icacls equivalents of explorer basic permissions

Question

I am using icacls to set permissions on a large number of directories for various groups. I want to assign what icacls help refers to as "modify access". It seems to do this correctly. However when the rights are viewed with Windows Explorer permissions tab on Windows 2008 the group shows up with no rights at all (no check boxes checked in the "Allow" column). One must click "Advanced -> Change Permissions -> Edit" to actually see that the group has been granted all permissions except "Full", "Delete Subfolders and Files", "Change Permissions" and "Take Ownership".

Now, from a purely functional point of view this is acceptable. The group has the desired rights. However, from an administrative point of view this could be confusing to someone further down the road when they see the group in the list on the first screen of the permissions tab but no rights appear to be assigned until you look at advanced permissions.

So my question is: Is there some way with icacls to assign the Modify right in such a way that it shows up on the first screen of the security tab as being so? In other words, with check marks in the allow column for "Modify", "Read & Excecute", "List folder contents", "Read" and "Write"?

Rex · Accepted Answer · 2013-10-10T22:18:37.097

3

What is the command line you are using to assign the permissions?

Try this one:

icacls <directory> /grant <user>:(CI)(OI)(M)

edited Oct 10 '13 at 22:18

answered Jun 19 '12 at 14:07

Rex

7,895
3
29
45

Oops! I meant to include the command. Unfortunately I closed the cmd.exe window and don't have it anymore but it was more or less `icacls /t /grant user:m` – John Fitzpatrick Jun 19 '12 at 15:38
Brilliant! It worked. So the inheritance flags are required for Windows Explorer to consider it a "non-special" privilege? – John Fitzpatrick Jun 19 '12 at 15:42
there's a syntax error in the example. It should be a space, not a colon, after `/grant`. – matt wilkie Oct 10 '13 at 22:09
@mattwilkie you are correct. Updated the answer – Rex Oct 10 '13 at 22:19

icacls equivalents of explorer basic permissions

1 Answers1