iCacls on Windows 7 (modify permissons for Everyone user on file/folder)

[darrenstraight]

In Windows XP I used to be able to do the following to change the permissions of a folder and its files inside by doing the following (must modify not remove any exsisting):

 

cacls "C:\Test" /e /c /g Everyone:F

 

In Windows 7 I'm trying the following (in run cmd as Administrator):

 

Icacls "C:\Test" /grant Everyone:F

 

But it just doesnt do anything (cant use /e switch says invalid)!!

 

I tried using a domain username too:

 

Icacls "C:\Test" /grant DOMAINNAME\username:F

 

But it just adds the user but with no ticks. I've tried various options as seen here: http://ss64.com/nt/icacls.html

 

I'm starting to give up, need this to work so I can deploy a batch file to certain computers with Adobe Photoshop installed on Windows 7 and change the permissions of C:\ProgramData\Adobe\Photoshop Elements\5.0 to evryone so theres not a problem on first load - just like Game maker and it's softwrap errors, was hoping to do the same!!

 

*Free virtual ice lolly and a pint for the one who can solve my problem - would send but it would melt and the beer would go warm hehe*

[ajs]

Have you tried using the :r switch after /grant?

 

(Since the website you linked to suggests to me that its the equivalent of /e)

[darrenstraight]

Have you tried using the :r switch after /grant?

 

(Since the website you linked to suggests to me that its the equivalent of /e)

 

No luck - also tried doing the following, which does stop inheritance and I can manually black tick/untick the boxed on the security tab:

 

Icacls "C:\Test" /inheritance:d

 

But still no luck adding any user with full control or anything for that matter, it adds user but only has special permissions grey ticked.

[ajs]

What are the current permissions on the folder?

[darrenstraight]

Interesting I was reading a comment on, someone else having problems with permissions on folders:

iCACLS Vista Command Prompt Tool to Manage ACLs » My Digital Life

 

And at the moment theres nothing in the test folder but I wonderd could I create a test.txt file and would permissions work on that, well I tried:

 

Icacls "C:\Test\test.txt" /grant Everyone:f

 

Well it seems icacls is working for me on files but not folders!

 

Permissions currently attached in image (after using Icacls "C:\Test" /inheritance:d)

Edited July 9, 2010 by darrenstraight

[ajs]

One of the comments on the site suggests that cacls is still around in Windows Vista. Presumably it's been removed entirely in Windows 7?

[darrenstraight]

One of the comments on the site suggests that cacls is still around in Windows Vista. Presumably it's been removed entirely in Windows 7?

 

I'm so confused!!

 

I've just tried CACLS again and it now works!

 

last time I tried it with commands it said "NOTE: Cacls is now deprecated, please use Icacls." and didnt work though that still comes up if I just type cacls in cmd, very confused - I'm going to try my batch files now and see if they work hopefuly they do!

 

Thanks for all your help btw, really appreciated!

Edited July 9, 2010 by darrenstraight

[ajs]

Not a problem. Hope you get it sorted :-)

[pmkochie]

Icacls "C:\Test\test.txt" /grant Everyone:f

should be:

icacls c:\test\test.ext /grant Everyone:(F)

or

icacls \\localhost\c$\test\test.ext /grant Everyone:(F)

 

if the user or group name has a space in it, include it in quotes such as "Domain Admins" or "Enterprise Admins"

icacls \\localhost\c$\test\test.ext /grant "Enterprise Admins":(F)

Edited March 3, 2011 by pmkochie
:( made a sad face and I need to put in :(

[defhead]

I too had this problem where the security was applying to my files but not folders. Folders would display special security.

 

I changed *.* to just * within the folder i wished to change. Using /T to made changes to all my subs. Here are my non working and working scripts.

 

Wrong

C:\test

Icacls *.* /T /C /grant system:F

 

Working

c:\test

Icacls * /T /C /grant system:F

 

Hope this helps as it was doing my head in.

[defhead]

Correction

 

Here is the correct working script i used to apply to folders and files.

 

icacls * /T /C /grant system:(OI)(CI)F

[Arthur]

^ Might be worth using CODE tags to avoid the smiley face problem.

 

I normally use SetACL to reset permissions - unlike ICACLS it works with file and folder names longer than 260 characters.

[degarb]

Correction

 

Here is the correct working script i used to apply to folders and files.

 

icacls * /T /C /grant system:(OI)(CI)F

 

 

I too am scripting, a long time user of cacls, but confused as heck with icacls. They just got everything wrong with the docs: too much no one needs to do, and nothing you would need to do; I found many thing are undefined in docs: container, objects, sid, perm. They didn't take a single week to make the docs easier, while a billion people over the years will be lost at using this useful tool, over looking its power.

 

I also have no windows7 machine to test my icacl bat So I don't know if there are y/n confirmations I need to overcome or what will work.

 

I am distributing an few exes that do not need to extract on the fly anything. so I will be putting these exes in folder called toolbox that will not allow any file to be written to the folder toolbox.

 

Do any of these lines work? Which can I use to lock for everyone, every account?

 

title icaclsbat

%SystemRoot%\system32\icacls.exe toolbox /grant:r Administrators:(OI)(CI)R

%SystemRoot%\system32\icacls.exe toolbox /grant:r users(OI)(CI):R

%SystemRoot%\system32\icacls.exe toolbox /grant:r system(OI)(CI):R

 

 

cd toolbox

 

 

%SystemRoot%\system32\icacls.exe * /T /C /grant:r system:(OI)(CI)R

 

 

: the frowny face is colon left parenthesis.