Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How exactly is it possible to restrict read and execute permissions of a file, and leave everything else in tact. So you can't open the file, although you can do things like move it and delete it etc.

share|improve this question

Those are not supported permissions in cacls. The supported permissions are: Read, Write, Change, Full Control, None.

EDIT: If one can copy it, they can read it, and if they can write/change it, they can delete it.

share|improve this answer
Sorry, I meant "execute" it, which does not affect anything else – James Jun 5 '11 at 23:52
So you want them to be able to execute it, or not? – soandos Jun 5 '11 at 23:53
I believe that execute is bascially the same as read – soandos Jun 5 '11 at 23:54
Yes, I don't want them to be able to execute it. I set some permissions manually, and managed to restrict a file from executing, but you could still rename / move it etc. How could you achieve the same using a utility such as icacls or cacls? – James Jun 5 '11 at 23:56
If you could tell me how you did it, then I would say maybe. Otherwise I am inclined to say no. – soandos Jun 6 '11 at 0:13

This is the tool you want. You say you don't want them to be able to open it, but if they can read it, they can open it. As it came up in your conversation, you can restrict their ability to execute files.

share|improve this answer

Grant everything, but deny read/execute permissions:

icacls myfile /grant user:m /deny user:rx

Grant specific permissions:

icacls myfile /grant user:(gw,ge,d,wd,ra,rea)

Similar can be done with xcacls, but not with the old cacls.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .