How to exclude sub-directory from cacls processing in batch file

Question

Suppose I have a directory myDir tree with many nested sub-directories. I grant full access to this directory with all its files and nested sub-directories to myUser with command:

cacls myDir /T /E /G myUser:F

So far, so good.

Now I have a sub-directory myDir/A/B/C which I would like to exclude from the cacls processing. That is, I would not like to grant myUser access to this sub-directory.

What would you suggest?

The simplest way is just to move this folder to another place before running cacls and move it back after that. Does it make sense?

Another solution is to add a second command that removes the `myuser` access from the folder. — foxidrive, Aug 22 '13 at 00:33

score 3 · Answer 1 · answered Aug 21 '13 at 22:01

Inherited folder permissions are displayed as:

OI - Object inherit - This folder and files. (no inheritance to subfolders)
CI - Container inherit - This folder and subfolders.
IO - Inherit only - The ACE does not apply to the current file/directory

These can be combined as folllows:
(OI)(CI) This folder, subfolders, and files.
(OI)(CI)(IO) Subfolders and files only.
(CI)(IO) Subfolders only.
(OI) (IO) Files only.

So BUILTIN\Administrators:(OI)(CI)F means that both files and Subdirectories will inherit 'F' (Fullcontrol)
similarly (CI)R means Directories will inherit 'R' (Read folders only = List permission)

To actually change the inheritance of a folder/directory use iCACLS /grant or iCACLs /deny

The question was about how to make cacls not chane the permissions of a specific folder when processing the entire tree. Permissions are set on each object, and inheritance is not automatic. Just setting a permission to be inherited doesn't change the permissions of any existing children - it basically just acts as the default ACL template to be used when creating new children. — joeking, Aug 22 '13 at 17:45

score 2 · Answer 2 · answered Aug 21 '13 at 21:56

You need to generate a list of files to be processed and exclude the ones you don't want since CACLS doesn't allow filtering.

Here, I use "dir" to generate the list of files to process. You could use "forfiles" as well.

(You can make the script more compact using pipes, but I used temporary files instead just to make it more clear).

@echo off
setlocal

set TMPFILE=%TEMP%\dirs.txt
set TMPFILE2=%TEMP%\dirs2.txt

@rem Generate the list of dir names to be processed
dir "%~1" /ad /s /b /p > %TMPFILE%

@rem Filter out the unwanted ones
findstr /i /v /C:"myDir\A\B\C" < %TMPFILE% > %TMPFILE2%

@rem And execute a command on each
for /F "delims=;" %%x in (%TMPFILE2%) do call :dostuff "%%x"

goto :EOF

:dostuff
    @rem do the directory itself
    cacls "%~1\ /E /G myUser:F

    @rem do the files
    cacls "%~1\*" /E /G myUser:F

    goto :EOF

How to exclude sub-directory from cacls processing in batch file

2 Answers2