Stop permissions inheritance of all subfolders in Windows 7

Question

This is in Windows 7.

I have several high level folders. Each high level folder has a whole bunch of subfolders.

I need to assign one group to be "read only" to the high level folders, but "read and write" to every subfolder and everything lower.

I thought I could do this in two steps:

1. Assign "read and write" permissions at the high folder level, using "This Folder, Subfolders, and Files." This step works, the group gets Read & Write all the way down.

2. Open the high-level folder again, and assign "Read Only" for the group I'm trying to restrict, but this time, choose "This Folder Only" when I apply it. This step doesn't work.

I would think that Step 2 would leave every subfolder as "Read and Write," and apply the "read only" only the top level folder. But all the subfolders, all the way down, become "Read Only" also after step 2.

I think this is because all the subfolders are inheriting permissions. I was expecting setting different permissions using "This Folder Only" would disable inheritance to allow the different permissions I'm setting, but it's not working that way.

If I open the directory, select all the subfolders, and right click "Properties," it won't let me set permissions on multiple files at once. It only lets me set permissions if I do them one at a time.

I don't want to set thousands of file permissions manually. Any help?

Thanks,

t.spoon.

Answer 1

I have several high level folders. Each high level folder has a whole bunch of subfolders.

I need to assign one group to be "read only" to the high level folders, but "read and write" to every subfolder and everything lower.

Based on your question, your comment clarification, and the confirmation that the high-level [parent] folder(s) will have read-only access. Also confirming that all beneath subfolders (and files within each subfolder) will get modify access, so below are two examples of doing this in a batch FOR loop; one a batch script, and one a copy and paste into the command line.

Set your variables

• SET TopFolder=:

  • Set the SET TopFolder= value to equal the [parent] root-level folder with the full path and folder name. The loop will set the permissions based on what exists below this folder granting the explicit modify NFTS ACL access.

• SET UserOrGroupName=:

  • Set the SET UserOrGroupName= value to equal the user account name or security group name (i.e. <LocalUserName>, <LocalGroupName>, <Domain>\<UserName>, or <Domain>\<GroupName>).

Command Line Copy Example

@ECHO ON

SET TopFolder=C:\Users\User\Desktop\HighLevelFolder\Parent1
SET UserOrGroupName=User
::: Grant top folder read and execute access and have beneath folders and files inherit these permissions.
ICACLS "%TopFolder%" /grant:r "%UserOrGroupName%":(OI)(CI)RX
::: Iterate the subfolders beneath the [parent] root-level folder to grant the explicit modify access
FOR /F "TOKENS=*" %G IN ('DIR /B /AD "%TopFolder%\*"') DO ICACLS "%TopFolder%\%~G" /grant:r "%UserOrGroupName%":(OI)(CI)M
GOTO EOF

Batch Script Example

@ECHO ON

SET TopFolder=C:\Users\User\Desktop\HighLevelFolder\Parent1
SET UserOrGroupName=User
::: Grant top folder read and execute access and have beneath folders and files inherit these permissions.     
ICACLS "%TopFolder%" /grant:r "%UserOrGroupName%":(OI)(CI)RX
::: Iterate the subfolders beneath the [parent] root-level folder to grant the explicit modify access
FOR /F "TOKENS=*" %%G IN ('DIR /B /AD"%TopFolder%\*"') DO ICACLS "%TopFolder%\%%~G" /grant:r "%UserOrGroupName%":(OI)(CI)M
GOTO EOF

---

Further Reading and Sources

• ICACLS
• FOR /F

I used these ICACLS options:

/grant[:r] Sid:perm grants the specified user access rights. With :r,
    the permissions replace any previously granted explicit permissions.
    Without :r, the permissions are added to any previously granted
    explicit permissions.

perm is a permission mask and can be specified in one of two forms:
    a sequence of simple rights:
            M - modify access
            RX - read and execute access

inheritance rights may precede either form and are applied
only to directories:
        (OI) - object inherit
        (CI) - container inherit

Answer 2

Assign "read and write" permissions at the high folder level, using "This Folder, Subfolders, and Files." This step works, the group gets Read & Write all the way down.

This is the bit in which poster "Tom" went wrong.

What he should have done in this step was set the 'Apply To' value as Subfolders and files only.

You can restrict the user access on a directory by setting its access (e.g. RX) to 'This folder only', provided you set the access on its sub-objects (e.g. FULL) to 'Subfolders and files only'. Otherwise the settings will conflict, and Windows 7 will reject the change or else apply it in some other manner than you intend.

Tom's manual procedure is miles easier than struggling with the horrors of icacls.exe, but it is possible - in theory - to get the same result with the following (but I never have, except after first deleting all inherited rights, and after also deleting all explicit rights too, and either deleting all other users on the object or doing this for EVERY user on the object):

I firstly set FULL access on SUB-OBJECTS only -

icacls.exe "%directory%" /T /grant:r %username%:(OI)(CI)(IO)F

Then I restrict the User's access on the DIRECTORY itself -

icacls.exe "%directory%" /grant:r %username%:(RX,WDAC,WO,WD,AD,WEA,DC)