answer
1k views

Icacls works from command line, not from batch file

The OS is Windows server 2012. I am trying to use command icacls C:\folder\targetfile /grant domain\usergroup:(rx) to give permissions on certain file. The command works when executed on command ...
2
votes
1answer
25k views

Remove file permission using icacls [closed]

Could someone help me to remove particular security groups from a file using icacls? The file has all security settings inherited from the folder, where the file resides. So I would like to remove ...
15
votes
2answers
81k views

How to replace permissions and everything inside with icacls on Windows Server 2012?

Using Windows Server 2012 R2 AND Windows Server 2008 R2. I have a folder called C:\temp\test and I want to grant access to SYSTEM and a user and all files and subdirectories, and remove everthing ...
9
votes
2answers
24k views

Unable to assign group permissions with ICACLS on Windows Server 2012

I cannot get icacls to accept my group for adding permissions. I am using an elevated power shell with the following command: icacls 'C:/foo' /grant:r 'Group Foo':f I get the following error: ...
4
votes
2answers
11k views

ICACLS Substitute Failing “No mapping between account names and security IDs was done.”

Running a really simple ICACLS command after I copied a directory over to a new server with permissions intact. I need to change a SID from an old server user group to a new server user group. ...
5
votes
1answer
26k views

Replace permission entries on all child objects using icacls

I'm trying to set Replace permission entries on all child objects using icacls but I can't seem to do it. I want new folders/files to receive the permissions as well so I want to check the box Replace ...
2
votes
2answers
3k views

How to setup NTFS ACL with Acces Based Enumeration

We're in the process of migrating from Novell Netware to Windows 2K8 R2 infrastructure (AD, File server, print server... etc) My question is about ACL. While Netware and Windows are totally different,...
2
votes
1answer
651 views

icacls equivalents of explorer basic permissions

I am using icacls to set permissions on a large number of directories for various groups. I want to assign what icacls help refers to as "modify access". It seems to do this correctly. However when ...
4
votes
3answers
65k views

Grant MODIFY on “All Subfolders and Files” with icacls, but only give Read to top level folder

One of our Windows servers that has some user folders on it has some pretty screwed up permissions. What I want it for SYSTEM and Domain Admins to have full control of all folders. I want the users to ...
3
votes
1answer
3k views

ICACLS IIS AppPool\DefaultAppPool = invalid parameter

The following command: icacls c:\inetpub\wwwroot\ /grant "IIS AppPool\DefaultAppPool":F Constantly returns Invalid parameter "IIS AppPool\DefaultAppPool" For any app pool name on any folder, I'm ...
3
votes
2answers
6k views

CACLS “Access is denied”

I am on Windows Server 2008. I'm trying to set deny permissions for a certain user on the Windows folder with the following command: cacls Windows /E /D sneakyUser I get the error message "...
-1
votes
1answer
8k views

icacls to make folder read-only

I'm just learning about icacls to set permissions to a folder. Better yet, I want to make sure that a folder is readonly. Anyone have any ideas? C:>icacls.exe C:\TEMP\Reports [switches]
3
votes
2answers
9k views

Finding files/folders with write/full control permissions for Everyone on Windows 2003

Trying to clean up permissions on this IIS6 w/ PHP CGI server, it seems that several files/folders have write permissions for Everyone. (You can probably guess what is happening, repeatedly.) So, ...
0
votes
1answer
5k views

icacls in windows 7 does not give full permission to write files in root drive

icacls in windows 7 does not give full permission to write files in root drive. We have a very old application based on Omnis7 that needs to create and read/write files on drive C: when running as a ...
0
votes
1answer
911 views

How to deny execution of a file although allow deletion of it (XCACLS/ICACLS)

Very frustrating problem, as the title suggests, I am trying to deny the user from executing the file, although I want to allow them to be able to delete the file icacls bat.exe /grant *S-1-1-0:(D) /...
9
votes
1answer
7k views

NTFS ACL's: What is the difference between object and container inhertiance?

I am looking at using icacls.exe. However, before proceeding, I wanted clarification on the difference between these two ACL's: (OI) - object inherit (CI) - container inherit
0
votes
1answer
1k views

Setting inheritance on folder structure with iCACLS

New to this forum. I am trying to finish up a script that creates a folder structure and assigns permissions via icacls. I have the script working correctly except for one thing. When setting ...
1
vote
2answers
634 views

Windows Server 2003 redirected folder permissions cannot be altered

I have a Windows SBS 2003 SP2 DC that is severely messed up. This system has 55 users and they are all using redirected "home" folders to "e:\Users Shared Folders" I need to backup the files in each ...
1
vote
2answers
14k views

Force ownership of folder structure without replacing other permissions - Windows Server 2008 R2 - takeown is erasing all other permissions

Logged on as local Administrator. Trying to put Administrator as owner of all files and folders on a drive. The drive contains an existing folder structure with securities/permissions/acls copied from ...
0
votes
1answer
2k views

Hyper-v, missing .vhd file after reboot

After a (patch and) reboot, I got an error message reading something about corrupt recycle-bin for e:\ (where I store my virtual machines). Two of the virtual machines could not be started. On the ...
1
vote
1answer
4k views

Error using iCacls

I saved an ACL using icacls using this command icacls File.zip /save aclsFile That worked fine, but whenever I try to restore the file I get an error message: icacls * /restore aclsFile Not all ...