ICACLS is a command-line utility in Windows that is used to view and modify file and folder permissions. It's a powerful tool that allows administrators to manage access control lists (ACLs) for files and directories. This article will guide you through the basics of using ICACLS, including practical examples of common tasks.

Understanding ICACLS

ICACLS stands for Integrity Control Access Control Lists. It is an improvement over the older CACLS and XCACLS utilities, providing more detailed control over permissions and supporting newer features like integrity levels.

Installing ICACLS

ICACLS is included by default in Windows Vista and later versions, including Windows Server editions. Therefore, there is no need for a separate installation.

Basic ICACLS Commands

1. View Permissions: To view the permissions of a file or directory, use the following command:

   icacls C:\Path\To\FileOrDirectory

   This command will display the ACLs for the specified file or directory.

2. Grant Permissions: To grant a user or group specific permissions, use:

   icacls C:\Path\To\FileOrDirectory /grant UserName:(Permission)

   For example, to grant the user "JohnDoe" full control over a folder, use:

   icacls C:\Data /grant JohnDoe:F

3. Deny Permissions: To explicitly deny permissions, use:

   icacls C:\Path\To\FileOrDirectory /deny UserName:(Permission)

   Denying permissions will override any granted permissions.

4. Remove Permissions: To remove a user's permissions, use:

   icacls C:\Path\To\FileOrDirectory /remove UserName

5. Reset Permissions: To reset the permissions of a file or directory to the default inherited permissions, use:

   icacls C:\Path\To\FileOrDirectory /reset

6. Backup and Restore ACLs: You can backup and restore ACLs using the following commands:

   • Backup:

     icacls C:\Path\To\FileOrDirectory /save AclFileName /t

   • Restore:

     icacls C:\Path\To\FileOrDirectory /restore AclFileName

Examples

• Granting Read and Execute Permissions:

  To grant the "Users" group read and execute permissions on a folder:

  icacls C:\Data /grant Users:RX

• Removing a User's Permissions:

  To remove all permissions for "JohnDoe" on a file:

  icacls C:\Data\File.txt /remove JohnDoe

• Resetting Permissions to Default:

  To reset permissions on a directory to default:

  icacls C:\Data /reset

Conclusion

ICACLS is a versatile command-line tool for managing file and folder permissions in Windows. By understanding and utilizing ICACLS, system administrators can effectively control access to resources, ensuring security and compliance within their environments.