/kb/825751
Microsoft provides an updated version of the Extended Change Access Control List tool () in the form of Microsoft Visual Basic scripts (). This article describes how to use scripts to modify and view NTFS file system permissions for files or folders. You can use from the command line to set all file system security options that are accessible in Microsoft Windows Explorer. Access control list (ACL) that can display and modify files.
Note: Compatible with Microsoft Windows 2000, Microsoft Windows XP, and Microsoft Windows Server 2003 only. Microsoft does not support it.
Back to the top
Setting up and using
To set up and use , follow these steps:
The latest version obtained from the following Microsoft websites:
/download/f/7/8/f786aaf3-a37b-45ab-b0a2-8c8c18bbf483/XCacls_Installer.exe (/download/f/7/8/f786aaf3-a37b-45ab-b0a2-8c8c18bbf483/xcacls_installer.exe)
Double-click "Xcacls_Installer.exe". When prompted to provide a location to place the extracted file, specify a folder located in the search path settings of your computer (such as C:\Windows).
Change the default script engine from Wscript to Cscript. (Scripts are best for running under Cscript.) To do this, type the following at the command prompt and press Enter:
/h:cscript
Note: Changing the default script engine to Cscript only affects how scripts are written to the screen. Wscript writes each row according to the OK dialog box. Cscript Writes each line to the command window. If you do not want to change the default script engine, you must run the script with the following command
However, if you change the default script to Cscript, you can run the script with the following command:
.
To view the command syntax, type the following command at the command prompt:
/?
Command syntax
The following /? command output describes the syntax of the command:
Usage:
XCACLS filename [/E] [/G user:perm;spec] [...] [/R user [...]]
[/F] [/S] [/T]
[/P user:perm;spec [...]] [/D user:perm;spec] [...]
[/O user] [/I ENABLE/COPY/REMOVE] [/N
[/L filename] [/Q] [/DEBUG]
filename [Required] If used alone, it displays ACLs.
(Filename can be a filename, directory name or
wildcard characters and can include the whole
path. If path is missing, it is assumed to be
under the current directory.)
Notes:
- Put filename in quotes if it has spaces or
special characters such as &, $, #, etc.
- If filename is a directory, all files and
subdirectories under it will NOT be changed
unless the /F or S is present.
/F [Used with Directory or Wildcard] This will change all
files under the inputted directory but will NOT
traverse subdirectories unless /T is also present.
If filename is a directory, and /F is not used, no
files will be touched.
/S [Used with Directory or Wildcard] This will change all
subfolders under the inputted directory but will NOT
traverse subdirectories unless /T is also present.
If filename is a directory, and /S is not used, no
subdirectories will be touched.
/T [Used only with a Directory] Traverses each
subdirectory and makes the same changes.
This switch will traverse directories only if the
filename is a directory or is using wildcard characters.
/E Edit ACL instead of replacing it.
/G user:GUI Grant security permissions similar to Windows GUI
standard (non-advanced) choices.
/G user:Perm;Spec Grant specified user access rights.
(/G adds to existing rights for user)
User: If User has spaces in it, enclose it in quotes.
If User contains #machine#, it will replace
#machine# with the actual machine name if it is a
non-domain controller, and replace it with the
actual domain name if it is a domain controller.
New to 3.0: User can be a string representing
the actual SID, but MUST be lead by SID#
Example: SID#S-1-5-21-2127521184-160...
(SID string shown has been shortened)
(If any user has SID# then globally all
matches must match the SID (not name)
so if your intention is to apply changes
to all accounts that match Domain\User
then do not specify SID# as one of the
users.)
GUI: Is for standard rights and can be:
Permissions...
F Full control
M Modify
X read and eXecute
L List folder contents
R Read
W Write
Note: If a ; is present, this will be considered
a Perm;Spec parameter pair.
Perm: Is for "Files Only" and can be:
Permissions...
F Full control
M Modify
X read and eXecute
R Read
W Write
Advanced...
D Take Ownership
C Change Permissions
B Read Permissions
A Delete
9 Write Attributes
8 Read Attributes
7 Delete Subfolders and Files
6 Traverse Folder / Execute File
5 Write Extended Attributes
4 Read Extended Attributes
3 Create Folders / Append Data
2 Create Files / Write Data
1 List Folder / Read Data
Spec is for "Folder and Subfolders only" and has the
same choices as Perm.
/R user Revoke specified user's access rights.
(Will remove any Allowed or Denied ACL's for user.)
/P user:GUI Replace security permissions similar to standard choices.
/P user:perm;spec Replace specified user's access rights.
For access right specification see /G option.
(/P behaves like /G if there are no rights set for user.)
/D user:GUI Deny security permissions similar to standard choices.
/D user:perm;spec Deny specified user access rights.
For access right specification see /G option.
(/D adds to existing rights for user.)
/O user Change the Ownership to this user or group.
/I switch Inheritance flag. If omitted, the default is to not touch
Inherited ACL's. Switch can be:
ENABLE - This will turn on the Inheritance flag if
it is not on already.
COPY - This will turn off the Inheritance flag and
copy the Inherited ACL's
into Effective ACL's.
REMOVE - This will turn off the Inheritance flag and
will not copy the Inherited
ACL's. This is the opposite of ENABLE.
If switch is not present, /I will be ignored and
Inherited ACL's will remain untouched.
/L filename Filename for Logging. This can include a path name
if the file is not under the current directory.
File will be appended to, or created if it does not
exit. Must be Text file if it exists or error will occur.
If filename is omitted, the default name of XCACLS will
be used.
/Q Turn on Quiet mode. By default, it is off.
If it is turned on, there will be no display to the screen.
/DEBUG Turn on Debug mode. By default, it is off.
If it is turned on, there will be more information
displayed and/or logged. Information will show
Sub/Function Enter and Exit as well as other important
information.
/SERVER servername Enter a remote server to run script against.
/USER username Enter Username to impersonate for Remote Connections
(requires PASS switch). Will be ignored if it is for a Local Connection.
/PASS password Enter Password to go with USER switch
(requires USER switch).
Wildcard characters can be used to specify more than one file in a command, such as:
* Any string of zero or more characters
? Any single character
You can specify more than one user in a command.
You can combine access rights.
Use View Permissions
You can also use permissions to view files or folders. For example, if you have a folder named C:\Test, type the following command at the command prompt to view folder permissions, and press Enter:
c:\test
The following example is a typical result:
C:\> c:\test
Microsoft (R) Windows Script Host 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.
Starting (Version: 3.4) Script at 6/11/2003 10:55:21 AM
Startup directory:
"C:\test"
Arguments Used:
Filename = "c:\test"
**************************************************************************
Directory:C:\test
Permissions:
Type Username Permissions Inheritance
Allowed BUILTIN\Administrators Full Control This Folder, Subfolde
Allowed NT AUTHORITY\SYSTEM Full Control This Folder, Subfolde
Allowed Domain1\User1 Full Control This Folder Only
Allowed \CREATOR OWNER Special (Unknown) Subfolders and Files
Allowed BUILTIN\Users Read and Execute This Folder, Subfolde
Allowed BUILTIN\Users Create Folders / Appe This Folder and Subfo
Allowed BUILTIN\Users Create Files / Write This Folder and Subfo
No Auditing set
Owner:Domain1\User1
Note: In this example, the output of the c:\test command is consistent with the text displayed in the graphical user interface (GUI). Some text in the command window is incomplete.
The output also gives the script version, startup directory, and parameters used.
You can also use wildcards to display matching files in the directory. For example, if you type the following command, all files with the ".log" extension in the C:\Test folder will be displayed:
c:\test\*.log
Example
The following command provides some examples of usage:
c:\test\ /g domain\testuser1:f /f /t /e
This command edits existing permissions. It grants Domain\TestUser1 full control of all files under C:\Test, iterates over the subfolders under C:\Test, and then changes all files found. This command does not touch the directory.
c:\test\ /g domain\testuser1:f /s /l "c:\"
This command replaces existing permissions. It grants Domain\TestUser1 full control of all subfolders under C:\Test and records to C:\. This command does not touch the file and does not traverse the directory.
c:\test\ /o "machinea\group1"
This command changes the owner of the readme file to group MachineA\Group1.
c:\test\ /r "machinea\group1" /r "domain\testuser1"
This command revokes the C:\Test\ permissions of MachineA\Group1 and Domain\TestUser1.
c:\test\subdir1 /i enable /q
This command will open inheritance on folder C:\Test\Subdir1. This command will cancel any screen output.
\\servera\sharez\ /p "domain\group2":14
This command is remotely connected to \\ServerA\ShareZ by using Windows Management Instrumentation (WMI). Then get the local path for the share, under which it changes permissions on. It retains the existing permissions of Domain\Group2 in its original form, but adds permissions 1 (read data) and permissions 4 (read extended properties). This command abandons other permissions on this file because the /e switch is not used.
d:\ /g "domain\group2":f /server servera /user servera\admin /pass password /e
This command uses WMI as ServerA\Admin to remotely connect to ServerA and grants full permissions on Domain\Group2. Existing permissions for Domain\Group2 are missing, but other permissions on the file are retained.
