Proper CACLS usage for setting folder permissions

Posted on 2006-05-19
Last Modified: 2008-01-09
I've begun using CACLS commands to set ACL permissions on our Win2K3 server, and its going great, saving a lot of time. But I have hit a stumbling block. I'll try to explain.

For examples sake, I'm assigning permissions for a security grouped called "Office" on a folder structure as follows:


Desired Permissions are:

Folder_A - READ (Root Folder Above the share)
Folder_B - READ (One folder of many in the share)
Folder_C - Change/Modify
Folder_D - Change/Modify

To further explain, there is a structure in place here, in which no one should be able to create, delete or modify any folders within the first two level Folders, A or B.

Below that, in Folders C and D, the group should be able to create, delete and modify folders or files.

I was able to achieve the desired result of granting the "Change" permission to the group for Folders B, C and D by using the following command, while at the "T:\Folder_A>" dos prompt:

T:\Folder_A>cacls *.* /e /t /g "Office":C

Now I want to assign the READ permission for Folder_B, but am getting stuck. I tried this command while at the Folder_A dos prompt:

T:\Folder_A>cacls Folder_B /e /g "Office":R

It shows the directory was processed, but when checking the permissions afterward, the Office group still has "Change" permissions to the folder. Also Folder_B is not inheriting any permissions.

A cacls Folder_B command, yields this output (I'm a little confused on reading this just yet):

BUILTIN\Users:(CI)(special access:)


Any idea's? I'm probably just going about this the wrong way...

Question by:waltb123
    LVL 33

    Expert Comment

    Check the properties of folder B... by right clicking it in explorer.  I would guess that the Office NTFS rights are being propagated down from a higher folder.  You would have to click Advanced and uncheck inheret from the parent folder.  Then choose copy permissions...

    Then re-run your cacls...

    -just a thought.

    Author Comment

    Thanks for the shot at it NJ (Im in NJ btw), but as mentioned above, Folder_B inheritance is not on (I just double checked too).

    Author Comment

    This question can be closed as I was able to find the answer on microsofts file system newsgroup.

    The correct formatting of the command needed to do what I needed was:

    cacls Folder_B /e /p "Office":R

    (Note the change from /g  /p)
    LVL 1

    Accepted Solution

    PAQed with points refunded (500)

    Community Support Moderator

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    This may not be a text book method to resolve VSS backup issues but it seemed to have worked on few of the Windows 2003 servers we had issues while performing a Volume Shadow Copy backup. If you have issues while performing a shadow copy backup usin…
    I've always wanted to allow a user to have a printer no matter where they login. The steps below will show you how to achieve just that. In this Article I'll show how to deploy printers automatically with group policy and then using security fil…
    Sending a Secure fax is easy with eFax Corporate ( First, Just open a new email message.  In the To field, type your recipient's fax number You can even send a secure international fax — just include t…
    Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…

    760 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    12 Experts available now in Live!

    Get 1:1 Help Now