4

I need to add full permissions for a specific group of users to all folders/files and subfolders on our file server without changing other permissions.

Few years ago someone removed "Administrators" group from our folder infrastructure on the file server and all the new folders have been created with "Domain Admins" rights. Now I have created a dedicated Active directory group which is a member of local administrators on the file server but I cannot give this group access to all folders and subfolders because inheritance is disabled on many subfolders and files. I am aware that I can add this group manually for every folder where inheritance is disabled but we are talking here about few hundreds folders. So is it possible to give this new AD group full access to all folders on the file server?

Binarylab
  • 92
  • 1
  • 1
  • 5

1 Answers1

4

You might use icacls.exe

For example:

icacls "<root folder>" /grant "Domain Admins":F /t

would add Full Access to the "Domain Admins" group to the "root folder" and every folder within.

If you add ":r" after Grant then the permissions would be replaced instead of being added.

 icacls "<root folder>" /grant:r "Domain Admins":F /t

The basic permissions are:

Full Control (F)
Modify (M)
Read & Execute (RX)
List Folder Contents (X,RD,RA,REA,RC)
Read (R)
Write (W)

Advanced permissions are:

Full Control (F)
Traverse folder / execute file (X)
List folder / read data (RD)
Read attributes (RA)
Read extended attributes (REA)
Create file / write data (WD)
Create folders / append data (AD)
Write attributes (WA)
Write extended attributes (WEA)
Delete subfolders and files (DC)
Delete (D)
Read permissions (RC)
Change permissions (WDAC)
Take ownership (WO)

You can also specify the inheritance for the folders:

This folder only
This folder, subfolders and files (OI)(CI)
This folder and subfolders (CI)
This folder and files (OI)
Subfolders and files only (OI)(CI)(NP)(IO)
Subfolders only (CI)(IO)
Files only (OI)(IO)
Pennino
  • 169
  • 1
  • 9
  • Thanks! It solved my problem. The strange thing is that after I've ran following command: icacls "D:\FS" /grant "Tier2Admins":F /t, the Tier2Admins group got "special permissions" instead of Full control in ACL. But in Advanced Security Settings its Full control. – Binarylab Dec 27 '15 at 11:28
  • I guess it is because if you look at the advanced properties, you will notice that you have probably set `Full Control` to `This folder only`. The "GUI" Full Control permissions assign the `This folder, subfolders and files` privilege instead. To give that privilege you need to run the command with the additional specifiers like: `icacls "D:\FS" /grant "Tier2Admins":(OI)(CI)F /t`. – Pennino Dec 27 '15 at 20:52