icacls - View and Change Permissions
Sometimes you try to open a folder and see “You don’t have permission to access this folder,” or you try to delete a file and get “Access is denied.”
The cause is the permissions (ACL: access control list) set on the file or folder. In Command Prompt, you can view and change permissions with the icacls command, and take ownership with the takeown command.
This article explains how to use these two commands, focusing on the most common procedures.
Basic Syntax of the icacls Command
icacls <file or folder> [options]Run without options, it displays the current permissions.
icacls "C:\work"
Each line is the setting for one user (or group), shown in the form user:(permission).
Permission Codes
Codes such as (F) and (M) show the permission that is granted. These five are the ones you will use most often (called “simple rights”).
| Code | Meaning |
|---|---|
F | Full control (all operations, including changing permissions) |
M | Modify (read, write, and delete) |
RX | Read and execute |
R | Read-only |
W | Write-only |
There are also individual rights such as D (delete), but the five above are enough to start with.
Inheritance Codes
Whether the permissions on a folder are passed on to the files and subfolders inside it is shown by codes placed before the permission.
| Code | Meaning |
|---|---|
(OI) | Object inherit. Passed on to files in the folder |
(CI) | Container inherit. Passed on to subfolders in the folder |
(IO) | Inherit only. Not applied to the folder itself |
(NP) | No propagate. Passed on only one level down, not further |
(I) | The setting was inherited from the parent folder |
To give permissions to a whole folder, you normally add both (OI)(CI).
Grant Permissions (/grant)
Use /grant to add permissions for a user or group.
icacls "C:\work" /grant "Users:(OI)(CI)M"This gives the Users group “Modify” permission on C:\work and everything inside it.
For the signed-in user, you can use the %USERNAME% environment variable.
icacls "C:\work" /grant "%USERNAME%:(OI)(CI)F"/grant adds to the existing settings. To replace existing settings, use /grant:r.
icacls "C:\work" /grant:r "%USERNAME%:(OI)(CI)RX"With /grant:r, any existing allow permissions for the specified user are replaced by the new ones (inherited entries and deny entries are not replaced).
Built-in group names can be displayed differently depending on the OS language. To be safe, specify a SID with a leading *. For example, Administrators is *S-1-5-32-544 and Everyone is *S-1-1-0.
icacls "C:\work" /grant "*S-1-5-32-544:(OI)(CI)F"Deny and Remove Permissions
To block a specific user, use /deny.
icacls "C:\work\secret.txt" /deny "Guest:(R)"To remove a user’s entry altogether, use /remove.
icacls "C:\work\secret.txt" /remove "Guest"A deny (/deny) entry set at the same level generally takes precedence over an allow entry. If you deny yourself or the Users group, you may lock yourself out. Use it only when you really need to.
Change Subfolders and Files Too (/T)
With /T, the operation is applied to all files and subfolders under the specified folder. With /C, processing continues even if errors occur.
icacls "C:\work" /grant "%USERNAME%:F" /T /CControl Inheritance (/inheritance)
| Option | Behavior |
|---|---|
/inheritance:e | Enable inheritance |
/inheritance:d | Disable inheritance and copy the inherited entries as explicit entries |
/inheritance:r | Disable inheritance and remove all inherited entries |
/inheritance:r removes all inherited entries, so if no explicit entries have been set, nobody may be able to access the item afterward. If you are unsure, use /inheritance:d.
To return permissions to their default state (inherited from the parent folder), /reset is handy.
icacls "C:\work" /reset /T /CPermissions you granted to users and any deny entries are lost and replaced with those inherited from the parent folder. With /T this affects everything underneath, so back up with /save first.
Fixing “Access Is Denied”
When you cannot access a folder created by another user, or data moved from an old PC, the basic procedure is to take ownership, then grant yourself permissions. Do this in a Command Prompt run as administrator.
1. Take Ownership (takeown)
takeown /f "D:\old-data" /r /d y| Option | Meaning |
|---|---|
/f | The target file or folder (wildcards allowed) |
/r | Include subfolders and files |
/d y | If you lack permission to list a folder’s contents, answer “yes” and continue |
/a | Make the Administrators group the owner (without it, the current user becomes the owner) |
When you use /r, also specify /d y (or /d n) so processing continues without prompts.
2. Grant Permissions (icacls)
Becoming the owner does not automatically grant you access. Follow up with icacls to grant yourself permissions.
icacls "D:\old-data" /grant "%USERNAME%:(OI)(CI)F" /T /CAfter these two lines, you can usually open or delete the folder.
Changing ownership or permissions on C:\Windows, C:\Program Files, or a drive root (C:\) can stop Windows from working properly. Change only folders that contain your own data.
Back Up and Restore Permissions
It is reassuring to save the current settings before you change them.
icacls "C:\work\*" /save "%USERPROFILE%\work-acl.txt" /TTo revert, run /restore and specify the folder that contains the saved items.
icacls "C:\work" /restore "%USERPROFILE%\work-acl.txt"For /restore, specify the folder that contained the saved items. In the example above, the contents of C:\work\* were saved, so specify C:\work.
Using Them in a Batch File
icacls and takeown set ERRORLEVEL to 0 on success and to a non-zero value on failure, so you can branch on the result. if errorlevel 1 only checks the previous command, so test after each one. Also, > nul hides only normal output; error messages are still shown.
@echo off
setlocal
set "TARGET=D:\old-data"
takeown /f "%TARGET%" /r /d y > nul
if errorlevel 1 (
echo Failed to take ownership. Check that you are running as administrator.
exit /b 1
)
icacls "%TARGET%" /grant "%USERNAME%:(OI)(CI)F" /T /C > nul
if errorlevel 1 (
echo Failed to change permissions.
exit /b 1
)
echo Permissions changed.
endlocal