1

I want to set permissions so that an executable file cannot be deleted or renamed but can be executed.

When I deny it to be deleted, also it can't be executed. Why?

Is there a way to make it undeletable but executable? (I am using advanced permissions to set it to allow execute and read the file).

2
  • Exactly how did you deny it being deleted? – Moab Jun 30 '18 at 15:30
  • Jus denied it to delet in the advanced permissions, also set it to allow execute and reade the file. – I am not Here Jun 30 '18 at 16:04
1

Prevent file Deletion or Rename but allow Read and Execute access

Try icacls with the below syntax against the file you want to lock down and with the username (or security group name) for which it'll apply. There are comment notes in the script above each command appended with ::: explaining what each does specifically to ACL the permissions.

You should reset the ACL permissions back to the way they were originally set initially before you made whatever changes you made before running this. Once you complete that, verify that the account can execute the file, and then afterwards run the below script.

Essentially this disables ACL inheritance to the folder the executable file resides and the file itself. It then grants an explicit read and execute to both the folder and the executable file. To prevent the renaming of the file, it denies create files / write data to the folder the executable file resides. Lastly, it explicitly denies delete access to both the folder and the executable file as well.


Script

@ECHO ON
SETLOCAL ENABLEDELAYEDEXPANSION
SET "Exe=C:\Folder\Path\file.exe"
SET "uAccount=Username"
FOR %%a in ("%Exe%") DO SET "eFolder=%%~DPa"
::: This strips the last "\" from the folder the exe resides so icacls can process
SET "eFolder=!eFolder:~0,-1!"

::: Disables ACL inheritence on the folder the exe file resides but copies all ACLs as inherited before removing
ICACLS "!eFolder!" /inheritance:d /grant:r "%uAccount%:(OI)(IO)" /C
::: Remove all granted permission ACLs on only the folder the exe file resides
ICACLS "!eFolder!" /remove:g "%uAccount%" /C
::: Remove all denied permission ACLs on only the folder the exe file resides
ICACLS "!eFolder!" /remove:g "%uAccount%" /C
::: Grants explicit read and execute ACL access on only the folder the exe file resides
ICACLS "!eFolder!" /grant:r "%uAccount%:(RX)" /C
::: Denies delete ACL access on only the folder the exe file resides  
ICACLS "!eFolder!" /deny "%uAccount%":(DE)
::: Denies create files / write data ACL access on only the folder the exe file resides  
ICACLS "!eFolder!" /deny "%uAccount%":(WD)

::: Disables ACL inheritence on the exe file only but copies all ACLs as inherited before removing
ICACLS "%Exe%" /inheritance:d /grant:r "%uAccount%:(OI)(IO)" /C
::: Remove all granted permission ACLs on only the exe file
ICACLS  "%Exe%"  /remove:g "%uAccount%" /C
::: Remove all denied permission ACLs on only the exe file
ICACLS  "%Exe%"  /remove:g "%uAccount%" /C
::: Grants explicit read and execute ACL access only to the exe file
ICACLS "%Exe%" /grant:r "%uAccount%:(RX)" /C
::: Grants an explicit deny of delete ACL access only to the exe file
ICACLS "%Exe%" /deny "%uAccount%":(DE)


PAUSE
EXIT

Note: Change the value of the Exe= variable to be the full explicit path to the executable file you wish to lock down, and the value of the uAccount= variable to be the username (or security group names) of the account (or group) which you wish this to be performed.


GUI ACL Permission Clarification

Folder the exe resides

enter image description here

The exe file itself enter image description here


Further Resources

5
  • Nice job you did! But there's some problems: * I just need the folder and the ".exe" file can't be renamed and deleted. I need still put files on this folder and delet this files then. Only the .exe file will be not deleted. – I am not Here Jun 30 '18 at 21:29
  • Also i having a problem with the name of my folder Pay&Go. Tried to skip the & with ^ but it worked for only some lines, another lines (i don't know why) didn't recognize the folder. – I am not Here Jun 30 '18 at 21:52
  • You are helping a lot! I really thank you for that! Well, the problem of the & is still happenning, the first step of te script don't recognize the name, but the last part recognize. It's strange... I'm waiting you think in a way to deny renaming name but allowing put files in ;) – I am not Here Jul 1 '18 at 1:09
  • Just tried your new script and the problem with the & is solved. Worked fine! So, the part of creating a sub-folder i'll try tomorrow. I tell you how it was. Thanks for while! I've uploaded my script anyway pastebin.com/CTgZF17K My system lenguage is Portuguese - Brazilian. I use Windows 10 Home Single Leanguage. – I am not Here Jul 1 '18 at 2:44
  • Just worked fine! I made a sub-folder and somes adjusts and everything happened good. There's only one last thing if you can help me, that i can't doing. There's a way to block folder from reading but able it to puting files in? Also, using crtl+c and dropping with crtl+v. – I am not Here Jul 2 '18 at 2:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.