Cacls

cacls and icacls are Microsoft Windows native command line utility capable of displaying and modifying Access Control List (ACL) on folders and files. An Access Control List is a list of permissions for securable object, such as a file or folder, that controls who can access it. Contents 1 CACLS 1.1 Criticism 1.1.1 SetACL-project 2 ICACLS 2.1 Examples 3 See also 4 References 5 External links CACLS This section requires expansion with: general description, examples and additional citations. Criticism This section contains weasel words, vague phrasing that often accompanies biased or unverifiable information. Such statements should be clarified or removed. (September 2009) The cacls utility is a command line editor of permissions in Windows 2000 and later. Microsoft has produced newer utilities such as xcacls.exe, xcacls.vbs, fileacl and icacls (Windows Vista), all of which offer improvements. SetACL-project Others, such as the SetACL team, have produced their own command-line and scriptable permissions editors. The documentation of a third-party free open-source replacement for cacls hosted on SourceForge, known as SetACL, suggests that cacls was invented for Windows NT 4.0 and is not suitable for use in Windows 2000 or later 1. Specifically, it notes that ACL inheritance was added in Windows 2000, but that neither the cacls utility nor the xcacls utility later released by Microsoft was properly updated to support it. The document expresses the opinion that Microsoft should have removed the utility from Windows 2000 rather than leave it in, only to have unwitting users internally disrupt a volume's security descriptors (by incorrectly ordering ACEs) in a way that's difficult to detect or recover from.citation needed This project's documentation explains that using the built-in cacls to apply permissions to a tree of folders creates a copy of the ACL for every single file and folder and applies it individually, which was correct under Windows NT 4.0, but which is disruptive in Windows 2000 and later, where the expected behavior is to create a single ACL marked as "inheritable" so future changes propagate automatically. ICACLS Windows Server 2003 Service Pack 2, Windows Vista and Windows Server 2008 include icacls, a command-line utility that can display, modify, backup and restore ACLs for files and folders, as well as to set mandatory labels of Windows Integrity Control for them. However, it is not a complete replacement for cacls. For example, it cannot be used to hand-code a Security Descriptor Definition Language (SDDL) string.clarification needed Examples Command Result icacls c:\windows\* /save AclFile /T Saves the ACLs for all items in c:\windows folder and its subfolders into a file named AclFile. icacls c:\windows\ /restore AclFile Restores the ACLs for every file within a file named AclFile to any relevant item that exists in c:\windows folder and its subfolders icacls file /grant Administrator:(D,WDAC) Grants the user named "Administrator" the Delete and Write permissions to a file named file. icacls file /grant *S-1-1-0:(D,WDAC) Grants the user or security group whose security identifier is S-1-1-0 the Delete and Write permissions to a file named file. icacls c:\windows\explorer.exe Displays the access control list for a file named c:\windows\explorer.exe. icacls file /setintegritylevel H Modifies the mandatory integrity level of an object named file to High See also SetACL chmod References This article includes a list of references, related reading or external links, but its sources remain unclear because it lacks inline citations. Please improve this article by introducing more precise citations where appropriate. (February 2008) ^ SetACL documentation External links Microsoft links Microsoft Windows XP Professional Product Documentation: "Cacls" Microsoft Knowledgebase: "How to use Xcacls.exe to modify NTFS permissions" Microsoft Knowledgebase: "How to use Xcacls.vbs to modify NTFS permissions" Microsoft Technet: "Xcacls Overview" Microsoft Technet: Windows Server 2008 Command-line Reference: "Icacls" MSDN Library: "DACLs and ACEs" SS64.com's description Computerhope.com's description SetACL documentation on SourceForge. Introduction to Windows Integrity Control ICACLS - ACLs Command line management: The Lazy Admin blog v · d · eWindows command line programs and built-ins (more) File system (basic) attrib · cd · chdir · copy · del · deltree · dir · erase · expand · fdisk · format · makecab · md · mkdir · mklink · mountvol · move · ntbackup · rd · rename · ren · rmdir · robocopy · sfc · sys · type · wbadmin · xcopy File system (advanced) assoc · cacls · chkdsk/scandisk · chkntfs · cipher · comp · compact · convert · defrag · diskcomp · diskcopy · diskpart · diskperf · fc · fixboot · fixmbr · fsutil · ftype · icacls · label · recover · regsvr32  · replace · rsm · subst · tree · verify · vol · vssadmin Processes at · exit · kill · schtasks · start · sc · shutdown · taskkill · tasklist · tlist Registry reg · regini User environment append · chcp · color · date · eventcreate · finger · graftabl · mode · path · pnputil · popd · pushd · runas · set · setver · setx · systeminfo · time · title · ver · wevtutil · whoami · winsat Text processing  · edlin · more · sort Shell programming break · call · cmd · command · cscript · doskey · echo · endlocal · for · goto · if · pause · powershell · prompt · rem · setlocal · shift · forfiles · choice Networking arp · atmadm · bitsadmin · cmstp · ftp · getmac · hostname · ipconfig · nbtstat · net · net use · netsh · netstat · nslookup · pathping · ping · rcp · rexec · route · rpcping · rsh · tcmsetup · telnet · tftp · tracert Searching find · findstr · where Miscellaneous bcdedit · bootcfg · clip · cls · Environment variables · help · print · debug · exe2bin · lpq · lpr · msiexec · pentnt · w32tm · wmic · powercfg (command)