NTFS File System Permissions

XCACLS:

XCACLS or Extended Change Access Control List tool, is an advanced version of CACLS, the difference being that we do not have to answer Yes/No prompts in XCACLS. CACLS and XCACLS are tools which are used to modify the ACLs (Access Control Lists), by which in turn we are modifying the folder permissions for users in windows.

CACLS is installed in all users machine in System32 folder.

Icacls.exe: This article describes the Icacls.exe command-line utility. You can use this utility to modify NTFS file system permissions

Icacls is a better option than LockPermission Table. This command can be run through command line or from CA too.

The reason why many people use cacls.exe instead is because using the "lockpermission table" is for some reason often unreliable, and simply doesn’t work always

Another reason people mention why cacls should be used instead, is because there is a risk that the "lockpermission" table applies only the permissions in the msi-packet to the folders, and erases others.
I.E other accounts, on the installed machine/domain loose permissions, such as "administrator", "system".

Yet another reason, and a very significant one, is that using "lockpermission" table does not enable you to assign inherited permission. So if you have, lets say 50 folders who also have subfolders - you would have to right click on every one of them and assign the permissions. That is very time consuming, but this is not a problem when cacls is used.

Change file and folder permissions - display or modify Access Control Lists (ACLs) for files and folders.

ICACLS name /save aclfile [/T] [/C] [/L] [/Q]

Restore ACLs to all files in directory :

/restore aclfile [/C] [/L] [/Q]

Stores the DACLs for the files and folders that match the name into aclfile for later use with /restore.

What is DACLs: If a Windows object does not have a discretionary access control list (DACL), the system allows everyone full access to it. If an object has a DACL, the system allows only the access that is explicitly allowed by the access control entries (ACEs) in the DACL. If there are no ACEs in the DACL, the system does not allow access to anyone. Similarly, if a DACL has ACEs that allow access to a limited set of users or groups, the system implicitly denies access to all trustees not included in the ACEs.

Change Owner:

      ICACLS name /setowner user [/T] [/C] [/L] [/Q]

/setowner : changes the owner.

Key

   name  The File(s) or folder(s) the permissions will apply to.

   /T  Traverse all subfolders to match files/directories.

  

   /C  Continue on file errors (access denied). If /C is not specified, Xcacls.exe stops on this error.

 

   /L  Perform the operation on a symbolic link itself, not its target.

   /Q  Quiet - suppress success messages.

/E edits the ACL instead of replacing it.

/G user:perm;spec grants a user access to the matching file or folder. 
∙      Theperm (permission) variable applies the specified access right to files and represents the special file-access-right mask for folders. The permvariable accepts the following values: 
o      R Read 
o      C Change (write) 
o      F Full Control 
o      P Change Permissions (special access) 
o      O Take Ownership (special access) 
o      X EXecute (special access) 
o      E REad (Special access) 
o      W Write (Special access) 
o      D Delete (Special access) 
∙      Thespec (special access) variable applies only to folders and accepts the same values as perm, with the addition of the following special value: 
o      T Not Specified. Sets an ACE for the directory itself without specifying an ACE that is applied to new files created in that directory.

/R user revokes all access rights for the specified user.

/P user:perm;spec replaces access rights for user. The rules for specifying perm and spec are the same as for the /G option.

/D user denies user access to the file or directory.

/Y disables confirmation when replacing user access rights. By default, CACLS asks for confirmation. Because of this feature, when CACLS is used in a batch routine, the routine stops responding until the right answer is entered. The /Y option was introduced to avoid this confirmation, so that Xcacls.exe can be used in batch mode.

icacls c:\windows\* /save Aclfile /T

will save the ACLs for all files under C:\windows and its subdirectories to AclFile.

icacls c:\windows\ /restore Aclfile

will save the ACLs for every file within Aclfile that exists in C:\windows and its subdirectories.