I use the following command (in an admin batch file) to grant all users (specifically users on the network) full access to a folder and all its contents:

Icacls %fold% /grant Everyone:F /inheritance:e /T

However, it is not applying these settings to files newly created. What am I missing in the Icacls command?


You're enabling inheritance for this item separately from its ACL entries. This means it will receive ACEs from its parent. It has absolutely nothing to do with whether it'll give its own custom ACEs to be inherited by children.

You have to mark each ACL entry as inheritable, separately for child files (object inherit) and child folders (container inherit):

icacls foo /grant Everyone:(OI)(CI)F

This is equivalent to the "Inherit: [Files and subfolders]" drop-down in Properties – Security – Advanced.

When you add ACEs marked inheritable, icacls will propagate them automatically and the /T option is unnecessary (maybe even slightly harmful).

  • Tip: First use takeown then icacls. Everyone can be replaced with current user name. – Biswapriyo Sep 25 '18 at 8:41
  • 2
    @Biswapriyo: Why would you do that? OP specifically wants to grant access to all users, not just to themselves. – user1686 Sep 25 '18 at 8:44
  • question, what do I put in the place of foo? Or is that what I should have there? – