Windows 10: icacls.exe doesn't show that ACL was inherited (I)

I noticed different behaviour of icacls.exe on two machines with Windows 10:



Windows 10 Version 1809 (OS Build 17763.678)



> echo "test" > file

> icacls.exe file

file NT AUTHORITY\SYSTEMF)

BUILTIN\AdministratorsF)

W10A\devF)



Successfully processed 1 files; Failed processing 0 files



> Get-Acl file | Format-List





Path : Microsoft.PowerShell.Core\FileSystem::C:\Users\dev\file

Owner : W10A\dev

Group : W10A\None

Access : NT AUTHORITY\SYSTEM Allow FullControl

BUILTIN\Administrators Allow FullControl

W10A\dev Allow FullControl

Audit :

Sddl : O:S-1-5-21-3626095386-1962481266-1351198716-1003G:S-1-5-21-3626095386-1962481266-1351198716-513DA;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;FA;;;S-1-5-21-3626095386-1962481266-1351198716-1003)





Windows 10 Version 1803 (OS Build 17134.950)



> echo "test" > file

> icacls.exe file

file NT AUTHORITY\SYSTEMI)(F)

BUILTIN\AdministratorsI)(F)

W10B\devI)(F)



Successfully processed 1 files; Failed processing 0 files



> Get-Acl file | Format-List





Path : Microsoft.PowerShell.Core\FileSystem::C:\Users\dev\file

Owner : W10B\dev

Group : W10B\None

Access : NT AUTHORITY\SYSTEM Allow FullControl

BUILTIN\Administrators Allow FullControl

W10B\dev Allow FullControl

Audit :



The file is local in both cases. Get-Acl shows that entries are inherited (ID) as expected. Why does icacls hide the information on the former machine? Interestingly, in the former case if I add any entry to the ACL (e.g. deny access to user X), the next call to icacls.exe shows (I) flags.

:)

 

Reset default ACLs for C:\Program Files\WindowsApps

I did not have to use the recovery disk option mentioned previously. I just had to run it from the command prompt in administrator mode:

Parameter description:

• /reset Replaces ACLs with default inherited ACLs for all matching files.
  
• /t Performs the operation on all specified files in the current directory and its subdirectories.
  
• /c Continues the operation despite any file errors. Error messages will still be displayed.
  
• /q Suppresses success messages.
  

Reference: icacls command reference

Note: I think I may have also restarted the computer like suggested, but I don't think that is required.

 

Move a file into a folder with a non-inherited ACL rule, the file will not inherit ACL from parent, why?

Hi,

I have an issue to setup ACL rule correctly when I move files around folders, and it seems a Windows bug...

When I move a file into a folder with a non-inherited ACL rule, the file will not inherit ACL from its parent.

For example,

D:\Folder has an explicit rule on it, which say user A has read permission of it.

And a file "Iamfile" is created in D:\ which will inherit rules from D:\ correctly.

At this moment, if you move the file "iamfile" to D:\Folder from Windows Explorer, anything is fine, iamfile will inherit permission from D:\Folder.

However, it you use "MOVE" command to do the same operation, the file "iamfile" will not inherit permission from D:\Folder, and all original rules inherit from D:\ will become explicit rules on D:\Folder\iamfile.

I'm not so sure it's a by-design or it's a bug, but I think its later.

Can anyone help me to check this problem? or how can I preserve inheriting permission from its parent when I using command line tool to do that?

Thanks.

Jack

 

Reset default ACLs for C:\Program Files\WindowsApps

Like this to reset permission on this folder:

The things was: