How to grant permission to users for a directory using command line in Windows?

Asked 28/5, 2010 at 11:59 Answered 1/5, 2023 at 1:34

Solved windows command-prompt file-permissions

347

How can I grant permissions to a user on a directory (Read, Write, Modify) using the Windows command line?

Cadastre answered 28/5, 2010 at 11:59 Comment(1)

We are running the apache service as a specific user account, would this allow apache to access the document root with full rights? – Actin 19/8, 2021 at 20:21

526

As of Vista, cacls is deprecated. Here's the first couple of help lines:

C:\>cacls
NOTE: Cacls is now deprecated, please use Icacls.

Displays or modifies access control lists (ACLs) of files

You should use icacls instead. This is how you grant John full control over D:\test folder and all its subfolders:

C:\>icacls "D:\test" /grant John:(OI)(CI)F /T

According do MS documentation:

F = Full Control
CI = Container Inherit - This flag indicates that subordinate containers will inherit this ACE.
OI = Object Inherit - This flag indicates that subordinate files will inherit the ACE.
/T = Apply recursively to existing files and sub-folders. (OI and CI only apply to new files and sub-folders). Credit: comment by @AlexSpence.

For complete documentation, you may run "icacls" with no arguments or see the Microsoft documentation here and here

Antagonize answered 29/11, 2011 at 12:51 Comment(15)

great. but how do we do this recursively? – Uncomfortable 1/12, 2013 at 3:49

Felipe: The (OI) and (CI) parameters make this recursive – Stenophyllous 18/12, 2013 at 1:21

I had issues with access denied trying to change permissions in the windows explorer UI. Adding the /T flag to the end replaced existing objects and was able to solve the problem for me. C:>icacls "D:\test" /grant John:(OI)(CI)F /T – Telles 1/7, 2014 at 3:56

@AlexSpence Great point! The /T is needed to update the permissions of existing files and folders. The (OI) and (CI) only applies to files and folders created in the future. – Meander 11/12, 2014 at 14:35

I wonder why I didn't need to add /T? Anyway thanks as this fixed my Win10 upgrade which seemed to have stripped the security of my user from the Documents folder (although ownership was intact) – Thiourea 9/8, 2015 at 13:40

Coming from the *nix world and being used to 'chown/chmod' to give access and set permissions via the CLI, this thread has been very helpful. – Ahearn 27/10, 2015 at 14:40

In Windows 10 I got this error: The term 'OI' is not recognized as the name of a cmdlet – Mc 27/12, 2015 at 14:25

@DaniilShevelev If you're using PowerShell, then you probably need to quote the argument which has parentheses. Surrounding it in 'single quotes' works. – Goodloe 3/5, 2016 at 15:31

@CălinDarie Your answer was tremendously helpful to me. Thanks! (I knew about /T, but not (OI)(CI).) – Goodloe 3/5, 2016 at 15:33

I get "OI : The term 'OI' is not recognized as the name of a cmdlet, function, script file, or operable program." with this command. edit: I was trying to run in Powershell, the command worked fine in CMD. – Winn 27/5, 2016 at 9:38

Did anyone mention of a documentation bug of icacls? Specifically the (D) and (DE) rights as written in icacls /? have been wrong until corrected in Windows 7. (DE) is a simple right, while (D) is a group of rights that equals to (DE,S). – Halford 13/8, 2017 at 15:49

If you run this in Powershell in Windows 10, you will get the error about "OI not recognized". Solution: Put the user+perms argument in quotes. For example: C:\>icacls "D:\test" /grant "John:(OI)(CI)F" /T – Koroseal 8/1, 2018 at 16:56

I get access denies when running this in an admin prompt, I had to run takeown /F C:\folder*, good thing I only have 2 files in the root of that folder and not have subfolders. – Les 5/2, 2019 at 6:47

This answer is actually really dangerous and misleading. Using this command without the /E parameter results in the files the permissions for the file being completely overwritten. The result of command above is that all permissions on the files are removed and replaced with granting John full access. – Slap 13/2, 2019 at 6:27

@Slap cacls is deprecated and this answer is using icacls, which doesn't even have a /E option. The command in this answer adds a permission for John and leaves existing permissions untouched. – Isabea 15/5, 2023 at 17:55

You can also use ICACLS.

To grant the Users group Full Control to a folder:

>icacls "C:\MyFolder" /grant Users:F

To grant Modify permission to IIS users for C:\MyFolder (if you need your IIS has ability to R/W files into specific folder):

>icacls "C:\MyFolder" /grant IIS_IUSRS:M

If you do ICACLS /? you will be able to see all available options.

Hollyanne answered 20/8, 2012 at 5:24 Comment(4)

And given that cacls is gone, it's even more reason to use icacls. – Woolsey 29/11, 2012 at 20:52

Adding full control didn't worked for me until /grant Users:(OI)(CI)F used – Deidradeidre 15/9, 2014 at 10:52

Do I need to replace Users with something else or NO ? According to icacls "C:\MyFolder" /grant Users:F – Mundell 13/1, 2015 at 16:0

If the current user is a member of the user group named "Users" (which, on Windows 7, is normally the case), then granting a permission to that group will affect the access rights of the current user. In any other case, replace the name Users with the actual name of the current user (e.g. John), thus: /grant John:(OI)(CI)F – Oppress 6/11, 2018 at 5:49

Open a Command Prompt, then execute this command:

icacls "c:\somelocation\of\path" /q /c /t /grant Users:F

F gives Full Access.

/q /c /t applies the permissions to subfolders.

Note: Sometimes "Run as Administrator" will help.

Realtor answered 1/10, 2015 at 17:44 Comment(2)

"Run as Admin" is needed, simply the best answer! – Mattah 5/12, 2019 at 23:48

Hi, I would like to set least permission for one user. For example, we have one application in Windows Server. So this user just need to access this application than any other services. Like user should not access any browser, should not access any file explorer, should not access any disk storage. This user should access just one stand-alone application. Is possible to do this case using windows command or any script in windows server? – Aide 14/10, 2020 at 6:5

Use cacls command. See information here.

CACLS files /e /p {USERNAME}:{PERMISSION}

Where,

/p : Set new permission

/e : Edit permission and kept old permission as it is i.e. edit ACL instead of replacing it.

{USERNAME} : Name of user

{PERMISSION} : Permission can be:

R - Read

W - Write

C - Change (write)

F - Full control

For example grant Rocky Full (F) control with following command (type at Windows command prompt):

C:> CACLS files /e /p rocky:f

Read complete help by typing following command:

C:> cacls /?

Christoffer answered 28/5, 2010 at 12:1 Comment(5)

Great answer! Only thing to note, is that files is the actual files you want to change the permissions on. Maybe [files] or {files} would be a better explanation. – Begonia 30/1, 2013 at 16:59

cacls is relevant; it is still available in Windows 10; Microsoft would deprecate cmd.exe in favour of Powershell too. – Yasminyasmine 25/5, 2017 at 14:47

@Chinggis6 Being "still available" doesn't mean something is a good idea to use or recommend others to use. Also, cmd.exe is not deprecated and is not likely to be, so that's not a point in favour of icacls at all, quite the opposite. – Indre 29/6, 2017 at 15:5

I know. I didn't state if it's a good idea to use or recommend cacls.exe. Neither did I mention that cmd.exe is already deprecated. I think people should at least be aware of its availability in higher versions even only for backward-compatibility or any other reason else. – Yasminyasmine 29/6, 2017 at 15:24

Plus one for including the /e parameter to edit rather than replace the permissions on the files – Slap 13/2, 2019 at 6:47

I try the below way and it work for me:

open cmd.exe
takeown /R /F *.*
icacls * /T /grant [username]:(D)

So that the files can become my own access and it assign to "Delete" and then I can delete the files and folders.

Creath answered 13/7, 2015 at 18:24 Comment(2)

Do not run del . /S /Q. It will begin deleting all your files within your root directory. – Agiotage 16/5, 2021 at 12:17

takeown was the key for me when transferring files from windows 8.1 to 10 via external hdd – Transferase 27/8, 2023 at 2:31

Corrupt Permissions: Regaining access to a folder and its sub-objects

Although most of the answers posted in reply to the question have some merit, IMHO none of them give a complete solution. The following (might be) a perfect solution for Windows 7 if you are locked-out of a folder by corrupted permission settings:

icacls "c:\folder" /remove:d /grant:r Everyone:(OI)(CI)F /T

For Windows 10 the user/SID must be specified after the /remove:d option:

icacls "c:\folder" /remove:d Everyone /grant:r Everyone:(OI)(CI)F /T

.
Notes:

The command is applied to the specified directory.
Specifying the user "Everyone" sets the widest possible permission, as it includes every possible user.
The option "/remove:d" deletes any explicit DENY settings that may exist, as those override explicit ALLOW settings: a necessary preliminary to creating a new ALLOW setting. This is only a precaution, as there is often no DENY setting present, but better safe than sorry.
The option "/grant" creates a new ALLOW setting, an explicit permission that replaces (":r") any and all explicit ALLOW settings that may exist.
The "F" parameter (i.e. the permission created) makes this a grant of FULL control.
The "/T" parameter adds recursion, applying these changes to all current sub-objects in the specified directory (i.e. files and subfolders), as well as the folder itself.
The "(OI)" and "(CI)" parameters also add recursion, applying these changes to sub-objects created subsequently.
.

ADDENDUM (2019/02/10) -

The Windows 10 command line above was kindly suggested to me today, so here it is. I haven't got Windows 10 to test it, but please try it out if you have (and then will you please post a comment below).

The change only concerns removing the DENY setting as a first step. There might well not be any DENY setting present, so that option might make no difference. My understanding is, on Windows 7, that you don't need to specify a user after /remove:d but I might be wrong about that!

ADDENDUM (2019/11/21) -

User astark recommends replacing Everyone with the term *S-1-1-0 in order for the command to be language independent. I only have an English install of Windows, so I can't test this proposal, but it seems reasonable.

Oppress answered 15/12, 2017 at 0:55 Comment(10)

No provision is needed for INHERITED permissions, because EXPLICIT permissions override them. So, creation of the new explicit setting nullifies any inherited settings that may exist (because the new explicit setting includes recursion). – Oppress 19/3, 2018 at 8:57

Invalid parameter "/remove:d" – Afterburning 2/11, 2018 at 23:20

I am running (can only run) icacls.exe on Windows 7. I cannot comment on, nor test for, any changes to it which might exist on Windows 8 or 10. As tested by me on Windows 7 64-bit, the remove option is effective to remove DENY settings. Its use might result in an error message if there are NO deny settings present, but if there are none such then it can't remove them anyway. – Oppress 6/11, 2018 at 4:57

Failure to reproduce exactly the command line in my original answer (save for the directory path) will result in the command failing. In particular, do NOT add any quotation marks that do not feature in my answer. If you encase (for example) the /remove:d option in quotes, the command will of course fail. – Oppress 6/11, 2018 at 5:27

yeah I did not use quotation marks. I'm using Windows 10 by the way. What's interesting is that /remove:d is a syntax parameter in the help output

ICACLS name [/grant[:r] Sid:perm[...]]        [/deny Sid:perm [...]]        [/remove[:g|:d]] Sid[...]] [/T] [/C] [/L] [/Q]        [/setintegritylevel Level:policy[...]]

and heres additional information:

/remove[:[g|d]] Sid removes all occurrences of Sid in the ACL. With         :g, it removes all occurrences of granted rights to that Sid. With         :d, it removes all occurrences of denied rights to that Sid.

Any idea? – Afterburning 7/11, 2018 at 11:32

@Afterburning Well, I sympathise. But I use Windows 7. With the grace of God, I will never use Windows 10. I'd rather migrate to Ubuntu! I suspect that /remove:g will probably remove all rights, both the ALLOW and the DENY entries (though with a possibility that 'granted' in this context means only ALLOW and so it will not process any DENY entries); whereas /remove:d will presumably only remove the DENY entries, leaving any ALLOW entries unchanged. But of course I cannot be sure. – Oppress 12/11, 2018 at 2:36

Perfect... however, you should replace Everyone by *S-1-1-0 to be language independent. – Formalin 8/11, 2019 at 12:52

For me I needed takedown /r /f otherwise I got access denied – Transferase 27/8, 2023 at 3:37

@Transferase : It would be helpful if you could specify whether you are running Windows 7 or Windows 10. Did you establish the actual cause of the 'access denied' response? Was it that you had encountered an existing DENY setting? If so, did your suggested command remove the existing DENY setting? – Oppress 13/11, 2023 at 3:35

@Transferase : The correct command to take ownership (with recursion, to act on files in sub-folders as well as the current folder) would of course actually be: takeown /f filename /r – Oppress 13/11, 2023 at 3:56

I struggled with this for a while and only combining the answers in this thread worked for me (on Windows 10):
1. Open cmd or PowerShell and go to the folder with files
2. takeown /R /F .
3. icacls * /T /grant dan:F

Good luck!

