2

I can't get more info about the /x switch than:

This option copies file audit settings and System Access Control List (SACL) information. You imply /o when you use the /x option.

I am trying to make a script to simple backup a couple of directories and personal files to a harddrive that is connected to my pc. In example scripts I often see the /x switch being used, why should I care about SACL information? - I am using Windows 10.

Can someone point me in the direction of a good explanation or does someone have one themselves?

2 Answers 2

3

Why should I care about SACL information?

Normally the /x option is used because you want to preserve the security settings between the source and target file.

Note:

  • /x: Copies file audit settings and system access control list (SACL) information (implies /o).
  • /o: Copies file ownership and discretionary access control list (DACL) information.

So if you specify /x you will preserve file audit settings, SACLs, file ownership and DACLs.

As you want to do the copy for backup, and may wish to restore later, you want to preserve all of these settings.

If you don't do this then the following may happen:

When you copy or move files and folders by using Windows Explorer, the permissions that are set on the files or folders may change. For example, when you copy a file in an NTFS file system volume or between two NTFS volumes, Windows treats it as a new file. As a new file, it takes on the permissions of the destination folder, and you become the CREATOR OWNER.

...

When you use the Xcopy command with the /O /X /E /H /K switches to copy the files, the following inherited permissions apply:

  • The security settings that are directly assigned to the files and folders are retained.
  • The security settings that are inherited from the source parent folder are lost.
  • The security settings of the destination folders are inherited.
  • When you move files or folders to FAT volumes, the folders and files lose their NTFS permissions because FAT volumes do not support NTFS permissions.

Source HOW TO: Copy a Folder to Another Folder and Retain its Permissions


Further Reading

5
  • Thanks for your comment David! So, to use preserve the security settings do I have to use all the switches you mention in your second quote together? I also read: "/X Copies file audit settings (implies /O)" does this mean that I need to ues /O when using /X ?
    – Ludo
    May 13, 2016 at 12:57
  • No, those switches apply to the explanation below it. (if you use any of those switches this is what happens).
    – DavidPostill
    May 13, 2016 at 13:01
  • 1
    @Ludo If you use /x you don't need /o. in other words /x does the same as /o and some extra stuff.
    – DavidPostill
    May 13, 2016 at 13:02
  • Careful, SACLs are not the same as DACLs. System Access Control Lists relate to file access auditing, not file permissions.
    – Ben N
    May 13, 2016 at 14:26
  • @BenN Yes, but /x includes /o and /o "Copies file ownership and discretionary access control list (DACL) information". Answer clarified.
    – DavidPostill
    May 13, 2016 at 14:32
1

System Access Control Lists do not contain file access permissions! Those are stored in the Discretionary Access Control List, which is what you see when you look at the Security tab of a file's Properties window. DACLs are copied when you use /o. /x copies both DACL and SACL.

So what's in a SACL? SACLs only say what kinds of access to the file should be audited. If you don't know whether you're auditing file access, you almost certainly aren't, and so copying the (blank) SACLs would be pointless. If you do need to keep that information around, then you should supply /x.

Read more about file access auditing at TechNet.

2
  • From what I read, I don't really need SACL for a (small and personal) backup. So I should be good with only using /O ?
    – Ludo
    May 13, 2016 at 13:38
  • Right, you almost certainly don't need to worry about auditing for personal backups.
    – Ben N
    May 13, 2016 at 14:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .