NTFS Permissions Cheat Sheet: icacls, Inheritance and takeown

Start here

Who has access to this folder?

icacls D:\data

Give a group modify on the whole tree

/grant "DOM\Grp":(OI)(CI)M /T

Permissions are a mess

icacls D:\data /reset /T /C

Access denied even as admin

takeown /F D:\data /R /D Y

Save the ACLs before touching them

icacls D:\data /save acl.txt /T

New files must inherit it

(OI)(CI)

Two questions, always in this order. What rights are granted, and how do they inherit. Most permission problems are the second question, not the first.

Permission sets

Code	Grants
`F`	Full control, including changing permissions and taking ownership
`M`	Modify: read, write, delete. The right answer for most shares.
`RX`	Read and execute
`R`	Read only
`W`	Write only, which alone cannot read back what it wrote
`D`	Delete
`N`	No access

Granular right	Meaning
`RD` / `WD`	Read data, list folder / write data, add file
`AD`	Append data, create subfolder
`X`	Execute, traverse folder
`DE` / `DC`	Delete / delete child
`RA` / `WA`	Read / write attributes
`REA` / `WEA`	Read / write extended attributes
`RC`	Read the security descriptor
`WDAC` / `WO`	Change permissions / take ownership

Inheritance flags

Flag	Meaning
`(OI)`	Object inherit: files below this folder get it
`(CI)`	Container inherit: subfolders get it
`(IO)`	Inherit only: the folder itself is not covered
`(NP)`	No propagate: one level down only
`(I)`	Shown in output: this entry came from the parent

Combination	Applies to
`(OI)(CI)`	This folder, its subfolders and its files. The normal choice.
`(OI)(CI)(IO)`	Subfolders and files only, not the folder itself
`(CI)`	This folder and subfolders, no files
`(OI)`	This folder and its files, no subfolders
`(OI)(CI)(NP)`	This folder and its immediate children only
no flag	This folder alone. Nothing created later inherits it.

The classic mistake. Granting rights without (OI)(CI) works today and fails tomorrow, because every file created after that point inherits nothing from the entry you added.

icacls

Task	Command
Show the ACL	`icacls D:\data`
Grant, keeping existing entries	`icacls D:\data /grant "DOM\Grp":(OI)(CI)M`
Grant, replacing that identity’s entries	`icacls D:\data /grant:r "DOM\Grp":(OI)(CI)M`
Deny	`icacls D:\data /deny "DOM\User":(OI)(CI)F`
Remove all entries for an identity	`icacls D:\data /remove "DOM\User" /T /C`
Remove only the deny entries	`icacls D:\data /remove:d "DOM\User" /T`
Reset to whatever the parent says	`icacls D:\data /reset /T /C /Q`
Disable inheritance, keep a copy of the entries	`icacls D:\data /inheritance:d`
Re-enable inheritance	`icacls D:\data /inheritance:e`
Strip inherited entries outright	`icacls D:\data /inheritance:r`
Change the owner	`icacls D:\data /setowner "Administrators" /T /C`
Back up every ACL in a tree	`icacls D:\data\* /save C:\temp\acl.txt /T`
Restore them	`icacls D:\ /restore C:\temp\acl.txt`
Find an orphaned SID	`icacls D:\data /findsid S-1-5-21-1111111111-2222222222-3333333333-1105 /T`
Check for broken ACLs	`icacls D:\data /verify /T`

Switch	Effect
`/T`	Recurse into the whole tree
`/C`	Continue after errors instead of stopping
`/Q`	Quiet, suppress the success lines
`/L`	Act on the symbolic link itself, not its target

/grant:r is a replace. The colon-r form removes every existing entry for that identity before adding yours. On a live share that is how an entire department loses access in one command. Save the ACLs first.

Ownership and attributes

Task	Command
Take ownership of one file	`takeown /F D:\data\file.txt`
Take ownership of a tree	`takeown /F D:\data /R /D Y`
Assign to the Administrators group, not to you	`takeown /F D:\data /R /A /D Y`
Show attributes	`attrib D:\data\file.txt`
Clear hidden and system on a tree	`attrib -h -s D:\data\. /S /D`
Set read-only	`attrib +r D:\data\file.txt`
Exclude from content indexing	`attrib +i D:\data /S /D`

Ownership beats permissions. An owner can always rewrite the ACL, which is why takeown followed by icacls /grant is the standard rescue for a folder nobody can open, including one left behind by a deleted account.

Identities you will meet

Name	What it means
`NT AUTHORITY\SYSTEM`	The machine itself. Never remove it from system paths.
`BUILTIN\Administrators`	Local administrators, including domain admins on members
`BUILTIN\Users`	Every interactive local and domain user on the machine
`Authenticated Users`	Anyone who authenticated, excluding guests
`Everyone`	Authenticated users plus guest access
`CREATOR OWNER`	Template: applied to whoever creates the item, inherit-only
`NT SERVICE\TrustedInstaller`	Owner of Windows system files
`NT SERVICE\MSSQLSERVER`	Pattern for per-service identities, valid in icacls

How Windows decides

Order	Rule
1	Explicit deny on the object
2	Explicit allow on the object
3	Inherited deny from the nearest parent
4	Inherited allow from the nearest parent
5	Nothing matched, access is refused

Situation	Result
User is in two groups, one allows, one denies	Deny wins at the same level
Explicit allow on the file, inherited deny on the folder	The explicit allow wins
Share permission Read, NTFS Modify	Read, the more restrictive of the two
Rights changed while the user is connected	Kerberos ticket still carries the old groups, log off and back on

Deny is a last resort. An explicit deny outranks every allow at the same level and is invisible when you skim an ACL. Remove the account from the group instead.

Recipes

Task	Command
Standard department share	`icacls D:\share /grant "DOM\Dept-RW":(OI)(CI)M /grant "DOM\Dept-RO":(OI)(CI)RX /T`
Rescue a folder nobody can open	`takeown /F D:\stuck /R /A /D Y` then `icacls D:\stuck /grant Administrators:(OI)(CI)F /T /C`
Snapshot before a change	`icacls D:\share\* /save C:\temp\acl-before.txt /T`
Roll that change back	`icacls D:\ /restore C:\temp\acl-before.txt`
Purge a leaver from every folder	`icacls D:\share /remove "DOM\leaver" /T /C /Q`
Clean up orphaned SIDs after a migration	`icacls D:\share /findsid S-1-5-21-... /T`
Break inheritance for one project folder	`icacls D:\share\secret /inheritance:d` then `/remove` what should not be there
Rebuild a tree that was reset by hand	`icacls D:\share /reset /T /C /Q`
Users own what they create	`icacls D:\drop /grant "CREATOR OWNER":(OI)(CI)(IO)M`

FAQ

I am a domain admin and still get access denied. Why?

Administrative rights are not a bypass on NTFS. If the ACL has no entry for you, you get nothing until you take ownership or use backup privilege. Start an elevated console, then takeown followed by an icacls /grant. On a UAC-filtered token the same command fails silently in a non-elevated window.

Everything worked, then new files stopped inheriting the rights.

The entry was added without (OI)(CI), so it applies only to the folder object itself. Re-grant with the inheritance flags, then run the same command with /T so existing children pick it up.

Does icacls /reset delete my permissions?

It replaces the ACL with whatever the parent would give the object. On a folder that deliberately breaks inheritance that is destructive, and there is no undo beyond a saved ACL file or a backup.

Share permissions or NTFS permissions?

Set the share to Authenticated Users Full Control and do all the real work in NTFS. Two overlapping permission models on one folder is how a “why can they read this” ticket turns into an afternoon.

Is cacls still usable?

It exists for compatibility and it mangles inheritance. Use icacls for anything you care about, and PowerShell’s Get-Acl and Set-Acl when the logic gets complex enough to need objects.