ICACLS options: Why is /t needed with (OI)(OC)?

Question

If I use ICACLS.exe to set permissions on a folder with a command such as

icacls "C:\Some\Directory" /grant "somedomain\someUser:(OI)(CI)F" /t

why is the /t option necessary? Is it not the case that (OI)(CI) will cause the permissions to be inherited to all objects within the C:\Some\Directory tree?

To be a bit more specific, suppose in my example above I have a directory C:\Some\Directory\Tree. Suppose that this directory has no explicit permissions defined. Adding the explicit permission "somedomain\someUser:(OI)(CI)F" to that directory would accomplish nothing, since it is already inherited. Does icacls even do this? (Edit: yes, if you wait long enough!) So if I know a directory tree has no explicit permissions, I really don't need the /t option (which wastes a tremendous amount of time on an 8TB directory tree with hundreds of millions of files...)

Answer 1

Some experimenting on a trivial directory tree shows that:

1) The (OI)(CI) does indeed cause the permissions to be inherited - as inherited ACE's in the DACL of course, not explicit ACE's - to all sub-objects (given that inheritance has not been disabled on the sub-object), as one would expect.

2) The /t option causes icacls to traverse the tree and add the exact same permission to each sub-directory as an explicit permission.

The result is that if one looks at the security permissions on a sub-directory, you will see two identical entries, one being the inherited permission, and one being the directory explicit permission setting (unless inheritance was disabled on the subdirectory or some other intervening directory).

Whether one wants this or not is another question, but likely not. Having the permission specified twice is not particularly useful, unless there is some future changes you need to guard against.

On a massive file system, this can take a loooooooong time to complete.

The fact that the documentation states "whether or not they are set to inherit permissions" perhaps is to alert you to:

1) copying as explicit permissions to all sub directories may not be necessary if the permission contains (OI)(CI)

but

2) if a subdirectory is set to not inherit permissions, this actually accomplishes something significant: on such a directory, the permission would not be inherited from the parent (i.e. the (OI)(CI) inheritance is suppressed), but it would still be there by virtue of being added as an explicit permission.

Answer 2

Is it not the case that (OI)(CI) will cause the permissions to be inherited?

No. This is explained by the description for /t:

Traverse all subfolders to match files/directories. This will apply permission changes to all subfolders whether or not they are set to inherit permissions from the parent.

Source icacls