• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 217
  • Last Modified:

Running a script to change icacls permissions but it needs to run twice over to work


In the script below I am trying to

• Remove inheritance derived from parent folder.
• Remove “Authenticated Users” – the *s-1-5-11 SID
• Add a Domain group

for /f %%R in (subfldrs_Test.txt) do icacls c:\testben\%%R /inheritance:d /remove:g *s-1-5-11 /grant:r "mf\mf_test":(OI)(CI)RX >> c:\testben\results.log

Unfortunately I have run to run the command twice to have the inheritance removed. is there a way I can do all three in one single line without running it again?
2 Solutions
How often do you need to run this script?
and on how many systems?
If you run the command directly as a test, does it error out?

You are running a loop, what is the issue with issuing the icalcs commands in squence that works?

Your issue is likely the inability of icalcs to resolve the group name "mf\mf_test"

You can run the command once by replacing the group name, with the group's SID
Just for clarity one way to obtain the group SiD is dsquery group -name "groupname"  | dsget group -sid (run it on a DC where these tools should be available)

for /f %%R in (subfldrs_Test.txt) do icacls c:\testben\%%R /inheritance:d /remove:g *s-1-5-11 /grant:r *<sid of group you want to add>:(OI)(CI)RX >> c:\testben\results.log

Open in new window

These are part of the RSAT (if missing here is a way to add them https://technet.microsoft.com/en-us/library/cc731420%28v=WS.10%29.aspx)
Lionel MMSmall Business IT ConsultantCommented:
I have found that running icacls works best with remove and grant as 2 separate commands. also I don not use domain\groupname--groupname only works
for /f %%R in (subfldrs_Test.txt) do icacls c:\testben\%%R /inheritance:d /remove:g *s-1-5-11 >> c:\testben\results-remove.log
for /f %%R in (subfldrs_Test.txt) do icacls /grant:r "groupname":(OI)(CI)RX >> c:\testben\results-grant.log
rhiancohenVMware Senior ConsultantAuthor Commented:
Thanks very much for the comments. I'll post back here when I've given it a try.

Featured Post


Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now