Questions tagged [icacls]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
1answer
38 views

Permissions not applied to folder on Brazilian machine, how to fix that?

I am applying permissions to a folder using RunWait by icacls. It is working correctly on windows 10 64bit English machine. But when I ran on the Brazilian machine, it is not applying. So ran the ...
0
votes
1answer
30 views

Create a kind of dropbox folder on Windows server so users can copy files in, but not delete or modify

Is there a way to set NTFS rights on a folder so that users are allowed to copy files into that folder and read them afterwards, but not delete or write to them (once they were closed at the end of ...
0
votes
0answers
20 views

icacls… make a folder structure read only but keep groups

in w2008, is posible to make a folder structure read-only? (the read only attrb en general dont work) the problem is that the structure has different groups with different permissions on different ...
1
vote
0answers
91 views

How to save ACLs of a directory tree and then restore it on another server, as SID mapping is not guaranteed?

ICACLS can save ACL of a tree with the command below, where a_dir_root is the root of this tree: icacls a_dir_root\ /save AclFile /T /C /Q Of course, groups are identified as SIDs. I want to restore ...
0
votes
1answer
25 views

ICACLS escape asterisk character

Let's say I have managed to create a file named '*' (via MSYS or whatever) Is there a way to properly escape this such that I can call ICACLS and only list that single file? icacls * lists everything ...
0
votes
0answers
20 views

Using icacls To Add Remote Domain AD Group To VFS File

I have a mapped network share (A Virtual File System (VFS)) I would like to add a group to from a remote domain. For this post, I'll refer to the DOMAIN\Group as REMOTEDOMAIN\Group. If I right-click ...
1
vote
1answer
139 views

NTFS permissions inheriting incorrectly as “this folder only”

I have a full directory tree that was migrated from another server. I've created top level folders with the necessary permissions that I wish to propagate to all descendant files and folders. However, ...
0
votes
0answers
60 views

ICACLS: Write Access for Program Files folder - handle invalid

A application (C:\Program Files (x86)\MyApp) needs to write to its own program directory in order to update itself. In Windows 10 this is not possible by default. [I know that it is no good practice ...
0
votes
2answers
119 views

How to restrict all but defined accounts to access folders on MS server?

I've been trying to only allow defined members on Active Directory from accessing folders used for an IIS server. There are too many accounts to deny one by one leaving only one or two users to access ...
0
votes
0answers
171 views

Granting permission to domain user for folder not working

I'm converting my code to use icacls and currently following this tutorial: https://ss64.com/nt/icacls.html. On this part, Grant the user jdoe rights to create, edit and delete files in the ...
1
vote
1answer
70 views

icacls : create private directory (full control for user and no listing for others except admins)

I would like to create a folder with permissions similar to my home directory. I tried giving myself full control etc. but I managed to get locked out and had to use the takedown tool to be able to ...
0
votes
1answer
254 views

How do I properly order NTFS ACL using icacls?

I have a directory structure 4 subdirectories deep: [Department] -> [Job #] -> [Docs] -> [EMail] At the [Docs] level I have 4 groups inherited from root and one group (st_JobDocs) explicit. All ...
0
votes
1answer
48 views

Windows Services Vulnerable to Tampering Mitigation

I am testing some software with Microsoft's Attack Surface Analyzer. I took a baseline and after installation scan of the software I am testing. When I create a report it shows that a certain service ...
-1
votes
2answers
182 views

What prevents someone to use CACLS to modify any file? [closed]

I recently discovered the CACLS command, that allows someone to edit the ACL of a file. I saw it in a CTF write-up (hacking challenge) to get the root flag supposedly restricted to the Administrator: ...
2
votes
2answers
6k views

PowerShell Icacls permissions with domain group

I am trying to use icacls to set permissions for a domain group, but for some reason it is not working. icacls "C:\Temp\ACL" /T /C /grant ("Everyone"+':F') ("System"+':F') ("Administrators"+':F') ("...
2
votes
1answer
9k views

icacls reset inherited permissions on multi folders

Looking to find a better way to script this for multiple folders. Right now I have a icacls script that is reseting permissions on files/folder from a parent folder: icacls "e:\FTP_Root\user1\*" /q /...
2
votes
2answers
4k views

icacls variable not working in powershell script

I am configuring a new fileserver running on nanoserver 2016 datacenter edition. Right now i am working on a powershell script to create user folders. But I get an error when using the icacls command ...
1
vote
0answers
95 views

ACL of Folders on Domain-joined Host for Local Account Holders

I have a domain-joined server, Windows Server 2012 R2 Standard, with a folder tree that is common to multiple users. Some users have domain accounts and some have only local Windows accounts. All ...
0
votes
1answer
986 views

how to reset original owner after assigning permissions to Windows specific folders using ICACLS and takeown?

