The Icacls command to set Files and Folders Permissions in Windows

Intro

• OS : Windows Server 2008 minimum
• ACL : Access Control List
• ACE : Access Control Entry is an element in an access control list (ACL)

Commands

Reset ACL

• Recover access to a file :

PS C:\Users\Administrator>takeown /A /R /F D:\FOLDER

• Replaces ACLs with default inherited ACLs for all matching files :
• /T indicates that this operation is performed on all matching files/directories below the directories specified in the name
• /C indicates that this operation will continue on all file errors.

PS C:\Users\Administrator>icacls D:\FOLDER /reset /T /C

Remove all inherited ACEs

• Remove all inherited ACEs :

PS C:\Users\Administrator>icacls D:\FOLDER /inheritance:r /T /C

• Note :
• /inheritancelevel:e : Enables inheritance
• /inheritancelevel:d : Disables inheritance and copies the ACEs
• /inheritancelevel:r : Disables inheritance and removes only inherited ACEs

Set ACLs

• /grant:r, replace permissions previously granted

• inheritance rights
• (OI) object inherit
• (CI) container inherit
• (IO) inherit only
• (NP) don't propagate inherit
• (I) permission inherited from parent container

• simple rights
• (RX,W) read + execute and write only access
• (RX,D) read + execute and delete access
• (M) read, execute, write, delete and modify access
• (F) full access

PS C:\Users\Administrator>icacls "D:\FOLDER" /grant:r "domain.local\users":(OI)(CI)(RX,D) "domain.local\Administrator":(OI)(CI)(F) SYSTEM:(OI)(CI)(F) Administrators:(OI)(CI)(F) /T /C

Remove user

• Remove all occurrences of Sid in the ACL :

PS C:\Users\Administrator>icacls "c:\$Windows.~BT" /remove:g SYSTEM

Add a user with full rights

• Grants the specified user access rights :

PS C:\Users\Administrator>icacls "c:\$Windows.~BT" /grant users:(OI)(CI)(F)

Deny rights to a user

• Explicitly denies the specified user access rights :

PS C:\Users\Administrator>icacls "c:\$WINDOWS.~BT" /deny SYSTEM:(OI)(CI)(F)

Examples

Reset ACL

• Recover access to a file with takeown tool :

PS C:\Users\Administrator>takeown /A /R /F E:\Common\TEST

• Replace ACLs with default inherited ACLs for all matching files :

PS C:\Users\Administrator>icacls E:\Common\TEST /reset /T /C

Add User

• Add user with read + execute and delete access :

PS C:\Users\Administrator>icacls E:\Common\TEST /grant s.marsh@std.local:(OI)(CI)(RX,D)

• Add user with read + execute and write only access :

PS C:\Users\Administrator>icacls E:\Common\TEST /grant b.stotch@std.local:(OI)(CI)(RX,W)

Remove User

• Remove user :

PS C:\Users\Administrator>icacls E:\Common\TEST /remove s.marsh@std.local

Permissions

• Replace permissions :

PS C:\Users\Administrator>icacls E:\Common\TEST /grant:r b.stotch@std.local:(OI)(CI)(RX,D)

• Denies user access rights :

PS C:\Users\Administrator>icacls E:\Common\TEST /deny b.stotch@std.local:(OI)(CI)(F)

Misc

• Print current permissions :

PS C:\Users\Administrator>icacls E:\Common\TEST
E:\Common\TEST BUILTIN\Administrators:(I)(F)
               CREATOR OWNER:(I)(OI)(CI)(IO)(F)
               NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
               BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
               BUILTIN\Users:(I)(OI)(CI)(RX)
               BUILTIN\Users:(I)(CI)(WD,AD)

Successfully processed 1 files; Failed processing 0 files

Save/Restore ACL

• Save current ACLs to file :

PS C:\Users\Administrator>icacls E:\Common\TEST /save AclFile /T
processed file: E:\Common\TEST
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Anemia.mp3
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Anemia.ogg
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Anything_That_You_Want.mp3
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Anything_That_You_Want.ogg
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Asshole.mp3
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Asshole.ogg
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Breathless.mp3
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Breathless.ogg
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Denomia.mp3
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Denomia.ogg
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Easy_Way.mp3
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Easy_Way.ogg
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Illusions_And_Witnesses.mp3
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Illusions_And_Witnesses.ogg
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Impro.mp3
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Impro.ogg
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Insubstantial_As_Me.mp3
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Insubstantial_As_Me.ogg
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Last_Tango.mp3
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Last_Tango.ogg
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Queens_&_Princes.mp3
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Queens_&_Princes.ogg
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Refund_You.mp3
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Refund_You.ogg
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Something.mp3
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Something.ogg
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_The_Elements_Of_A_State.mp3
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_The_Elements_Of_A_State.ogg
processed file: E:\Common\TEST\tracks.xml
Successfully processed 30 files; Failed processing 0 files

• Restore ACLs from file :

PS C:\Users\Administrator>icacls E:\Common\ /restore AclFile
processed file: E:\Common\TEST
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Anemia.mp3
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Anemia.ogg
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Anything_That_You_Want.mp3
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Anything_That_You_Want.ogg
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Asshole.mp3
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Asshole.ogg
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Breathless.mp3
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Breathless.ogg
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Denomia.mp3
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Denomia.ogg
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Easy_Way.mp3
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Easy_Way.ogg
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Illusions_And_Witnesses.mp3
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Illusions_And_Witnesses.ogg
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Impro.mp3
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Impro.ogg
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Insubstantial_As_Me.mp3
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Insubstantial_As_Me.ogg
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Last_Tango.mp3
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Last_Tango.ogg
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Queens_&_Princes.mp3
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Queens_&_Princes.ogg
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Refund_You.mp3
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Refund_You.ogg
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Something.mp3
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_Something.ogg
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_The_Elements_Of_A_State.mp3
processed file: E:\Common\TEST\The_Dolphins_-_Demo_-_The_Elements_Of_A_State.ogg
processed file: E:\Common\TEST\tracks.xml
Successfully processed 30 files; Failed processing 0 files