Batch modification and assignment of user and folder permissions by Icacls (1)
Example: quick, batch deployment of folder sharing permissions, etc.
1. View folders with permissions
Icacls d:\ 1234\ 12 through the above command, you can see the folder permissions details of 1234 in disk D below. Note: the declaration of inheritance should be placed before the specific permissions. For example: (OI) (CI) (IO) (M) is correct, but (M) (OI) (CI) (IO) prompts invalid parameters.
2. Authorize users to 12 folders: 999 has read permission
Icacls d:\ 1234\ 12 / grant 999: (OI) (CI) (RX) / T2.2 authorize all folders and files in the 1234 folder icacls d:\ 1234\ *. * / grant 999: (OI) (CI) (RX) / T2.3 if the user has permission to modify 12 folders before 999 Now the read permission you want to change to icacls d:\ 1234\ 12 / grant [: r] 999: (OI) (CI) (RX) / T keyword explanation: / grant [: r] Sid:perm grants access to the specified user. If you use: r, these permissions replace all previously granted explicit permissions. (if you want to modify previous permissions, it is recommended to add: r, which will make your folder permissions clearer.) if you do not use: r, these permissions will be added to all previously granted explicit permissions. / T indicates that this operation is performed on all matching files / directories under the directory specified by that name.
3. Delete user: 999 from 12 folders.
Icacls d:\ 1234\ 12 / remove:g 999 / T keyword explanation: / remove [: [g | d]] Sid deletes all SID that appears in the ACL. Using: G, all permissions granted to the SID will be deleted. Using: d, all permissions that deny the SID will be deleted.
The ICACLS command help syntax is as follows: > icacls ICACLS name / save aclfile [/ T] [/ C] [/ L] [/ Q] stores the DACL of files and folders that match names in aclfile for future use with / restore. Note that the SACL, owner, or integrity label is not saved. ICACLS directory [/ substitute SidOld SidNew [...]] / restore aclfile [/ C] [/ L] [/ Q] applies the stored DACL to the files in the directory. ICACLS name / setowner user [/ T] [/ C] [/ L] [/ Q] changes the owner of all matching names. This option does not force all identities to be changed; you can do so using the takeown.exe utility. ICACLS name / findsid Sid [/ T] [/ C] [/ L] [/ Q] looks for all matching names that contain ACL that explicitly mentions SID. ICACLS name / verify [/ T] [/ C] [/ L] [/ Q] finds all files whose ACL is irregular or whose length is inconsistent with the ACE count. ICACLS name / reset [/ T] [/ C] [/ L] [/ Q] replaces ACL with the default inherited ACL for all matching files. ICACLS name [/ grant [: r] Sid:perm [...] [/ deny Sid:perm [...]] [/ remove [: G |: d]] Sid [...] [/ T] [/ C] [/ L] [/ Q] [/ setintegritylevel Level:policy [...]] / grant [: r] Sid:perm grants access to the specified user. If you use: r, these permissions replace all previously granted explicit permissions. If you do not use: r, these permissions are added to all previously granted explicit permissions. / deny Sid:perm explicitly denies the specified user access. An explicit deny ACE is added for the listed permissions, and the same permissions are removed from all explicitly granted permissions. / remove [: [g | d]] Sid deletes all SID that appear in the ACL. Using: G, all permissions granted to the SID will be deleted. Using: d, all permissions that deny the SID will be deleted. The / setintegritylevel [(CI) (OI)] level explicitly adds the integrity ACE to all matching files. The level to be specified is one of the following: the inheritance option for L [ow] M [edium] H [igh] integrity ACE can take precedence over the level, but applies only to directories. / inheritance:e | d | r e-enable inheritance d-disable inheritance and copy ACE r-delete all inherited ACE Note: Sid can be in numeric format or friendly name format. If the number format is given, add a * at the beginning of the SID. / T indicates that this operation is performed on all matching files / directories under the directory specified by that name. / C indicates that this operation will continue on all file errors. An error message will still be displayed. / L indicates that this operation is performed on the symbolic link itself rather than on its destination. / Q indicates that icacls should disable the display of success messages. ICACLS preserves the canonical order of ACE entries: explicitly deny explicitly deny inheritance grant perm is the permission mask One of two formats can be specified: simple permission sequence: n-No access F-full access M-modify RX-read and execute R-read-only W-write-only permission D-specific list of permissions separated by commas in parentheses: DE-delete RC-read control WDAC-write DAC WO-write owner S-synchronous AS-access system security Universal MA-maximum allowed GR-generic read GW-generic write GE-generic execution GA-all generic RD-read data / list directory WD-write data / add Add file AD-add data / add subdirectory REA-read extended attribute WEA-write extended attribute X-execute / traverse DC-delete subkey RA-read attribute WA-write attribute Inherited permissions can take precedence over each format But only apply to directories: (OI)-object inheritance (CI)-Container inheritance (IO)-only inheritance (NP)-do not propagate inheritance (I)-example of permissions inherited from the parent container: icacls c:\ windows\ * / save AclFile / T-saves the ACL of all files in c:\ windows and its subdirectories to AclFile. Icacls c:\ windows\ / restore AclFile-restores the ACL of all files in AclFile that exist in c:\ windows and its subdirectories. Icacls file / grant Administrator: (DMageWDAC)-the user will be granted administrator rights to delete and write files to DAC. Icacls file / grant * S Mel 1-1-0: (DMagle WDAC)-users defined by sid S Mel 1-1-0 will be granted permission to delete files and write to WDAC.
