How to set NTFS permissions for a folder to deny access for all but one

Posted on 2013-09-26
Medium Priority
Last Modified: 2013-09-26

I need to disable access to certain folder for all user and groups except one user or group.
For example - folder "MyFolder", I need:
Administrators group = deny all access
Users group = deny all access
Trusted Installed = deny all access
(this line is optional) system = deny all access
MySpecialGroup group = enable all access

Optionally, instead of last line could be this line:
MySpecialUser user = enable all access

So, I'm ok with any of two - enable access for one particular group or for one particular user.

Is it possible to do on Windows 7/Server 2008/2012 ?
I mean - Windows 7 Ultimate or Enterprise. Windows server 2008 R2 or Server 2012.

Thank you in advance.
Question by:Dmitry_Bond
  • 2
  • 2
  • 2
LVL 20

Assisted Solution

strivoli earned 450 total points
ID: 39524043
Just clear all ACLs entries and add the SpecialGroup or the SpecialUser.

Assisted Solution

by:Sumit Gupta
Sumit Gupta earned 1050 total points
ID: 39524050
Everyone: Uncheck all boxes
Your user: Check "Full control"
Remove any other user/Groups.

Author Comment

ID: 39524070
Is it possible to do it with standard cmdline (or maybe - with SysInternals tools)? Without PowerShell or other 3rd party tools?
Get your problem seen by more experts

Be seen. Boost your question’s priority for more expert views and faster solutions


Accepted Solution

Sumit Gupta earned 1050 total points
ID: 39524084
This is how you grant John full control over D:\test folder and all its subfolders:

C:>icacls "D:\test" /grant John:(OI)(CI)F

According do MS documentation:

F= Full Control
CI= Container Inherit - This flag indicates that subordinate containers will inherit this ACE.
OI= Object Inherit - This flag indicates that subordinate files will inherit the ACE.

For more details with examples here is the link from Microsoft:

LVL 20

Expert Comment

ID: 39524085
Sure you can do it with a standard cmdline. Can't you use the simplest method: the GUI?

Author Closing Comment

ID: 39524147
It works. Thanks.

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Recently, I read that Microsoft has analysed statistics for their security intelligence report. It revealed: still, the clear majority of windows users do their daily work as administrator. An administrative account is a burden, security-wise. My ar…
One thing I've always found frustrating is no matter how many times one asks the end users to not save things on their local machines, they do it anyway.  Forget that we don't back up the desktops - only the servers.  Well, let's sneak their data on…
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…

624 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question