Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am planning on re-installing Windows soon. All files on my disk D:, which I am not planning on erasing, will have security descriptors from the current Windows installation with new security descriptors coming from the new Windows installation.

Is there a way to remove all security descriptors from all folders and files on a drive other than the ones created by current installation? Please let me know how to do it.

share|improve this question
up vote 2 down vote accepted

icacls is the way to go. I think this will do it, but if not, you can play with the other options:

icacls * /T /Q /C /RESET

share|improve this answer
This will restore all ACL settings to default inherited. I am worried if this will break some system folders, like $RECYCLE.BIN? On the other hand I can simply delete it afterwards and it will be recreated by Windows. – Sergiy Byelozyorov Jul 15 '11 at 11:35
@Sergiy Byelozyorov I am not sure it will (after all the disk gets a set of default permissions right off the bat), but compared to other options like changing all the ACL's manually, that is pretty easy to fix after-the-fact. – KCotreau Jul 15 '11 at 11:38
Why are you worried about the system files from a previous installation. You should only be worried about your own data. – Ramhound Jul 15 '11 at 12:11
+1 for undocumented parameter – Moab Jul 15 '11 at 14:36
@KCotreau: Agree. I should not worry about old system files. – Sergiy Byelozyorov Jul 15 '11 at 16:19

Other than icacls provided by KCotreau answer in here, you can also handle security descriptors through PowerShell. You may want to start here:

TechNeth: Windows PowerShell Tip of the Week: Working with Security Descriptors

Take particular notice that you can set your a desirable security descriptor on one file and then use that as a template for every other file. The following commands does this:

C:\>$MyNewACL = get-acl templatefile.txt
C:\>get-childitem x:\somefolder -recurse -force | set-acl -aclobject $MyNewACL

The first command will copy the security descriptions of the file templatefile.txt, that you first set as having the settings you want to repopulate some folder with. The second command does the actual changes to all the files in that folder inside drive X (-recurse will get files and directories inside that folder, and -force will get hidden files).

See also: Set-Acl command

share|improve this answer
I like your answer little more than KCotreau's, since it permits me to select security descriptors on my own. On the other hand, why would I need anything else than default? :) – Sergiy Byelozyorov Jul 15 '11 at 11:36
It gives you more control no doubt, but it is also more involving. You may want to keep KCotreau's suggestion in mind too for those situations where this level of control isn't needed. – A Dwarf Jul 15 '11 at 11:43

If you want all of the drive contents to have the same ACLs, just set them at the top level (the drive itself) and the use the option to replace ACLs on all subfolders and files (in the advanced security preferences).

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .