This webpage contains a series of examples of how xcacls.vbs can be used.
Overview
Xcacls.vbs is an augmented version of the Extended Change Access Control List tool (Xcacls.exe) that ships in the Windows 2000 and Windows Server 2003 Support Tools.
Xcacls.vbs is an unsupported utility that addresses specific limitations with the original Xcacls.exe utility, specifically the inability to append permissions to a folder whose child objects have the inheritance flag set.
Xcacls.vbs can be downloaded from: http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=19419
Examples
- List all privileges of a certain file or folder:cscript xcacls.vbs c:\test\file.txt
- List all privileges on a folder and on all files and folders inside that folder:cscript xcacls.vbs c:\test /F /S
- List all privileges on a folder and on all files and folders inside that folder also traverse all subfolders and do the same:cscript xcacls.vbs c:\test /F /S /T
- Give a user Full Control on a file or folder:cscript xcacls.vbs c:\test\file.txt /G MYDOMAIN\user:F /E
- Remove a user's access on a file or folder:cscript xcacls.vbs c:\test\file.txt /R MYDOMAIN\user /E
- Deny a user Full Control on a file or folder:cscript xcacls.vbs c:\test\file.txt /D MYDOMAIN\user:F /E
- Enable and apply inheritance on a folder:cscript xcacls.vbs c:\test /I ENABLE
Links
Other examples and help information can be found on the Microsoft support site on http://support.microsoft.com/default.aspx?scid=KB;EN-US;825751
Xcacls.vbs can be downloaded from: http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=19419
Tags:
Comments
Edit ACL but do not inherit
I want to grant a Full permissions to an account user on a particular folder. When I try this:
cscript xcacls.vbs <_path_to_folder> /G "":F /E
But, this granted F access to the folder, it's sub folder and files as well.
The subfolders will be
The subfolders will be configured to automatically inherit the permissions from the parent folder. My advise would be to first change the settings of the subfolders so that permissions are not inherited:
cscript xcacls.vbs <_path_to_folder_subfolder> /I COPYThis will copy the permissions and remove inheritance.
Afterwards you can repeat your command to grant Full permissions.
Thanks. I see that removing
Thanks. I see that removing the inheritance takes a long time to finish if the number of files is more. Any way to avoid that? Or any other tool that basically just changes the ACL of a folder and do not touch the sub folders and the files?
I don't think that there is
I don't think that there is an easy solution: removing inheritance means that Windows has to modify the permissions for every file and folder individually. When removing inheritance for a certain file or folder you are in fact setting the permissions of this file or folder to the permissions of the parent folder. So if you have many files, then many permissions have to be set.
Another tool will not be able to help you: if inheritance is set on a folder, then changing the permissions of the parent folder will always have as effect that the children inherit these permissions.
Thanks,I was looking to NP
Thanks,
I was looking to NP (Non Propagating) option of icacls, but it seems icacls atleast go through all the files if not applies the modified ACL to those files.
Pages