For a specific requirement i need to assign permissions to "Starks" for C: and C:\Windows C:\Windows\System32 and few other windows specific folders on a Win7 machine without tampering existing ...
0
votes
1answer
75 views

Find permission of specific account and owner to replace with new account

Using Windows 2008R2. I have an ad account "fileadm" which have some permissions of many folders and files and for some it's a owner. I need to replace this account with another account (with the same ...
0
votes
1answer
358 views

How do I provide read-only permission for a user on a Windows File Share?

I am trying to provide read-only permission to folder/sub-folders for particular users in windows NAS server with following scenarios: if user already has some permission remove all of that. provide ...
3
votes
1answer
526 views

NTFS Access Control Entries difference between icacls output and GUI

When I add/edit NTFS permissions for a user/group from command line via icacls application, i get multiple ACE entries in the list for the same thing, while from the GUI every ACE (since they are all ...
1
vote
1answer
524 views

Give exclusive AD access to Mapped Drive via GPO

I want to know how to provide a user with exclusive access to a folder, but not other folders. The folder root is located here: DC1\\UserFolders\%username% I use a GPO to map that user's folder. ...
0
votes
1answer
285 views

ICACLS for a remote group on a remote machine

This question concerned a local group. I'm trying to use icacls for a remote group. I've tried this way, but it didn't work : > icacls \\HOST\shared_dir\file.txt /grant "HOST\GROUP":F HOST\GROUP: ...
5
votes
1answer
955 views

NTFS: User can edit/delete files without rights

I have a very strange NTFS rights phenomenon on a fileserver and I cannot find my mistake, pulling my hair out for hours now. What am I missing? My goal is: User from Group-A should be able to write ...
2
votes
1answer
2k views

Resetting Windows' File Security Permissions

I'm trying to find the correct commands to reset each of my hard drives permissions to remove all of the incorrect, outdated groups/usernames that have built up on folders over time and reset the ...
2
votes
1answer
10k views

change ownership using Icacls on windows

On a windows 7 enterprise 64 bit OS - I want to change ownership of a folder inherited to all sub-folders using ICACLS I am logged in as standard user. The folder is owned by an administrator user, ...
0
votes
1answer
816 views

icacls adding SID instead of friendly name [closed]

I need to apply the icacls command from a server in the network, for example, server001 to a folder that is on server002. The objective is to add a local security group of server002 on a folder that ...
0
votes
1answer
173 views

Access denied on single file with explicit permissions set

I have a Windows 2008R2 server that has a weird permissions issue. I have a single file in a share that has inheritance disabled and explicit permissions set on the file. The only groups that have ...
2
votes
2answers
2k views

ICACLS in powershell script 50% working

I have an ICACLS command running within a powershell script. The script creates a new folder on a server share, creates a new security group in AD and then runs ICACLS to provision the folder. When I ...
1
vote
1answer
6k views

icacls Command regaining Permission by Administrator and Everyone

Accidentally I gave Deny permission to 'Everyone' folder which points to my website. I am using Windows 2012. Now I get access denied for Administrator and Website shows 500 error. Can anyone give ...
0
votes
0answers
660 views

ICACLS not working from PowerShell

I created a BAT file that executes this C:\Windows\system32\icacls.exe "F:\Users\username" /inheritance:r /T /C /Q It works fine. When I copy the command within a PowerShell, I get error ...
0
votes
1answer
5k views

icacls for a local group of a remote machine

I'm trying to use icacls to adjust permissions on a remote folder, when the grantee is the local group of the remote server. From machine Foo, I'm trying to grant modify rights for group Bar\Users to ...
1
vote
3answers
5k views

icacls variables in batch file

I'm moving users to a new domain, file server and user name format. I'm trying to write a simple DOS batch to copy the data and set the permissions. X: is mapped to the old server and E: is the local ...
0
votes
1answer
971 views

using icacls to set traverse/execute without setting change permissions

I'm having trouble with network shares. Specifically with mac clients accessing home shares on a NAS. The fix has been to remove certain permissions on the Library folder. in the past, i've used set-...
2
votes
1answer
701 views

