Questions tagged [icacls]
The icacls tag has no usage guidance.
55
questions
0
votes
1
answer
221
views
How to set limited permissions using command line on windows?
user want to delete all permissions and keep only modify permission for everyone and full permission to system.
Like this.
But present with icacls command
icacls "%ProgramData%\myfolder\...
- 155
-1
votes
2
answers
104
views
Permissions not applied to folder on Brazilian machine, how to fix that?
I am applying permissions to a folder using RunWait by icacls.
It is working correctly on windows 10 64bit English machine.
But when I ran on the Brazilian machine, it is not applying.
So ran the ...
- 362
0
votes
1
answer
115
views
Create a kind of dropbox folder on Windows server so users can copy files in, but not delete or modify
Is there a way to set NTFS rights on a folder so that users are allowed to copy files into that folder and read them afterwards, but not delete or write to them (once they were closed at the end of ...
- 101
1
vote
0
answers
145
views
How to save ACLs of a directory tree and then restore it on another server, as SID mapping is not guaranteed?
ICACLS can save ACL of a tree with the command below, where a_dir_root is the root of this tree:
icacls a_dir_root\ /save AclFile /T /C /Q
Of course, groups are identified as SIDs. I want to restore ...
- 113
0
votes
1
answer
257
views
ICACLS escape asterisk character
Let's say I have managed to create a file named '*' (via MSYS or whatever)
Is there a way to properly escape this such that I can call ICACLS and only list that single file?
icacls * lists everything ...
- 111
1
vote
1
answer
2k
views
NTFS permissions inheriting incorrectly as "this folder only"
I have a full directory tree that was migrated from another server. I've created top level folders with the necessary permissions that I wish to propagate to all descendant files and folders. However, ...
- 123
0
votes
2
answers
250
views
How to restrict all but defined accounts to access folders on MS server?
I've been trying to only allow defined members on Active Directory from accessing folders used for an IIS server.
There are too many accounts to deny one by one leaving only one or two users to access ...
- 1
0
votes
0
answers
447
views
Granting permission to domain user for folder not working
I'm converting my code to use icacls and currently following this tutorial: https://ss64.com/nt/icacls.html.
On this part,
Grant the user jdoe rights to create, edit and delete files in the
...
- 121
1
vote
1
answer
262
views
icacls : create private directory (full control for user and no listing for others except admins)
I would like to create a folder with permissions similar to my home directory. I tried giving myself full control etc. but I managed to get locked out and had to use the takedown tool to be able to ...
- 216
0
votes
1
answer
470
views
How do I properly order NTFS ACL using icacls?
I have a directory structure 4 subdirectories deep: [Department] -> [Job #] -> [Docs] -> [EMail]
At the [Docs] level I have 4 groups inherited from root and one group (st_JobDocs) explicit. All ...
- 465
0
votes
1
answer
54
views
Windows Services Vulnerable to Tampering Mitigation
I am testing some software with Microsoft's Attack Surface Analyzer. I took a baseline and after installation scan of the software I am testing. When I create a report it shows that a certain service ...
- 13
-1
votes
2
answers
253
views
What prevents someone to use CACLS to modify any file? [closed]
I recently discovered the CACLS command, that allows someone to edit the ACL of a file. I saw it in a CTF write-up (hacking challenge) to get the root flag supposedly restricted to the Administrator:
...
- 9
2
votes
2
answers
9k
views
PowerShell Icacls permissions with domain group
I am trying to use icacls to set permissions for a domain group, but for some reason it is not working.
icacls "C:\Temp\ACL" /T /C /grant ("Everyone"+':F') ("System"+':F') ("Administrators"+':F') ("...
- 243
2
votes
1
answer
11k
views
icacls reset inherited permissions on multi folders
Looking to find a better way to script this for multiple folders.
Right now I have a icacls script that is reseting permissions on files/folder from a parent folder:
icacls "e:\FTP_Root\user1\*" /q /...
- 23
2
votes
2
answers
6k
views
icacls variable not working in powershell script
I am configuring a new fileserver running on nanoserver 2016 datacenter edition. Right now i am working on a powershell script to create user folders. But I get an error when using the icacls command ...
- 23
1
vote
0
answers
169
views
ACL of Folders on Domain-joined Host for Local Account Holders
I have a domain-joined server, Windows Server 2012 R2 Standard, with a folder tree that is common to multiple users. Some users have domain accounts and some have only local Windows accounts. All ...
- 11
0
votes
1
answer
1k
views
how to reset original owner after assigning permissions to Windows specific folders using ICACLS and takeown?
For a specific requirement i need to assign permissions to "Starks" for C: and C:\Windows C:\Windows\System32 and few other windows specific folders on a Win7 machine without tampering existing ...
- 101
0
votes
1
answer
85
views
Find permission of specific account and owner to replace with new account
Using Windows 2008R2.
I have an ad account "fileadm" which have some permissions of many folders and files and for some it's a owner.
I need to replace this account with another account (with the same ...
- 1
0
votes
1
answer
455
views
How do I provide read-only permission for a user on a Windows File Share?
I am trying to provide read-only permission to folder/sub-folders for particular users in windows NAS server with following scenarios:
if user already has some permission remove all of that.
provide ...
- 101
3
votes
1
answer
693
views
NTFS Access Control Entries difference between icacls output and GUI
When I add/edit NTFS permissions for a user/group from command line via icacls application, i get multiple ACE entries in the list for the same thing, while from the GUI every ACE (since they are all ...
- 31
1
vote
1
answer
574
views
Give exclusive AD access to Mapped Drive via GPO
I want to know how to provide a user with exclusive access to a folder, but not other folders. The folder root is located here:
DC1\\UserFolders\%username%
I use a GPO to map that user's folder. ...
- 199
0
votes
1
answer
425
views
ICACLS for a remote group on a remote machine
This question concerned a local group. I'm trying to use icacls for a remote group.
I've tried this way, but it didn't work :
> icacls \\HOST\shared_dir\file.txt /grant "HOST\GROUP":F
HOST\GROUP: ...
- 113
5
votes
1
answer
1k
views
NTFS: User can edit/delete files without rights
I have a very strange NTFS rights phenomenon on a fileserver and I cannot find my mistake, pulling my hair out for hours now. What am I missing?
My goal is:
User from Group-A should be able to write ...
- 4,812
2
votes
1
answer
2k
views
Resetting Windows' File Security Permissions
I'm trying to find the correct commands to reset each of my hard drives permissions to remove all of the incorrect, outdated groups/usernames that have built up on folders over time and reset the ...
- 139
4
votes
1
answer
19k
views
change ownership using Icacls on windows
On a windows 7 enterprise 64 bit OS - I want to change ownership of a folder inherited to all sub-folders using ICACLS
I am logged in as standard user. The folder is owned by an administrator user, ...
- 143
0
votes
1
answer
1k
views
icacls adding SID instead of friendly name [closed]
I need to apply the icacls command from a server in the network, for example, server001 to a folder that is on server002. The objective is to add a local security group of server002 on a folder that ...
- 101
0
votes
1
answer
309
views
Access denied on single file with explicit permissions set
I have a Windows 2008R2 server that has a weird permissions issue. I have a single file in a share that has inheritance disabled and explicit permissions set on the file. The only groups that have ...
- 1
2
votes
2
answers
2k
views
ICACLS in powershell script 50% working
I have an ICACLS command running within a powershell script. The script creates a new folder on a server share, creates a new security group in AD and then runs ICACLS to provision the folder. When I ...
- 21
3
votes
1
answer
10k
views
icacls Command regaining Permission by Administrator and Everyone
Accidentally I gave Deny permission to 'Everyone' folder which points to my website. I am using Windows 2012.
Now I get access denied for Administrator and Website shows 500 error.
Can anyone give ...
- 33
0
votes
0
answers
778
views
ICACLS not working from PowerShell
I created a BAT file that executes this
C:\Windows\system32\icacls.exe "F:\Users\username" /inheritance:r /T /C /Q
It works fine.
When I copy the command within a PowerShell, I get error ...
- 316
0
votes
1
answer
5k
views
icacls for a local group of a remote machine
I'm trying to use icacls to adjust permissions on a remote folder, when the grantee is the local group of the remote server. From machine Foo, I'm trying to grant modify rights for group Bar\Users to ...
- 197
1
vote
3
answers
6k
views
icacls variables in batch file
I'm moving users to a new domain, file server and user name format. I'm trying to write a simple DOS batch to copy the data and set the permissions. X: is mapped to the old server and E: is the local ...
- 11
0
votes
1
answer
1k
views
using icacls to set traverse/execute without setting change permissions
I'm having trouble with network shares. Specifically with mac clients accessing home shares on a NAS. The fix has been to remove certain permissions on the Library folder.
in the past, i've used set-...
- 11
2
votes
1
answer
825
views
Locking directory structure
As the title suggests, I'm trying to lock the directory structure for a folder-hierarchy.
Multiple (W7) users access shared projects on a (QNAP) SMB NAS (ACL & Auth against AD).
When new ...
- 21
0
votes
1
answer
2k
views
Icacls works from command line, not from batch file
The OS is Windows server 2012.
I am trying to use command icacls C:\folder\targetfile /grant domain\usergroup:(rx) to give permissions on certain file.
The command works when executed on command ...
- 570
2
votes
1
answer
40k
views
Remove file permission using icacls [closed]
Could someone help me to remove particular security groups from a file using icacls?
The file has all security settings inherited from the folder, where the file resides. So I would like to remove ...
- 57
17
votes
2
answers
93k
views
How to replace permissions and everything inside with icacls on Windows Server 2012?
Using Windows Server 2012 R2 AND Windows Server 2008 R2.
I have a folder called C:\temp\test and I want to grant access to SYSTEM and a user and all files and subdirectories, and remove everthing ...
- 2,188
12
votes
2
answers
40k
views
Unable to assign group permissions with ICACLS on Windows Server 2012
I cannot get icacls to accept my group for adding permissions. I am using an elevated power shell with the following command:
icacls 'C:/foo' /grant:r 'Group Foo':f
I get the following error:
...
- 777
5
votes
2
answers
17k
views
ICACLS Substitute Failing "No mapping between account names and security IDs was done."
Running a really simple ICACLS command after I copied a directory over to a new server with permissions intact. I need to change a SID from an old server user group to a new server user group.
...
- 165
6
votes
1
answer
38k
views
Replace permission entries on all child objects using icacls
I'm trying to set Replace permission entries on all child objects using icacls but I can't seem to do it. I want new folders/files to receive the permissions as well so I want to check the box Replace ...
2
votes
2
answers
3k
views
How to setup NTFS ACL with Acces Based Enumeration
We're in the process of migrating from Novell Netware to Windows 2K8 R2 infrastructure (AD, File server, print server... etc)
My question is about ACL. While Netware and Windows are totally different,...
2
votes
1
answer
790
views
icacls equivalents of explorer basic permissions
I am using icacls to set permissions on a large number of directories for various groups. I want to assign what icacls help refers to as "modify access". It seems to do this correctly. However when ...
- 123
4
votes
3
answers
85k
views
Grant MODIFY on "All Subfolders and Files" with icacls, but only give Read to top level folder
One of our Windows servers that has some user folders on it has some pretty screwed up permissions. What I want it for SYSTEM and Domain Admins to have full control of all folders. I want the users to ...
- 101k
6
votes
1
answer
6k
views
ICACLS IIS AppPool\DefaultAppPool = invalid parameter
The following command:
icacls c:\inetpub\wwwroot\ /grant "IIS AppPool\DefaultAppPool":F
Constantly returns
Invalid parameter "IIS AppPool\DefaultAppPool"
For any app pool name on any folder, I'm ...
- 235
4
votes
2
answers
9k
views
CACLS "Access is denied"
I am on Windows Server 2008.
I'm trying to set deny permissions for a certain user on the Windows folder with the following command:
cacls Windows /E /D sneakyUser
I get the error message "...
- 53
0
votes
1
answer
10k
views
icacls to make folder read-only
I'm just learning about icacls to set permissions to a folder. Better yet, I want to make sure that a folder is readonly. Anyone have any ideas?
C:>icacls.exe C:\TEMP\Reports [switches]
- 111
4
votes
2
answers
16k
views
Finding files/folders with write/full control permissions for Everyone on Windows 2003
Trying to clean up permissions on this IIS6 w/ PHP CGI server, it seems that several files/folders have write permissions for Everyone. (You can probably guess what is happening, repeatedly.)
So, ...
- 280
0
votes
1
answer
6k
views
icacls in windows 7 does not give full permission to write files in root drive
icacls in windows 7 does not give full permission to write files in root drive.
We have a very old application based on Omnis7 that needs to create and read/write files on drive C: when running as a ...
- 159
0
votes
1
answer
1k
views
How to deny execution of a file although allow deletion of it (XCACLS/ICACLS)
Very frustrating problem, as the title suggests, I am trying to deny the user from executing the file, although I want to allow them to be able to delete the file
icacls bat.exe /grant *S-1-1-0:(D) /...
- 1
12
votes
1
answer
12k
views
NTFS ACL's: What is the difference between object and container inhertiance?
I am looking at using icacls.exe. However, before proceeding, I wanted clarification on the difference between these two ACL's:
(OI) - object inherit
(CI) - container inherit
- 10.8k