2

How exactly is it possible to restrict read and execute permissions of a file, and leave everything else in tact. So you can't open the file, although you can do things like move it and delete it etc.

3 Answers 3

1

Those are not supported permissions in cacls. The supported permissions are: Read, Write, Change, Full Control, None.

EDIT: If one can copy it, they can read it, and if they can write/change it, they can delete it.

5
  • Sorry, I meant "execute" it, which does not affect anything else
    – James
    Jun 5, 2011 at 23:52
  • So you want them to be able to execute it, or not?
    – soandos
    Jun 5, 2011 at 23:53
  • I believe that execute is bascially the same as read
    – soandos
    Jun 5, 2011 at 23:54
  • Yes, I don't want them to be able to execute it. I set some permissions manually, and managed to restrict a file from executing, but you could still rename / move it etc. How could you achieve the same using a utility such as icacls or cacls?
    – James
    Jun 5, 2011 at 23:56
  • If you could tell me how you did it, then I would say maybe. Otherwise I am inclined to say no.
    – soandos
    Jun 6, 2011 at 0:13
1

Grant everything, but deny read/execute permissions:

icacls myfile /grant user:m /deny user:rx

Grant specific permissions:

icacls myfile /grant user:(gw,ge,d,wd,ra,rea)

Similar can be done with xcacls, but not with the old cacls.

0

This is the tool you want. You say you don't want them to be able to open it, but if they can read it, they can open it. As it came up in your conversation, you can restrict their ability to execute files.

http://support.microsoft.com/kb/318754

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .