Comments on: Mastering Permissions with icacls.exe Command thru the GUI

By: Bohack

Bohack — Fri, 03 Feb 2012 22:52:55 +0000

Use a /t which changes DACLs of specified files in the current directory and all subdirectories.

cacls “C:\Program Files\XXXX” /e /t /g “Domain\domain users”:C

I do it all the time…

Depending on the files you have you may which continues to change DACLs, ignoring errors.

By: Safraz

Safraz — Fri, 03 Feb 2012 19:47:37 +0000

Need some help please:

This work cacls “C:\Program Files\XXXX” /e /g “Domain\domain users”:C
for the first folder not for sub folder

How do have add “domain users” to the all the subfolder and files Using Icacls

By: Scott

Scott — Thu, 15 Dec 2011 06:08:07 +0000

I believe the following line above is incorrect:

Subfolders and files only (OI)(CI)(NP)(IO)

When I use the above it gives lower folders “Subfolder only” permissions, which is different from when choosing “subfolder and files only” via the GUI. I found the following line works the same as the GUI:

Subfolders and files only (OI)(CI)(IO)
cheers
PS. Otherwise this has been one of the more useful ICACLs related pages that I have read (and I have read lots).

By: Bohack

Bohack — Fri, 02 Dec 2011 13:49:28 +0000

Personally I would go back to basics with the original cacls command. cacls /e for edit will do what you are looking to do. It will edit the DACL in stead of replacing it, so you will retain the original permission structure. Coupled with the /r or revoke that should do it. I would test it first and there is probably a way to do it with the icacls command, but at first glance I didn’t see how. Why waste the time if the cacls command will work.

By: Morph

Morph — Fri, 02 Dec 2011 09:09:47 +0000

I want to do something like amir (1st post).

We have a badly maintained dacl structure with ad hoc added users and groups everywhere.

Now somehow the local users group has read rights inherited through the whole tree. We don’t want that!.

I can’t block inheritence, remove the local users group and propagate this to all child objects, because I lose all the ad hoc users and groups!!!!

Question; how can I remove only the specific group from all acl’s troughout the tree while preserving the rest of the settings.

By: Mike Rosadino

Mike Rosadino — Thu, 01 Dec 2011 19:04:02 +0000

I have a very simple example I’m hoping someone can provide the solution for. I want to use the “icacs” utility to grant Full Control to a couple Excel files on the local hard drive to ONLY the logged in user on a Windows 7 desktop (eg, %USERNAME% environment variable), and NO access to anyone else. How would I accomplish this? It seems there are a lot of default user groups that get access by default but I want to remove these (eg, “NT AUTHORITY\Authenticated Users”, “BUILTIN\Administrators”, “BUILTIN\Users”, etc).

By: Bob Broccoli

Bob Broccoli — Wed, 05 Oct 2011 03:29:51 +0000

Thanks for the timely reply and your insight Jon.

The reason that I was considering icals in lieu of secedit was the KB Article ID: 313222 – Last Review: September 23, 2011 – Revision: 15.0. It said:

“The use of “secedit /configure” to import the default security template, dfltbase.inf, is unsupported nor is it a viable method to restore default security permissions on Windows Vista, Windows 7, Windows Server 2008 and Windows Server 2008 R2 computers.”

The same article said that using icacls /restore would be good. The problem is, you must have a previous backup from the icacls /save command. I do not have one or know of one, but I would assume that there would be some file that would have the “initial” settings employed an admin or user creates the first folders in a disk or partition. Whatever is assigned during that creation would be the “basic” settings, that would subsequently be manually modified by a user, if desired.

Right now, the only idea I have is to go to another satisfactorily operating Win 7 computer and to perform an icacls /save and then copy that file to this computer. The problem is that the restore affects all partitions and disks whereas I only want to modify the disks containing my copied files (rescued from my system prior to the rebuild).

Is there such a basic set of simple/advanced permissions that are available?

By: Bohack

Bohack — Tue, 04 Oct 2011 23:54:17 +0000

That is two questions… First what do the switches do? and the other is what are the defaults? First the icacls * means all matching files the “/T” tells it to carry the function out on all file and subfolders below and the “/Q” and “/C” is to suppress errors and not print messages to the console on success. The “/reset” will carry the inherited permissions all the way down and forcefully reset permissions. Now the second question is what are the default install permissions? In Windows XP it use to be applied during setup, but since Windows Vista and Windows 7 use WIM file the permissions are applied as the files are expanded. However defltbase.inf still exists and can be used to reapply permissions in Windows 7 back to “factory” permissions; using the command of “secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose” the inf file is in “c:\windows\inf”. This is the proper procedure to reset permissions back to default.

By: Bob Broccoli

Bob Broccoli — Tue, 04 Oct 2011 22:06:07 +0000

It’s a sad day for me. Logging on to my Win 7 system, I found I had no task bar icons, no desktop icons and no files in my start folders. Definitely not good!! Upon investigation, I found that the files and objects were there but hidden, and found that I could not unhide them. After many hours of attempted to repair, I chose to rebuild my system. In order to save my data, since I am the only user on this desktop I bought a new 1TB drive, formatted and partitioned it, and “rolled” off all my data to the new HDD.

My problem is all the data on the new drive is in the same state, read only and hidden.

Since we are talking about 100,000 files, mostly images, docx and xls files, is there a way, using takeown and icals to set these files back to “factory” ownership and permissions. Is it as simple as:

icacls * /T /Q /C /RESET

but what ARE those permissions and who would the owner be.
Also what are the “standard” security characteristics.

bob

By: Bohack

Bohack — Tue, 13 Sep 2011 13:24:42 +0000

Unfortunately NTFS is the only file level security that Windows supports. If you are dealing with removable storage of a sensitive nature I recommend using TrueCrypt. Create a crypt file on the base of the UFD (USB Flash Device) and then just mount it when needed. I keep all of my uber secure information on a UFD and never worry about loosing it, since if it’s lost the person would need to identify the file and break the AES256 encryption. If you’re storing sensitive information on UFD without using TrueCrypt, your information will be stole at some point. Yes TrueCrypt is totally FREE!