Windows 10: Icacls command usage ?

Only by running as administrator. I can make a new folder by clicking on the administrator shield to get administrator authority.





But can't save anything as my normal (Admin) user.





This is correct authorities and should look like this: Code: Microsoft Windows [Version 10.0.11082] (c) 2016 Microsoft Corporation. All rights reserved. C:\Windows\system32>icacls "C:\Program Files" C:\Program Files NT SERVICE\TrustedInstallerF) NT SERVICE\TrustedInstallerCI)(IO)(F) NT AUTHORITY\SYSTEMM) NT AUTHORITY\SYSTEMOI)(CI)(IO)(F) BUILTIN\AdministratorsM) BUILTIN\AdministratorsOI)(CI)(IO)(F) BUILTIN\UsersRX) BUILTIN\UsersOI)(CI)(IO)(GR,GE) CREATOR OWNEROI)(CI)(IO)(F) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGESRX) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGESOI)(CI)(IO)(GR,GE) Successfully processed 1 files; Failed processing 0 files C:\Windows\system32>[/quote]

 

Hrm. The five levels deep sub-folder to which I wanted to grant write access; this is the info from icacls.

I ran this command /remove:g %userdomain%\%username% on the 5 levels deep sub-folder as mentioned above. The result;
Successfully processed 1 files; Failed processing 0 files

When I ran strictly icacls on the 5 levels deep sub-folder after removing; there remains (F) full access ?

The frown emicons are really suppose to be right bracket (

 

OK, you've added Everyone - you can remove it with

icacls "C:\Program Files\Test\Test\Test" /remove:g Everyone /t

(Don't forget the /t to process subdirectories also.)

The rest of it looks OK except you don't have All Application Packages at the bottom (unless it is cut off). That may cause problems for your store apps...

BTW if you use

Code:

 instead of [quote] tags it doesn't turn things into smileys... [quote]   *Sad [/quote]  Code: :([/quote]

 

I don't understand ?

Icacls is a command to give full access to a folder and or any sub-folders that is it's main purpose ?

 

icacls is a command to change or display access. You noticed this earlier *Wink

In post #15 you have indicated you have Everyone which you need to remove and you don't have ALL APPLICATION PACKAGES which you should (but perhaps you didn't copy/paste it all into the quote).

The ALL APPLICATION PACKAGES SID is used by the modern Store Apps so if you are missing this SID in Program Files directory they will not work correctly.

You need to compare what you have to the defaults which I posted in post #14.

 

I don't have All Application Packages listed for the 5 level deep sub-folder ?

Before running this command I couldn't write to any folder in Program Files, then I realized before successfully running the command that I could write to the folder Program Files, when previously even running explorer with admin privileges, I couldn't write to program files, what I find odd.

Code: NT SERVICE\TrustedInstallerI)(F) NT SERVICE\TrustedInstallerI)(CI)(IO)(F) NT AUTHORITY\SYSTEMI)(F) NT AUTHORITY\SYSTEMI)(OI)(CI)(IO)(F) BUILTIN\AdministratorsI)(F) BUILTIN\AdministratorsI)(OI)(CI)(IO)(F) BUILTIN\UsersI)(RX) BUILTIN\UsersI)(OI)(CI)(IO)(GR,GE) CREATOR OWNERI)(OI)(CI)(IO)(F)[/quote] It could also be that I'm not re-creating the problem and that is where icacls comes into help ? *Smile Anyhow I suppose I'll continue to understand this command. *Smile