Integrity Control Access Control List (icacls)

A CLI utility for showing and editing permissions on NTFS-formatted volumes.

Basic Syntax

icacls [<Path>...] [/grant[:r] <UserOrGroup>:<Rights>]
        [/deny:<UserOrGroup>:<Rights>]
        [/setowner <OwnerName>]
        [/inheritance:{e|r}]
        [/remove:<UserOrGroup>]
        [/reset]
        [/save <FileName>] [/restore <FileName>]
        [/t] [/c] [/q]

where

• <Path> can be a file, folder or * for all items in directory.
• /t recurse into sub-folders
• /c continue if errors occur.
• /q quiet mode, i.e. gives no output.

If only <Path> is passed as argument, then it simply displays the permissions of files and folders on <Path>.

Permissions

Symbol	Meaning
F	Full control
M	Modify
RX	Read & execute (list files and open them)
R	Read
W	Write (create, modify, delete files)
D	Delete
E	Enumerate subfolders & files (used by some tools)
D:P	Delete permission with protected flag (prevents inheritance from parent)

Inheritance

Permissions of a parent folder can be inherited by a child sub-folders/file with the following settings:

Flag	Meaning
(CI)	Container inherit
(OI)	Object inherit
(IO)	Inherit only
(NP)	Do not propagate inherit
(I)	Permission inherited from parent container