1

Why can't I remove a group from a file if it is being denied read permission even though I have read permission from my account, am part of the Administrators group, and I'm running icacls from an elevated command prompt?

This will remove the "Users" group just fine:

copy a b
icacls b /inheritance:d
icacls b /remove:g "Users"

Result: The file no longer has the "Users" group.

But if I remove read access then the group cannot be removed by icacls:

copy a b
icacls b /inheritance:d
icacls b /deny "Users":r
icacls b /remove:g "Users"

Result: The file still has the "Users" group.

To work around this I have to grant a group "full" permission first and then use /remove to guarantee that the group will be removed. But this feels like a vulnerability as a particular group will, briefly, have full access.

Improve this question

1 Answer 1

Reset to default
2

You're using the wrong switch. You need to use /remove:d:

icacls b /remove:d "Users"

When a group has been denied permissions, there are no rights for the /remove:g switch to remove.

Alternately, to remove any permissions assigned to the group, whether they are grant or deny, use:

icacls b /remove "Users"

Summary

  • /remove:g removes rights that are (G)ranted
  • /remove:d removes rights that are (D)enied
  • /remove removes all rights

More information about Icacls switches can be found on TechNet.

Improve this answer
1
  • I had to use /remove BUILTIN\Users on my server. Don't know why `BUILTIN` was required on a remove, works just fine on grants.
    – AlwaysLearning
    Aug 2, 2018 at 7:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.