Locking directory structure

As the title suggests, I'm trying to lock the directory structure for a folder-hierarchy. Multiple (W7) users access shared projects on a (QNAP) SMB NAS (ACL & Auth against AD). When new ...
0
votes
1answer
2k views

Icacls works from command line, not from batch file

The OS is Windows server 2012. I am trying to use command icacls C:\folder\targetfile /grant domain\usergroup:(rx) to give permissions on certain file. The command works when executed on command ...
2
votes
1answer
31k views

Remove file permission using icacls [closed]

Could someone help me to remove particular security groups from a file using icacls? The file has all security settings inherited from the folder, where the file resides. So I would like to remove ...
17
votes
2answers
87k views

How to replace permissions and everything inside with icacls on Windows Server 2012?

Using Windows Server 2012 R2 AND Windows Server 2008 R2. I have a folder called C:\temp\test and I want to grant access to SYSTEM and a user and all files and subdirectories, and remove everthing ...
10
votes
2answers
30k views

Unable to assign group permissions with ICACLS on Windows Server 2012

I cannot get icacls to accept my group for adding permissions. I am using an elevated power shell with the following command: icacls 'C:/foo' /grant:r 'Group Foo':f I get the following error: ...
4
votes
2answers
13k views

ICACLS Substitute Failing “No mapping between account names and security IDs was done.”

Running a really simple ICACLS command after I copied a directory over to a new server with permissions intact. I need to change a SID from an old server user group to a new server user group. ...
5
votes
1answer
31k views

Replace permission entries on all child objects using icacls

I'm trying to set Replace permission entries on all child objects using icacls but I can't seem to do it. I want new folders/files to receive the permissions as well so I want to check the box Replace ...
2
votes
2answers
3k views

How to setup NTFS ACL with Acces Based Enumeration

We're in the process of migrating from Novell Netware to Windows 2K8 R2 infrastructure (AD, File server, print server... etc) My question is about ACL. While Netware and Windows are totally different,...
2
votes
1answer
678 views

icacls equivalents of explorer basic permissions

I am using icacls to set permissions on a large number of directories for various groups. I want to assign what icacls help refers to as "modify access". It seems to do this correctly. However when ...
4
votes
3answers
72k views

Grant MODIFY on “All Subfolders and Files” with icacls, but only give Read to top level folder

One of our Windows servers that has some user folders on it has some pretty screwed up permissions. What I want it for SYSTEM and Domain Admins to have full control of all folders. I want the users to ...
4
votes
1answer
4k views

ICACLS IIS AppPool\DefaultAppPool = invalid parameter

The following command: icacls c:\inetpub\wwwroot\ /grant "IIS AppPool\DefaultAppPool":F Constantly returns Invalid parameter "IIS AppPool\DefaultAppPool" For any app pool name on any folder, I'm ...
4
votes
2answers
7k views

CACLS “Access is denied”

I am on Windows Server 2008. I'm trying to set deny permissions for a certain user on the Windows folder with the following command: cacls Windows /E /D sneakyUser I get the error message "...
0
votes
1answer
9k views

icacls to make folder read-only

I'm just learning about icacls to set permissions to a folder. Better yet, I want to make sure that a folder is readonly. Anyone have any ideas? C:>icacls.exe C:\TEMP\Reports [switches]
3
votes
2answers
12k views

Finding files/folders with write/full control permissions for Everyone on Windows 2003

Trying to clean up permissions on this IIS6 w/ PHP CGI server, it seems that several files/folders have write permissions for Everyone. (You can probably guess what is happening, repeatedly.) So, ...
0
votes
1answer
5k views

icacls in windows 7 does not give full permission to write files in root drive

icacls in windows 7 does not give full permission to write files in root drive. We have a very old application based on Omnis7 that needs to create and read/write files on drive C: when running as a ...