Microsoft provides an updated version of the Extended Change Access Control List tool () in the form of Microsoft Visual Basic scripts (). This article describes how to use scripts to modify and view NTFS file system permissions for files or folders. You can use from the command line to set all file system security options that are accessible in Microsoft Windows Explorer. Access control list (ACL) that can display and modify files.
Note: Compatible with Microsoft Windows 2000, Microsoft Windows XP, and Microsoft Windows Server 2003 only. Microsoft does not support it.
Back to the top
Setting up and using
To set up and use , follow these steps:
The latest version obtained from the following Microsoft websites:
/download/f/7/8/f786aaf3-a37b-45ab-b0a2-8c8c18bbf483/XCacls_Installer.exe (/download/f/7/8/f786aaf3-a37b-45ab-b0a2-8c8c18bbf483/xcacls_installer.exe)
Double-click "Xcacls_Installer.exe". When prompted to provide a location to place the extracted file, specify a folder located in the search path settings of your computer (such as C:\Windows).
Change the default script engine from Wscript to Cscript. (Scripts are best for running under Cscript.) To do this, type the following at the command prompt and press Enter:
/h:cscript
Note: Changing the default script engine to Cscript only affects how scripts are written to the screen. Wscript writes each row according to the OK dialog box. Cscript Writes each line to the command window. If you do not want to change the default script engine, you must run the script with the following command
However, if you change the default script to Cscript, you can run the script with the following command:
.
To view the command syntax, type the following command at the command prompt:
/?
Command syntax
The following /? command output describes the syntax of the command:
Copy the codeThe code is as follows:
Usage:
XCACLS filename [/E] [/G user:perm;spec] [...] [/R user [...]]
[/F] [/S] [/T]
[/P user:perm;spec [...]] [/D user:perm;spec] [...]
[/O user] [/I ENABLE/COPY/REMOVE] [/N
[/L filename] [/Q] [/DEBUG]
filename [Required] If used alone, it displays ACLs.
(Filename can be a filename, directory name or
wildcard characters and can include the whole
path. If path is missing, it is assumed to be
under the current directory.)
Notes:
- Put filename in quotes if it has spaces or
special characters such as &, $, #, etc.
- If filename is a directory, all files and
subdirectories under it will NOT be changed
unless the /F or S is present.
/F [Used with Directory or Wildcard] This will change all
files under the inputted directory but will NOT
traverse subdirectories unless /T is also present.
If filename is a directory, and /F is not used, no
files will be touched.
/S [Used with Directory or Wildcard] This will change all
subfolders under the inputted directory but will NOT
traverse subdirectories unless /T is also present.
If filename is a directory, and /S is not used, no
subdirectories will be touched.
/T [Used only with a Directory] Traverses each
subdirectory and makes the same changes.
This switch will traverse directories only if the
filename is a directory or is using wildcard characters.
/E Edit ACL instead of replacing it.
/G user:GUI Grant security permissions similar to Windows GUI
standard (non-advanced) choices.
/G user:Perm;Spec Grant specified user access rights.
(/G adds to existing rights for user)
User: If User has spaces in it, enclose it in quotes.
If User contains #machine#, it will replace
#machine# with the actual machine name if it is a
non-domain controller, and replace it with the
actual domain name if it is a domain controller.
New to 3.0: User can be a string representing
the actual SID, but MUST be lead by SID#
Example: SID#S-1-5-21-2127521184-160...
(SID string shown has been shortened)
(If any user has SID# then globally all
matches must match the SID (not name)
so if your intention is to apply changes
to all accounts that match Domain\User
then do not specify SID# as one of the
users.)
GUI: Is for standard rights and can be:
Permissions...
F Full control
M Modify
X read and eXecute
L List folder contents
R Read
W Write
Note: If a ; is present, this will be considered
a Perm;Spec parameter pair.
Perm: Is for "Files Only" and can be:
Permissions...
F Full control
M Modify
X read and eXecute
R Read
W Write
Advanced...
D Take Ownership
C Change Permissions
B Read Permissions
A Delete
9 Write Attributes
8 Read Attributes
7 Delete Subfolders and Files
6 Traverse Folder / Execute File
5 Write Extended Attributes
4 Read Extended Attributes
3 Create Folders / Append Data
2 Create Files / Write Data
1 List Folder / Read Data
Spec is for "Folder and Subfolders only" and has the
same choices as Perm.
/R user Revoke specified user's access rights.
(Will remove any Allowed or Denied ACL's for user.)
/P user:GUI Replace security permissions similar to standard choices.
/P user:perm;spec Replace specified user's access rights.
For access right specification see /G option.
(/P behaves like /G if there are no rights set for user.)
/D user:GUI Deny security permissions similar to standard choices.
/D user:perm;spec Deny specified user access rights.
For access right specification see /G option.
(/D adds to existing rights for user.)
/O user Change the Ownership to this user or group.
/I switch Inheritance flag. If omitted, the default is to not touch
Inherited ACL's. Switch can be:
ENABLE - This will turn on the Inheritance flag if
it is not on already.
COPY - This will turn off the Inheritance flag and
copy the Inherited ACL's
into Effective ACL's.
REMOVE - This will turn off the Inheritance flag and
will not copy the Inherited
ACL's. This is the opposite of ENABLE.
If switch is not present, /I will be ignored and
Inherited ACL's will remain untouched.
/L filename Filename for Logging. This can include a path name
if the file is not under the current directory.
File will be appended to, or created if it does not
exit. Must be Text file if it exists or error will occur.
If filename is omitted, the default name of XCACLS will
be used.
/Q Turn on Quiet mode. By default, it is off.
If it is turned on, there will be no display to the screen.
/DEBUG Turn on Debug mode. By default, it is off.
If it is turned on, there will be more information
displayed and/or logged. Information will show
Sub/Function Enter and Exit as well as other important
information.
/SERVER servername Enter a remote server to run script against.
/USER username Enter Username to impersonate for Remote Connections
(requires PASS switch). Will be ignored if it is for a Local Connection.
/PASS password Enter Password to go with USER switch
(requires USER switch).
Wildcard characters can be used to specify more than one file in a command, such as:
* Any string of zero or more characters
? Any single character
You can specify more than one user in a command.
You can combine access rights.
Use View Permissions
You can also use permissions to view files or folders. For example, if you have a folder named C:\Test, type the following command at the command prompt to view folder permissions, and press Enter:
c:\test
The following example is a typical result:
Copy the codeThe code is as follows:
C:\> c:\test
Microsoft (R) Windows Script Host 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.
Starting (Version: 3.4) Script at 6/11/2003 10:55:21 AM
Startup directory:
"C:\test"
Arguments Used:
Filename = "c:\test"
**************************************************************************
Directory:C:\test
Permissions:
Type Username Permissions Inheritance
Allowed BUILTIN\Administrators Full Control This Folder, Subfolde
Allowed NT AUTHORITY\SYSTEM Full Control This Folder, Subfolde
Allowed Domain1\User1 Full Control This Folder Only
Allowed \CREATOR OWNER Special (Unknown) Subfolders and Files
Allowed BUILTIN\Users Read and Execute This Folder, Subfolde
Allowed BUILTIN\Users Create Folders / Appe This Folder and Subfo
Allowed BUILTIN\Users Create Files / Write This Folder and Subfo
No Auditing set
Owner:Domain1\User1
Note: In this example, the output of the c:\test command is consistent with the text displayed in the graphical user interface (GUI). Some text in the command window is incomplete.
The output also gives the script version, startup directory, and parameters used.
You can also use wildcards to display matching files in the directory. For example, if you type the following command, all files with the ".log" extension in the C:\Test folder will be displayed:
c:\test\*.log
Example
The following command provides some examples of usage:
c:\test\ /g domain\testuser1:f /f /t /e
This command edits existing permissions. It grants Domain\TestUser1 full control of all files under C:\Test, iterates over the subfolders under C:\Test, and then changes all files found. This command does not touch the directory.
c:\test\ /g domain\testuser1:f /s /l "c:\"
This command replaces existing permissions. It grants Domain\TestUser1 full control of all subfolders under C:\Test and records to C:\. This command does not touch the file and does not traverse the directory.
c:\test\ /o "machinea\group1"
This command changes the owner of the readme file to group MachineA\Group1.
c:\test\ /r "machinea\group1" /r "domain\testuser1"
This command revokes the C:\Test\ permissions of MachineA\Group1 and Domain\TestUser1.
c:\test\subdir1 /i enable /q
This command will open inheritance on folder C:\Test\Subdir1. This command will cancel any screen output.
\\servera\sharez\ /p "domain\group2":14
This command is remotely connected to \\ServerA\ShareZ by using Windows Management Instrumentation (WMI). Then get the local path for the share, under which it changes permissions on. It retains the existing permissions of Domain\Group2 in its original form, but adds permissions 1 (read data) and permissions 4 (read extended properties). This command abandons other permissions on this file because the /e switch is not used.
d:\ /g "domain\group2":f /server servera /user servera\admin /pass password /e
This command uses WMI as ServerA\Admin to remotely connect to ServerA and grants full permissions on Domain\Group2. Existing permissions for Domain\Group2 are missing, but other permissions on the file are retained.