Mc answered 27/12, 2015 at 15:8 Comment(0)

With an Excel vba script to provision and create accounts. I was needing to grant full rights permissions to the folder and subfolders that were created by the tool using our administrators 'x' account to our new user.

cacls looked something like this: cacls \FileServer\Users\Username /e /g Domain\Username:C

I needed to migrate this code to Windows 7 and beyond. My solution turned out to be:

icacls \FileServer\Users\Username /grant:r Domain\Username:(OI)(CI)F /t

/grant:r - Grants specified user access rights. Permissions replace previously granted explicit permissions. Without :r, permissions are added to any previously granted explicit permissions

(OI)(CI) - This folder, subfolders, and files.

F - Full Access

/t - Traverse all subfolders to match files/directories.

What this gave me was a folder on this server that the user could only see that folder and created subfolders, that they could read and write files. As well as create new folders.

Goatfish answered 23/4, 2014 at 16:38 Comment(0)

Just in case there is anyone else that stumbles on this page, if you want to string various permissions together in the one command, I used this:

icacls "c:\TestFolder" /grant:r Test_User:(OI)(CI)(RC,RD,RX)

Note the csv string for the various permissions.

Run answered 23/3, 2015 at 2:6 Comment(1)

Thank you much. It helped me to set the permission for RX & RD. In most of the example given in the Internet was explained with /F full permission, Which should not be case. – Ignatzia 5/8, 2015 at 14:46

XCACLS.VBS is a very powerful script that will change/edit ACL info. c:\windows\system32\cscript.exe xcacls.vbs help returns all switches and options.

You can get official distribution from Microsoft Support Page

Dither answered 20/9, 2012 at 15:26 Comment(3)

Can you provide a reference where XCACLS.VBS can be found? – Discontinuance 20/9, 2012 at 17:8

resources.oreilly.com/examples/9780735618688-files/blob/… – Oppress 14/10, 2020 at 15:2

The xcacls.vbs script does not run on Windows 7 or later. Presumably because it depends on cacls.exe which is no longer supported, having been superceded by icacls. – Oppress 13/11, 2023 at 3:45

Bulk folder creation and grant permission works me by using the below powershell script.

Import-Csv "D:\Scripts\foldernames.csv" | foreach-object {
    $username = $_.foldername 

    # foldername is the header of csv file

    $domain = “example.com”

    $folder= "D:\Users"

    $domainusername = $domain+“\”+$username

    New-Item $folder\$username –Type Directory

    Get-Acl $folder\$username  

    $acl = Get-Acl $folder\$username

    $acl.SetAccessRuleProtection($True, $False)

    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("Administrators","FullControl", "ContainerInherit, ObjectInherit", "None", "Allow")
    $acl.AddAccessRule($rule)

    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("SYSTEM","FullControl", "ContainerInherit, ObjectInherit", "None", "Allow")
    $acl.AddAccessRule($rule)

    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("$domain\Domain Admins","Read", "ContainerInherit, ObjectInherit", "None", "Allow")
    $acl.AddAccessRule($rule)

    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($domainusername,"Modify", "ContainerInherit, ObjectInherit", "None", "Allow")
    $acl.AddAccessRule($rule)

    Set-Acl $folder\$username $acl
}

Note: You have to create same domain username in csv file otherwise you will get permission issues

Strain answered 25/5, 2017 at 4:43 Comment(0)

i was not able to open any file in a drive, this command unlocked all -

icacls i:\* /grant Users:F /t /q /c

Domenicadomenico answered 2/1, 2023 at 13:34 Comment(1)

Before issuing this command, you probably need to take over the ownership first using: takeown /R /F "i:\*", then unlock with the above command, and then you can delete the directory using Windows Explorer. Don't forget also run the command as Administrator using command prompt. – Exceedingly 2/5, 2023 at 6:2

attrib +r +a +s +h <folder name> <file name> to hide
attrib -r -a -s -h <folder name> <file name> to unhide

Marijn answered 24/11, 2011 at 10:2 Comment(1)

Those are attributes of the file (read-only, archive, system, hidden) not permissions, which are linked to user accounts. – Retrieval 4/6, 2013 at 16:6

excellent point Călin Darie

I had a lot of scripts to use cacls I move them to icacls how ever I could not find a script to change the root mount volumes example: d:\datafolder. I finally crated the script below, which mounts the volume as a temporary drive then applies sec. then unmounts it. It is the only way I found that you can update the root mount security.

1 gets the folder mount GUID to a temp file then reads the GUID to mount the volume as a temp drive X: applies sec and logs the changes then unmounts the Volume only from the X: drive so the mounted folder is not altered or interrupted other then the applied sec.

here is sample of my script:

**mountvol "d:\%1" /L >tempDrive.temp && FOR /f "tokens=*" %%I IN (tempDrive.temp) DO mountvol X: %%I 
D:\tools\security\icacls.exe  %~2 /grant domain\group:(OI)(CI)F /T /C >>%~1LUNsec-%TDWEEK%-%TMONTH%-%TDAY%-%TYEAR%-%THOUR%-%TMINUTE%-%TAM%.txt
if exist x:\*.* mountvol X: /d**

Muncey answered 3/2, 2015 at 21:55 Comment(0)

I am Administrator and some script placed "Deny" permission on my name on all files and subfolders in a directory. Executing the icacls "D:\test" /grant John:(OI)(CI)F /T command did not work, because it seemed it did not remove the "Deny" right from my name from this list.

The only thing that worked for me is resetting all permissions with the icacls "D:\test" /reset /T command.

Equivocal answered 18/2, 2016 at 15:27 Comment(1)

It is possible to overcome the problem without using the reset command, by specifying ''/remove:d'' to delete any explicit DENY settings that may exist - see my perfect solution (above). – Oppress 19/3, 2018 at 9:2

navigate to top level directory you want to set permissions to with explorer
type cmd in the address bar of your explorer window
enter icacls . /grant John:(OI)(CI)F /T where John is the username
profit

Just adding this because it seemed supremely easy this way and others may profit - all credit goes to Călin Darie.

Dewdrop answered 21/7, 2020 at 21:48 Comment(0)

When I ran the command:

icacls "c:/path/to/folderA/folderB" /grant:r Everyone:(OI)(CI)F /T

None of the files in folderB were being processed, which was indicated via the output message:

Successfully processed 0 files; Failed processing 0 files

However, once I changed the specified path to the parent directory("c:/path/to/folderA") and re-ran the command all the files in folderB were successfully processed.

Note: If you want any other files/folders in folderA to not be processed, try moving all those files/folders to a different location before running the command above.

Hope this helps anyone running into the same issue.

Mckay answered 24/7, 2022 at 20:19 Comment(0)

For anyone needing to grant permissions to multiple drives, I created the following script:

@ECHO off
ECHO Run this with admin privileges
:: Change following variable to desired user or group
set UserOrGrp=Users
for %%d in (A B C D E F G H I J K L M N O P Q R S T U V W X Y Z) do (
    if EXIST %%d:\ (
        ECHO Taking ownership of drive %%d:\
        takeown /R /F %%d:\ /D Y /SKIPSL
        ECHO Granting full control to %UserOrGrp%
        icacls %%d:\* /Q /C /T /grant %UserOrGrp%:F
    )
)

Polinski answered 1/5, 2023 at 1:34 Comment(0)

-1

in windows 10 working without "c:>" and ">"

For example:

F = Full Control
/e : Edit permission and kept old permission
/p : Set new permission

cacls "file or folder path" /e /p UserName:F

(also this fixes error 2502 and 2503)

cacls "C:\Windows\Temp" /e /p UserName:F

Connective answered 10/1, 2020 at 9:9 Comment(0)

-5

This is what worked for me:

Manually open the folder for which the access is denied.
Select the Executable/application file in that folder.
Right-click on it and go to Properties -> Compatibility
Now see the Privilege Level and check it for Run As Administrator
Click on Change Settings for all users.

The problem is solved now.

Lodhia answered 31/3, 2013 at 5:29 Comment(1)

The question is for doing the above trough the command line. While your suggestion might work well, it is not applicable if you only have terminal access (ssh) to a sever which needs to be set up, thus you will need to use a cmd script – Impala 22/12, 2014 at 13:21

Hot tags

Godot Unity Godot Help Programming Godot 4.X GUI GDScript 3D 2D Physics CSharp Godot 3.X VR XR Projects C++

Recommended topics

Hot tags