ICACLS: Complete Guide to Managing Access Rights in Windows

Introduction / Why This Is Needed

ICACLS is a built-in Windows command-line utility for displaying and modifying Access Control Lists (ACL) for files and folders. It allows administrators and advanced users to precisely configure who can perform which operations on file system objects.

With this guide, you will learn how to:

• View complex permission chains.
• Assign, modify, and remove access permissions for users and groups.
• Manage permission inheritance between folders.
• Restore default Windows permissions.
• Perform bulk ACL operations on entire folder trees.

This is critically important for resolving access issues, configuring network shared folders, and ensuring security.

Requirements / Preparation

1. Operating System: Windows 10, Windows 11, Windows Server 2016 or newer. The icacls.exe utility is located in C:\Windows\System32\.
2. Access Rights: To modify an object's ACL, your account must have the "Change Permissions" right (typically Write DAC). For most system folders and files, this requires running the command prompt as an administrator.
3. Basic Knowledge: Understanding of Windows security models (users, groups, permissions like Read, Write, Full Control).

⚠️ Important: Be extremely careful when modifying permissions on system folders (C:\Windows, C:\Program Files). Incorrect actions can lead to OS or application failure. Always create a system restore point before performing bulk operations.

Step-by-Step Instructions

Step 1: View Current Permissions (ICACLS Without Parameters)

Before making any changes, you must understand the current ACL configuration.

# View permissions for a specific folder
icacls "C:\Users\Public\Documents"

# View with all inherited and explicit permissions displayed
icacls "C:\Users\Public\Documents" /t /c /l

What the command does:

• icacls <path> — outputs the list of Access Control Entries (ACE) for the specified object.
• /t — recursively traverses all nested files and folders (for analyzing structure).
• /c — continues the operation even when encountering access errors (does not stop).
• /l — processes only symbolic links, not target objects (for safety).

Example output:

C:\Users\Public\Documents BUILTIN\Administrators:(I)(F)
                               BUILTIN\Users:(I)(RX)
                               NT AUTHORITY\Authenticated Users:(I)(M)

• (I) — Inherited permission flag.
• (F) — Full Control.
• (RX) — Read & Execute.
• (M) — Modify.

Step 2: Assign New Permissions (ICACLS /grant)

Add explicit permissions for a user or group. Syntax: icacls <path> /grant <user>:<permissions>

# Grant user 'Ivanov' read and write access to the Project folder
icacls "D:\Projects" /grant Ivanov:(R,W)

# Grant group 'Developers' full control over the folder and all its contents
icacls "D:\Projects" /grant Developers:(F) /t

# Add execute (RX) permission for all authenticated users
icacls "C:\Tools\script.bat" /grant "Authenticated Users":(RX)

Key Permissions (Mnemonics):

• F — Full control
• M — Modify
• RX — Read & execute
• R — Read
• W — Write
• D — Delete

💡 Tip: Always use full group names (e.g., "BUILTIN\Users") if there is a risk of confusion. For local users, you can use just Ivanov.

Step 3: Managing Inheritance (ICACLS /inheritance)

Inheritance is the mechanism where a folder automatically receives the same base permissions as its parent. Manage this behavior.

# 1. Disable inheritance for the folder and COPY current inherited permissions as explicit
icacls "D:\SecretProject" /inheritance:d

# 2. Disable inheritance and REMOVE all copied inherited permissions
icacls "D:\SecretProject" /inheritance:r

# 3. Re-enable inheritance (restore default)
icacls "D:\SecretProject" /inheritance:e

• /inheritance:d — Disable inheritance, copying current inherited ACEs to explicit.
• /inheritance:r — Remove all inherited ACEs (a stricter option).
• /inheritance:e — Enable inheritance (default for most folders).

Step 4: Removing Permissions (ICACLS /remove)

Remove explicit or inherited permissions for a specified user/group.

# Remove all explicit permissions for user 'TempUser' from the folder
icacls "D:\Temp" /remove TempUser

# Remove inherited permissions for group 'Guests' (if they exist)
icacls "D:\Temp" /remove "Builtin\Guests" /inheritance

Caution: Removing inherited permissions via /remove with the /inheritance flag can disrupt expected security behavior. Often, simply disabling inheritance (/inheritance:r) is sufficient.

Step 5: Restoring Default Permissions (ICACLS /reset)

If you "break" a folder's ACL, the /reset command will attempt to return it to the state it would have by default, based on inheritance from its parent.

# Reset ACL of folder 'D:\Projects' to standard, inherited from D:\
icacls "D:\Projects" /reset /t /c

# Apply reset to all child objects, ignoring errors
icacls "D:\Projects" /reset /t /c

Limitation: /reset is not a magic "undo" button. It does not restore ACL backups. It only removes all explicit ACEs on the object and forces it to inherit permissions from its parent again. If the parent has non-standard permissions, the result will be unexpected.

Step 6: Bulk Operations and Error Handling

Work with entire folder trees using a combination of switches.

# Example: Recursively grant group 'DevTeam' modify (M) rights on all files in D:\Code
# /t - recursion, /c - continue on errors, /q - quiet mode (minimal output)
icacls "D:\Code" /grant DevTeam:(M) /t /c /q

# Example: Find all files where 'Everyone' has Full Control, and remove it
# First search (findstr), then apply remove in a loop (for PowerShell)
Get-ChildItem "C:\" -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
    $acl = icacls $_.FullName 2>$null
    if ($acl -match "Everyone:(I?)\(F\)") {
        icacls $_.FullName /remove Everyone
    }
}

Safety: Test commands with /t on a small test folder before running on critical data.

Verifying the Result

After performing changes, always verify the outcome.

1. Visual Check: Open the file/folder properties in Explorer (Right-click → Properties → Security). Ensure the required accounts are present in the list and unwanted ones are absent.
2. Command-line Check: Run icacls <path> again and compare the output with expectations.
3. Functional Check: Try to perform the operation as the user for whom you configured permissions (run a file, write a document, delete a folder). This is the most reliable method.

Common Problems

Problem 1: "Access is denied" when trying to change permissions

• Cause: The current user (even an administrator) lacks the Write DAC right on the target object.
• Solution: Run the command prompt or PowerShell as an administrator (Right-click → "Run as administrator"). If that doesn't help, the object might be system-protected. As a last resort, use takeown /f <path> /r to take ownership, then retry icacls.

Problem 2: Inheritance doesn't work as expected after /reset

• Cause: The parent folder from which the ACL should be inherited itself has non-standard (explicit) permissions.
• Solution: Check the ACL of the parent folder. If a "full recovery" is needed, you may need to reset ACLs up the chain to the disk root or use other tools (e.g., secedit /configure with a default security template).

Problem 3: Error "The parameter is incorrect" when specifying permissions

• Cause: Invalid syntax in the <permissions> part. For example, a space between (R,W) or using a non-existent permission letter.
• Solution: Ensure permissions are specified without spaces inside the parentheses: (R,W), not (R, W). Use only valid mnemonics: F, M, RX, R, W, D.

Problem 4: Bulk operation (/t) "hangs" or takes too long

• Cause: Recursing through a huge number of files (millions) or over a network path with high latency.
• Solution:
  1. Use the /c switch to continue on errors.
  2. Limit recursion depth if possible (e.g., process only the top level first).
  3. For network paths, ensure connection stability.
  4. Perform such operations during periods of lowest load.

Problem 5: Cannot delete a system account (SYSTEM, TrustedInstaller)

• Cause: These are protected system accounts. Their complete removal from ACLs of critical objects is forbidden by the system.
• Solution: You cannot and should not delete these entries. You can only modify their permissions (e.g., from F to RX), and even that is dangerous. To restore default permissions on system objects, use sfc /scannow or System Restore.

Advanced Example: Securely Configuring a Network Shared Folder

Goal: Create a folder D:\Share\Projects accessible for read/write to the group Domain\Developers, but without the ability to delete other users' files. Inheritance from the parent is disabled.

# 1. Create the folder (if it doesn't exist)
mkdir "D:\Share\Projects"

# 2. Disable inheritance and remove all existing inherited permissions (if any)
icacls "D:\Share\Projects" /inheritance:r

# 3. Grant the Developers group Modify (M) — includes read, write, execute, but NOT Delete
icacls "D:\Share\Projects" /grant "Domain\Developers":(M)

# 4. Grant SYSTEM and Administrators Full Control for management
icacls "D:\Share\Projects" /grant "SYSTEM":(F) "Administrators":(F)

# 5. Verify the result
icacls "D:\Share\Projects"

Explanation: The Modify (M) permission does not include the Delete (D) right. This means users in Developers can create and modify files but cannot delete files created by other users (unless they have the Delete Subfolders and Files permission on the parent folder). This is often required for shared working folders.

Conclusion on Best Practices

1. Test on a copy: Before applying bulk operations (/t), test the command on a single folder.
2. Document changes: Record which commands you executed and for what purpose.
3. Principle of least privilege: Grant users only the permissions they need for their work, not Full Control by default.
4. Use groups: Assign permissions to domain groups or local groups (Users, Administrators), not to individual users. This simplifies management.
5. Backup ACLs: For important folders, you can save the current ACL to a file: icacls "D:\Critical" /save acl_backup.txt. Restore with: icacls "D:\Critical" /restore acl_backup.txt.

The icacls command is a powerful and precise tool. With this knowledge, you will be able to handle virtually any task related to access management in Windows, from simple to complex corporate scenarios.