Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How exactly is it possible to restrict read and execute permissions of a file, and leave everything else in tact. So you can't open the file, although you can do things like move it and delete it etc.

share|improve this question

3 Answers 3

Those are not supported permissions in cacls. The supported permissions are: Read, Write, Change, Full Control, None.

EDIT: If one can copy it, they can read it, and if they can write/change it, they can delete it.

share|improve this answer
    
Sorry, I meant "execute" it, which does not affect anything else –  James Jun 5 '11 at 23:52
    
So you want them to be able to execute it, or not? –  soandos Jun 5 '11 at 23:53
    
I believe that execute is bascially the same as read –  soandos Jun 5 '11 at 23:54
    
Yes, I don't want them to be able to execute it. I set some permissions manually, and managed to restrict a file from executing, but you could still rename / move it etc. How could you achieve the same using a utility such as icacls or cacls? –  James Jun 5 '11 at 23:56
    
If you could tell me how you did it, then I would say maybe. Otherwise I am inclined to say no. –  soandos Jun 6 '11 at 0:13

This is the tool you want. You say you don't want them to be able to open it, but if they can read it, they can open it. As it came up in your conversation, you can restrict their ability to execute files.

http://support.microsoft.com/kb/318754

share|improve this answer

Grant everything, but deny read/execute permissions:

icacls myfile /grant user:m /deny user:rx

Grant specific permissions:

icacls myfile /grant user:(gw,ge,d,wd,ra,rea)

Similar can be done with xcacls, but not with the old cacls.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.