iCACLS.exe – Windows CMD Command
Notice: A non well formed numeric value encountered in /home/future4tech/public_html/wp-content/plugins/crayon-syntax-highlighter/crayon_formatter.class.php on line 118
Notice: A non well formed numeric value encountered in /home/future4tech/public_html/wp-content/plugins/crayon-syntax-highlighter/crayon_formatter.class.php on line 119
Notice: A non well formed numeric value encountered in /home/future4tech/public_html/wp-content/plugins/crayon-syntax-highlighter/crayon_formatter.class.php on line 118
Notice: A non well formed numeric value encountered in /home/future4tech/public_html/wp-content/plugins/crayon-syntax-highlighter/crayon_formatter.class.php on line 119
Notice: A non well formed numeric value encountered in /home/future4tech/public_html/wp-content/plugins/crayon-syntax-highlighter/crayon_formatter.class.php on line 118
Notice: A non well formed numeric value encountered in /home/future4tech/public_html/wp-content/plugins/crayon-syntax-highlighter/crayon_formatter.class.php on line 119
Notice: A non well formed numeric value encountered in /home/future4tech/public_html/wp-content/plugins/crayon-syntax-highlighter/crayon_formatter.class.php on line 118
Notice: A non well formed numeric value encountered in /home/future4tech/public_html/wp-content/plugins/crayon-syntax-highlighter/crayon_formatter.class.php on line 119
Change file and folder permissions – display or modify Access Control Lists (ACLs) for files and folders.
iCACLS resolves various issues that occur when using the older CACLS & XCACLS
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 |
Syntax Add or remove permissions: ICACLS Name [/grant[:r] User:Permission[...]] [/deny User:Permission[...]] [/remove[:g|:d]] User[...]] [/inheritance:e|d|r ] [/setintegritylevel Level[...]] [/T] [/C] [/L] [/Q] Store ACLs for one or more directories matching name into aclfile for later use with /restore: ICACLS name /save aclfile [/T] [/C] [/L] [/Q] Restore ACLs to all files in directory: ICACLS directory [/substitute SidOld SidNew [...]] /restore aclfile [/C] [/L] [/Q] Change Owner: ICACLS name /setowner user [/T] [/C] [/L] [/Q] Find items with an ACL that mentions a specific SID: ICACLS name /findsid Sid [/T] [/C] [/L] [/Q] Find files whose ACL is not in canonical form or with a length inconsistent with the ACE count: ICACLS name /verify [/T] [/C] [/L] [/Q] Replace ACL with default inherited acls for all matching files: ICACLS name /reset [/T] [/C] [/L] [/Q] This is equivalent to “Replace all child permission entries with inheritable permission from this object” in the GUI. Key name The File(s) or folder(s) the permissions will apply to. /T Traverse all subfolders to match files/directories. This will apply permission changes to all subfolders whether or not they are set to inherit permissions from the parent. On very large directory structures this may take some time as the command has to traverse the entire tree. /C Continue on file errors (access denied) Error messages are still displayed. /L Perform the operation on a symbolic link itself, not its target. /Q Quiet - supress success messages. /grant :r user:permission Grant access rights, with :r, the permissions will replace any previouly granted explicit permissions (for the given user). Otherwise the permissions are added. /deny user:permission Explicitly deny the specified user access rights. This will also remove any explicit grant of the same permissions to the same user. /remove[:[g|d]] User Remove all occurrences of User from the acl. :g remove all granted rights to that User/Sid. :d remove all denied rights to that User/Sid. /inheritance:e|d|r e - Enable inheritance d - Disable inheritance and copy the ACEs r - Remove all inherited ACEs /setintegritylevel [(CI)(OI)]Level Add an integrity ACE to all matching files. level is one of L,M,H (Low Medium or High) Mandatory Label\Low Mandatory Level = Low. Mandatory Label\Medium Mandatory Level = Medium/Standard. Mandatory Label\High Mandatory Level = Elevated. If No mandatory label is displayed in the output, it is Medium by default. A Directory Inheritance option for the integrity ACE can precede the level and is applied only to directories: user A user account, Group or a SID /restore Apply the acls stored in ACLfile to the files in directory permission is a permission mask and can be specified in one of two forms: a sequence of simple rights: D - Delete access F - Full access (Edit_Permissions+Create+Delete+Read+Write) N - No access M - Modify access (Create+Delete+Read+Write) RX - Read and eXecute access R - Read-only access W - Write-only access a comma-separated list in parenthesis of specific rights: DE - Delete RC - read control WDAC - write DAC WO - write owner S - synchronize AS - access system security MA - maximum allowed GR - generic read GW - generic write GE - generic execute GA - generic all RD - read data/list directory WD - write data/add file AD - append data/add subdirectory REA - read extended attributes WEA - write extended attributes X - execute/traverse DC - delete child RA - read attributes WA - write attributes inheritance rights can precede either form and are applied only to directories: (OI) - object inherit (CI) - container inherit (IO) - inherit only (NP) - don’t propagate inherit (I) - Permission inherited from parent container |
Unlike earlier command-line tools, iCACLS correctly preserves the canonical ordering of ACE entries:
- Explicit Deny
- Explicit Grant
- Inherited Deny
- Inherited Grant
Access Control Lists apply only to files stored on an NTFS formatted drive, each ACL determines which users (or groups of users) can read or edit the file. When a new file is created it normally inherits ACLs from the folder where it was created.
An access control list (ACL) is a list of access control entries (ACE). When backing up or restoring an ACL with iCACLS, you must do so for an entire directory (using /save and /restore) even if you are only interested in the ACEs for a few individual files. In practice, most permissions are set at the per-directory level.
Multiple /Grant /Deny /Remove clauses can be included in a single icacls command, on a large directory tree this has the advantage that the tree only has to be traversed once, rather than multiple times if you were to issue several consecutive icacls commands instead.
Modify vs Full control
- To edit a file you must have the “Modify/Change” ACL (or be the file’s owner)
- To use the iCACLS command to change the permissions of a file requires “FULL Control” (or be the file’s owner)
- File “Ownership” will always override all ACL’s – you always have Full Control over files that you create.
1 2 3 4 5 6 7 8 9 10 11 12 |
Inheritance Inherited folder permissions are given as: OI - Object inherit - This folder and files. (no inheritance to subfolders) CI - Container inherit - This folder and subfolders. IO - Inherit only - The ACE does not apply to the current file/directory These can also be combined as follows: (OI)(CI) This folder, subfolders, and files. (OI)(CI)(IO) Subfolders and files only. (CI)(IO) Subfolders only. (OI) (IO) Files only. |
So BUILTIN\Administrators:(OI)(CI)F means that both files and Subdirectories will inherit ‘F’ (Full control)
similarly (CI)R means Directories will inherit ‘R’ (Read folders only = List permission)
It is worth spending some time working out which permissions can be inherited and which need to be applied directly. On large/complex directory structures, minimizing the number of ACLs can improve fileserver performance.
If inheritance is combined with /T (traverse subfolders) the change will apply to all folders, not just the top level.
for example:
icacls “C:\demo\example” /inheritance:e /T
Will traverse all subfolders below”C:\demo\example” and enable the inheritance for everyone, this will replace any inheritance permissions that have been removed.
If no inheritance is specified, inheritance rules will not be changed but existing inherited permissions will be re-applied to existing objects in the specified location for the specified users/groups.
for example:
icacls “C:\demo\example” /grant administrators:(F) /T
This is similar to applying /reset to the child items of “C:\demo\example” but only resets the administrator’s group.
Built-In Groups
A command which addresses a built-in group by name like ICACLS folder name /GRANT Everyone:F /T
will only work when the system language is English.
To make this language-independent, use an asterisk followed by the well-known SID for the group, see Q243330 for a list.
For example, to grant full control to Everyone on a folder: ICACLS foldername /GRANT *S-1-1-0:F /T
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
Running icacls under PowerShell The options for icacls do not always run easily under PowerShell, but they can be made to work by setting a few variables and then executing with Invoke-Expression to expand all the variables: #set PS variables for each of the icacls options $Path = "c:\demo" #The path must be the first thing passed to icacls $Grant = "/grant:r" $Remove = "/remove" $replaceInherit = "/inheritance:r" $permission = ":(OI)(CI)(F)" $useraccount1 = "F4Tdom\simon" $useraccount2 = "administrators" #run icacls using invoke Expression Invoke-Expression -Command ('icacls $Path $replaceInherit $Grant "${useraccount1}${permission }"') |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 |
Examples: Change the NTFS permissions on C:\demo\example\, remove all existing inherited permissions and replace with Full control for the Administrators group and Change/Modify permission for jsmith. Apply the new permissions to the folder and inherit down to subfolders and files (OI)(CI): icacls "C:\demo\example" /inheritance:r /grant:r Administrators:(OI)(CI)F icacls "C:\demo\example" /grant:r Administrators:(OI)(CI)F /T icacls "C:\demo\example" /grant:r F4TDom\jsmith:(OI)(CI)M /T or you can combine grants like: icacls "C:\demo\example" /grant:r Administrators:(OI)(CI)F /T /grant:rF4TDom\jsmith:(OI)(CI)M /T View the permissions currently set on a folder: icacls "C:\demo\example" Grant the group FileAdmins 'Delete' and 'Write DAC' permissions to C:\demo\example: icacls "C:\demo\example" /grant:r FileAdmins:(D,WDAC) Reset permissions on all child items below C:\demo\example\, note the use of \*, without that, the permissions would be reset to those of C:\demo\ icacls "C:\demo\example\*" /c /t /reset Propagate a new permission to all files and subfolders of C:\demo\example\, without using inheritance: (so if any of the subfolders contain specific permissions, those won't be overwritten) icacls "C:\demo\example" /grant:r accountName:(NP)(RX) /T Backup the ACLs of every file in the current directory: icacls * /save Myacl_backup.txt Restore ACLS using a previously saved acl file: icacls /restore Myacl_backup.txt Change the Integrity Level (IL) of a file to High: icacls MyReport.doc /setintegritylevel H Remove all inheritance on the 'Demo' folder and grant access to the domain user 'Volta', in this command the /t will traverse existing subfolders and files, and the (CI) will ensure that new folders/files added in future will inherit these permissions: icacls C:\demo\example /inheritance:r /grant F4Tdom\Volta:(CI)F /t Grant the user jdoe rights to create, edit and delete files in the folder C:\demo\example\, but prevent deletion of the folder itself: :: First remove inheritance and grant admins Full control to the top folder icacls "C:\demo\example" /inheritance:r /grant:r administrators:(OI)(CI)(F) :: Grant Modify + Delete Child to subfolders and files only icacls "C:\demo\example" /grant:r F4TDom\jdoe:(OI)(CI)(IO)(M,DC) /T :: Grant Read/Execute, Write and Append to the top level folder icacls "C:\demo\example" /grant:r F4TDom\jdoe:(RX,WD,AD) :: if any pre-existing subfolders Grant admins Full control icacls "C:\demo\example" /grant:r administrators:(OI)(CI)(F) /T |
The above does set the correct permissions, but an undesired bug/side effect is that within the top-level folder the Windows Explorer right-click option to create New files will be empty – only New Folder is shown:
