Using iCACLS Command to Manage File and Folder Permissions on Windows

7.1K

The built-in Windows ICACLS.exe command is used to manage file and folder permissions from the command prompt.

This command is most often used in scripts and automated tasks to grant, modify, remove, or back up NTFS permissions on files or directories to users and/or groups. It is sometimes easier and more efficient to configure access control lists (ACLs) on a file system object using the icacls command in the CLI than to adjust NTFS permissions using the Security tab in the File Explorer GUI.

What Is iCACLS in Windows

The icacls (Integrity Control Access Control List) command is a native Windows command-line tool that allows users to view, modify, backup, and restore permissions for files and folders on NTFS file systems. It is the modern replacement for the legacy cacls command.

To get help on icacls syntax, all available flags, and some useful usage examples, run it without switches:

icacls.exe

How to View NTFS Permissions Using iCACLS

Enter the full path of the file or folder to list the NTFS permissions currently assigned to it:

icacls C:\DOCs\IT_Dept

This command returns a list of permissions for an object in the format of a Discretionary Access Control List (DACL). The DACL contains a set of Access Control Entry (ACE) entries, each of which describes a user or group and the NTFS permissions assigned to it. It is similar to the list of NTFS permissions that you can see on the Security tab of the file properties in File Explorer.

Understanding ICACLS Output (ACE Entry Breakdown)

The ACE entry has the following format:

Security principal : permission levels

What does a typical ACE entry include? For example:

CONTOSO\fs01-IT_dept_R:(OI)(CI)(RX)

CONTOSO\fs01-IT_dept_R is a security principal (group or user) to which permissions are assigned.

The list of permissions assigned to the security principal follows the colon (:).

• (OI) — object inherit;
• (CI) — container inherit;
• (RX) — Read and Execute access.

Viewing Permissions in File Explorer

You can see what the same ACE entry looks like in File Explorer GUI:

1. Open the file or folder properties;
2. Navigate to the Permissions tab;
3. Click Advanced;
4. The list of all assigned ACE records is shown on the Permissions tab.

   

iCACLS Permission Abbreviations Explained

Below is a complete list of permission abbreviations used in iCACLS:

Basic access permissions:

• F  —  full access (Read, Write, Modify, Delete, Change)
• M  —  modify (Read, Write, and Delete)
• RX  —  read and execute access
• R  —  read-only access
• W  —  write-only access
• D  —  delete only
• N – no access

Advanced permissions:

• DE  —  delete
• RC  —  read control
• WDAC  —  write DAC
• WO —  write owner
• S  —  synchronize
• AS  —  access system security
• MA  —  the maximum allowed permissions
• GR  —  generic read
• GW  —  generic write
• GE  —  generic execute
• GA  —  generic all
• RD  —  read data/list directory
• WD  —  write data/add file
• AD  — append data/add subdirectory
• REA  —  read extended attributes
• WEA  —  write extended attributes
• X  —  execute/traverse
• DC  —  delete child
• RA  —  read attributes
• WA  —  write attributes

iCACLS inheritance settings:

• (OI)  —  objects inherit the specified ACE
• (CI)  —   subdirectories in the current directory inherit ACE
• (IO)  —  inherit only to the current object
• (NP)  —  don’t propagate inherit
• (I)  — permission inherited from the parent container

How to Find Orphaned SIDs in ACLs

After AD migrations, domain consolidations, or account deletions, NTFS permissions may contain orphaned security identifiers (SIDs) that can no longer be resolved to a valid user/group. In File Explorer, these entries usually appear as Account Unknown (S-1-5-21-…).

You can use the /findsid option to locate files and folders that contain a specific SID in their ACL. As example, here is the command:

icacls C:\Data /findsid *S-1-5-21-123456789-123456789-123456789-1001 /T

This command recursively scans all files and folders and returns objects where the specified SID is present in the ACL.

Here is a common workflow:

1. Identify unresolved SIDs in the ACL;
2. Locate all affected files and folders with /findsid;
3. Remove obsolete ACEs or replace them with valid accounts or groups.

This can be pretty useful after domain migrations, SID cleanup projects, or when you troubleshooting unexpected permission assignments.

Note. The SID must be specified in the same format as it appears in the ACL. The /findsid option searches for a specific SID and does not automatically remove matching entries.

How to Set and Modify NTFS Permissions with ICACLS

Now let’s look at some typical examples of using iCACLS tool to modify file or folder permissions on Windows.

Grant Modify Permissions to a User

Grant user John permissions to modify (M) the contents of the specified folder:

icacls C:\PS /grant John:M

Grant Permissions Using SID

In addition to user/group names, with ICACLS you can assign permissions directly to a Security Identifier (SID).

Here is an example:

icacls C:\Data /grant *S-1-5-21-1234567890-123456789-123456789-1105:(RX)

The asterisk (*) before the SID tells ICACLS that the value should be interpreted as a SID rather than an account name.

Using SIDs can be helpful in several cases:

• Domain migrations where account names may change;
• Restoring permissions when the original account no longer exists;
• Troubleshooting orphaned ACL entries that reference deleted users/groups.

You can use the following command to determine the SID of a user:

Get-ADUser jsmith | Select-Object SID

Instead of specifying the user name manually, you can use the the %username%

Instead of entering the username manually, you can use the %username% environment variable to grant permissions to the currently logged on user.

ICACLS c:\PS /grant %username%:F

Grant Full Control to a Group

Next, let’s grant Full Control (F) permissions to a folder and its nested items for a domain security group:

icacls "C:\PS" /grant domainname\NYUsers:(OI)(CI)(F) /Q /C /T

PowerShell note. When you are running ICACLS commands from PowerShell, keep in mind that inheritance flags such as (OI) and (CI) may need additional handling (because PowerShell parses parentheses before passing arguments to external executables). In order to avoid parsing issues, you should use the stop-parsing operator (–%) or quote the permission string.

Here is an example:

icacls --% C:\PS /grant domainname\NYUsers:(OI)(CI)(F) /T

• domainname\NYUsers — this can be a local or domain user or group that you want to grant permissions to. It is possible to use built-in group names: Administrators, Everyone, Users, etc.
• (OI)(CI) — inherit object permissions on files and folders within the directory
• (F) — grant Full control permissions. Then need to apply several permissions, for example Read + Execute and Write, separate them with comma, like this:(RX,W)
• /Q — suppress success messages
• /C — continue on errors
• /T — apply changes to all files and subdirectories (recursively)

Replacing Existing ACLs

The :r with the /grant parameter is used to replace existing ACLs rather than adding a new ACL entry:

icacls C:\PS /grant:r Administrators:F

Deny Permissions

The Deny NTFS permissions are rarely used, except in cases when you need to immediately strip or protect vital files. For example, to explicitly deny a specific user group from deleting files (D):

icacls c:\ps /deny "NYUsers:(CI)(D)"

Note. Keep in mind that deny rules take precedence over allow rules.

Remove NTFS Permissions

Remove all NTFS permissions that have been assigned directly to a user:

icacls C:\PS /remove John

/grant vs /grant:r

Keep in mind that the /grant and /grant:r options behave differently if permissions for the specified user already exist.

You can use /grant option to add a new ACE without removing existing explicit permissions:

icacls C:\PS /grant User1:R

For example, if User1 already has Modify (M) permissions, the new Read (R) ACE is added alongside the existing entry.

With the /grant:r option, you can replace all existing explicit Allow permissions for that user with the specified permissions:

icacls C:\PS /grant:r User1:R

This can be useful when you want to standardize permissions and avoid accumulating multiple ACEs for the same account.

Note. The :r parameter only replaces existing explicit Allow permissions for the specified user/group. Inherited permissions are not affected.

Removing Specific ACE Types

By default, the /remove option deletes all ACEs associated with the specified user/group. In case you need to remove only Allow or Deny entries, use the following options:

You can remove only Allow ACEs with the command:

icacls C:\PS /remove:g John

To remove only Deny ACEs, use the command:

icacls C:\PS /remove:d John

In order to remove all ACEs (Allow and Deny):

icacls C:\PS /remove John

Note. Using /remove:g or /remove:d is often safer than /remove because it prevents accidentally deleting all permissions assigned to a user/group.

Managing Permission Inheritance with iCACLS

You can use the icacls.exe command to enable or disable permissions inheritance on folder or file objects. Use the /inheritance switch with one of the following options:

• E — enable inheritance
• D — disable inheritance and copy current ACE
• R — remove all inherited ACEs

Enable or Disable NTFS Inheritance

For example, to enable permission inheritance on an object:

icacls c:\PS /inheritance:E

To disable inheritance and remove all inherited permissions:

icacls c:\PS /inheritance:R

To disable inheritance permissions on the object and copy the current access control list (explicit permission):

icacls c:\PS /inheritance:D

Propagating Permissions without Inheritance

Propagate new permissions to all files and subfolders without using inheritance:

icacls "C:\PS\" /grant:r Everyone:(NP)(RX) /T

No specific subfolder permissions are overwritten in this case.

How to Reset NTFS Permissions

If incorrectly assigned permissions cause applications or even the operating system to behave abnormally, you can reset them to their default values.

Reset the current file permissions:

icacls C:\ps\secret.docx /T /Q /C /RESET

This will replace the permissions on the file with the permissions inherited from the parent folder (equivalent of the “Replace all child permission entries with inheritable permission from this object” option in File Explorer).

How to Change File or Folder Ownership Using ICACLS

The icacls command can be used to change the owner of a directory or folder. For example:

icacls c:\ps\ /setowner John /C /L /Q /T

This command only allows to change the owner of the file that you are the owner of. If you are not the current object owner, use the takeown command to take file or folder ownership.

Change the owner of all files in the directory:

icacls c:\ps\* /setowner John /C /L /Q /T

How to Manage Integrity Levels with ICACLS

ICACLS can be used to view and config Integrity Levels on files and folders.

Here are the most common integrity levels:

• Low (L) — typically used by sandboxed or untrusted apps;
• Medium (M) — default level for standard user processes;
• High (H) — used by elevated administrative processes.

For example, if you need to assign a High Integrity Level to a folder, use the following command:

icacls C:\Data /setintegritylevel H

In order to set a Medium Integrity Level, use the following:

icacls C:\Data /setintegritylevel M

To assign a Low Integrity Level, run the following command:

icacls C:\Data /setintegritylevel L

You can also apply Integrity Levels recursively to child files and folders:

icacls C:\Data /setintegritylevel (OI)(CI)H

Keep in mind that Integrity Levels do not replace NTFS permissions. They provide an additional layer of access control and are primarily used in app isolation and security hardening scenarios.

How to Backup and Restore NTFS Permissions Using ICACLS

The icacls command allows you to save the current ACLs of the current object to a plain text file (which is a way of backing up the NTFS permissions):

How to Export NTFS Permissions to a File

Export the current ACL of the folder and save it to a *.TXT file:

icacls C:\PS\* /save c:\temp\PS_folder_ACLs.txt /T

The ACLs of all subfolders and files are included in the target TXT file.

To apply the saved ACLs to the folder (restore permissions):

icacls C:\PS /restore c:\temp\PS_folder_ACLs.txt /T /C /Q

This makes it much easier to copy ACLs from folder to folder (or between hosts).

Verifying ACL Consistency

The /verify option checks the integrity and consistency of ACL information stored on files and folders. It can help you to identify corrupted security descriptors, invalid ACL structures, or mismatched ACE counts.

In order to verify ACL consistency for a folder and all child objects, run the command:

icacls C:\Data /verify /T

You can also check a single file/directory with the following command:

icacls C:\Data\Report.xlsx /verify

In case inconsistencies are detected, ICACLS reports the affected objects. This command is particularly useful when troubleshooting NTFS permission issues, file server migrations, backup/restore problems, or suspected security descriptor corruption.

Note. Keep in mind that the /verify switch only checks ACL consistency and does not automatically repair detected problems.

How to Bulk Replace SIDs After Domain Migration

When migrating users between domains/forests, file ACLs may still reference old user/group SIDs. You can use the /substitute option during ACL restoration to replace old SID references with new ones.

Here is an example:

icacls D:\Data /save D:\Backup\ACLs.txt /T

In order to replace old SID references with new ones during ACL restoration, you need to use the /substitute option together with /restore.

icacls D:\Data /substitute S-1-5-21-OLD-SID S-1-5-21-NEW-SID /restore D:\Backup\ACLs.txt /C /Q

You can use this approach during:

• AD Migration Tool (ADMT) projects;
• Forest-to-forest migrations;
• File server consolidations;
• Domain restructures.

Common ICACLS Errors

You may encounter the “Access is denied” error when trying to change permissions on a file or folder using the ICACLS tool. The ICACLS command failed to process the files in this case.

If this happened:

• Make sure that the command prompt executing icacls is running in “Run as administrator” mode.
• Make sure your user account has the necessary permissions to modify the object’s ACL. The resulting user permissions for the object can be obtained using the following command:
  

  "\\live.sysinternals.com\tools\accesschk64.exe" -d reslab\cyril "C:\PS"