Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to set file permissions so users from two Windows installations can access certain files from a shared NTFS hard disk, withouth resorting to give "Everyone" permissions.

From within an installation I can get rights for its local user(s), but I can't give permissions to the other user by SID:

icacls * /grant *S-1-5-21-3699620855-3856482933-2467390241-1001:R /T *S-1-5-21-3699620855-3856482933-2467390241-1001: No mapping between account names and security IDs was done.

Apparently Windows has to have record of the SID somehow. Is there a way to force it to give permissions to a "foreign" SID?

share|improve this question
Unless you have the ability to create a domain what you want isn't possible. It wouldn't be possible on Linux either. Windows respects the permissions of another Windows installation as it should. You could also simple share the drive with the other installation, once you do, you can limit the permissions of each User. – Ramhound Aug 5 '13 at 11:49

I was able to find this powershell function that purports to do exactly what you want:

function SetNTFSPermissionsBySid([string]$directory, [System.DirectoryServices.DirectoryEntry]$objAD)
    # Convert byte array sid to sid string
    $sID = New-Object System.Security.Principal.SecurityIdentifier $objAD.objectsid[0],0

    # Inheritance This Folder, Subfolders and Files)
    $inherit = []"ContainerInherit, ObjectInherit"
    $propagation = []"None"

    # Retrieve the ACL
    $aCL = Get-Acl $directory

    # Create Ace
    $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule($sID, "Modify", $inherit, $propagation, "Allow")

    # Add Ace to Acl    

    # Set Acl to the directory
    Set-Acl -aclobject $aCL -path $directory

All credit goes to Settings NTFS Permissions by SID in PowerShell by Remko Weijnen.

This would require PowerShell 3.0+ due to its use of Get-Acl and Set-Acl.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .