Managing File System Permissions with SetACL.exe

Managing File System Permissions with SetACL.exe

Example 1.1 – Setting Permissions^

SetACL.exe -on "C:\my dir" -ot file -actn ace
           -ace "n:domain1\user1;p:change"

Sets ‘change’ permissions on the directory ‘c:\my dir’ for user ‘user1′ in domain ‘domain1′.

Example 1.2 – Setting Multiple Permissions^

SetACL.exe -on "C:\my dir" -ot file -actn ace
           -ace "n:domain1\user1;p:read,write_dacl"

Same as the previous example, but sets the following two permissions:

  • read (standard permission set)
  • write_dacl (specific permission)

Example 1.3 – Adding Multiple ACEs^

SetACL.exe -on "C:\my dir" -ot file -actn ace
           -ace "n:domain1\user1;p:change"
           -ace "n:administrators;p:full"

Same as the first example, but additionally sets ‘full’ permissions for the group ‘administrators’.

Example 1.4 – Specifying SIDs^

SetACL.exe -on "C:\my dir" -ot file -actn ace
           -ace "n:domain1\user1;p:change"
           -ace "n:S-1-5-32-544;p:full"

An improved version of the previous example: ‘administrators’ is a built-in group, whose name is dependent on the language of the operating system. Therefore it is better to use its well-known SID which never changes.

Example 1.5 – Remote Systems^

SetACL.exe -on "\\server1\share1\my dir" -ot file -actn ace
           -ace "n:domain1\user1;p:change"
           -ace "n:S-1-5-32-544;p:full"

Same as the previous example, but using a UNC name to access the server ‘server1′ remotely via the network share ‘share1′.

Example 1.6 – Auditing Entries (SACL)^

SetACL.exe -on "\\server1\share1\my dir" -ot file -actn ace
           -ace "n:domain1\user1;p:change"
           -ace "n:S-1-5-32-544;p:full"
           -ace "n:domain2\user2;p:full;m:aud_fail;w:sacl"

Same as the previous example, but additionally setting an auditing entry for all (‘full’) failed attempts of ‘user2′ from domain ‘domain2′.

Example 1.7 – Cleaning up ACLs^

SetACL.exe -on "\\server1\share1\my dir" -ot file -actn ace
           -ace "n:domain1\user1;p:change"
           -ace "n:S-1-5-32-544;p:full"
           -ace "n:domain2\user2;p:full;m:aud_fail;w:sacl"
           -actn clear -clr "dacl,sacl"

Same as the previous example, but first (see ordering of actions in the documentation) the DACL and SACL are cleared of any non-inherited entries, and then the specified ACEs are set. This effectively ‘cleans up’ messed-up ACLs.

Example 1.8 – Resetting Child Objects^

SetACL.exe -on "\\server1\share1\my dir" -ot file -actn ace
           -ace "n:domain1\user1;p:change"
           -ace "n:S-1-5-32-544;p:full"
           -ace "n:domain2\user2;p:full;m:aud_fail;w:sacl"
           -actn clear -clr "dacl,sacl"
           -actn rstchldrn -rst "dacl,sacl"

Same as the previous example, but even more housekeeping is done. Propagation of inherited permissions is enabled for all sub-objects whose permissions are also reset, resulting in only the specified permissions being active for a whole directory tree.

Example 1.9 – Using the Log File^

SetACL.exe -on "\\server1\share1\my dir" -ot file -actn ace
           -ace "n:domain1\user1;p:change"
           -ace "n:S-1-5-32-544;p:full"
           -ace "n:domain2\user2;p:full;m:aud_fail;w:sacl"
           -actn clear -clr "dacl,sacl"
           -actn rstchldrn -rst "dacl,sacl"
           -log "c:\my files\setacl log.txt"

Same as the previous example, but all output is written both to the screen and to the log file ‘c:\my files\setacl log.txt’.

Example 1.10 – Silent Mode^

SetACL.exe -on "\\server1\share1\my dir" -ot file -actn ace
           -ace "n:domain1\user1;p:change"
           -ace "n:S-1-5-32-544;p:full"
           -ace "n:domain2\user2;p:full;m:aud_fail;w:sacl"
           -actn clear -clr "dacl,sacl"
           -actn rstchldrn -rst "dacl,sacl"
           -log "c:\my files\setacl log.txt"
           -silent

Same as the previous example, but no output is written to the screen, only to the log file ‘c:\my files\setacl log.txt’.

Example 1.11 – Filtering and Excluding Objects^

SetACL.exe -on "\\server1\share1\my dir" -ot file -actn ace
           -ace "n:domain1\user1;p:change"
           -ace "n:S-1-5-32-544;p:full"
           -ace "n:domain2\user2;p:full;m:aud_fail;w:sacl"
           -actn clear -clr "dacl,sacl"
           -actn rstchldrn -rst "dacl,sacl"
           -log "c:\my files\setacl log.txt"
           -silent
           -fltr "secrets" -fltr "top secret"

Same as the previous example, but files/directories containing the strings ‘secrets’ or ‘top secret’ are excluded.

Example 1.12 – Setting the Owner^

SetACL.exe -on "\\server1\share1\users" -ot file -actn setprot
           -op "dacl:np;sacl:nc"
           -rec cont_obj
           -actn setowner -ownr "n:S-1-5-32-544"

Resets a whole directory tree to what most administrators dream of: the owner of all files and directories is set to the group ‘administrators’ and the flag ‘allow inheritable permissions from the parent object to propagate to this object’ is enabled for all object’s DACLs; the SACLs are left unchanged.

Example 2 – Listing and Backup^

SetACL.exe -on "\\server1\share1\users" -ot file -actn list
           -lst "f:sddl;w:d,s,o,g"
           -rec cont
           -bckp "d:\data\setacl listing.txt"

Creates a complete listing of DACL, SACL, owner and primary group in SDDL format of the directory ‘\\server1\share1\users’ and all sub-folders. The listing is stored in unicode format in the backup file specified.

Example 3 – Restore^

SetACL.exe -on "dummy entry" -ot file -actn restore
           -bckp "d:\data\setacl listing.txt"

Restores all (!) security descriptor data (DACL, SACL, owner, primary group) from the backup file to its original location.

BEWARE: If you have the appropriate user rights (usually, being a member of the administrators group on the target system is sufficient) ALL data in the security descriptor is overwritten!

Comment: Only data contained in the backup file is overwritten, i.e. if you create a backup of the SACL only, when you restore it, the DACL, owner and primary group are left unchanged!

Example 4 – Copying Permissions Between Users^

SetACL.exe -on "\\server1\share1\users" -ot file -actn trustee
           -rec cont_obj
           -trst "n1:domain1\user1;n2:domain2\user2;ta:cpytrst;w:dacl"

This command copies all ACEs belonging to ‘domain1\user1′ to ‘domain2\user2′ resulting in a duplication of permissions: after the process domain2\user2 has the same permissions as domain1\user1. This might be useful in a migration scenario where users from domain1 are migrated (copied) to domain2.

Example 5 – Migrating Permissions Between Domains^

SetACL.exe -on "\\server1\share1\users" -ot file -actn domain
           -rec cont_obj
           -dom "n1:domain1;n2:domain2;da:repldom;w:dacl"

This is useful in a domain migration scenario where users from domain1 are migrated (copied) to domain2. This command replaces all SIDs belonging to users/groups from domain1 with SIDs of users/groups with the same names from domain2 resulting in a replacement of permissions: after the process domain2\user1 has the permissions domain1\user1 previously had.

Example 6 – Removing all Permissions of a User^

SetACL.exe -on "c:\\" -ot file -actn trustee 
           -trst "n1:UserOrGroup;ta:remtrst;w:dacl,sacl" -rec cont_obj -ignoreerr

Removes “UserOrGroup” from the ACLs of all files on drive C:.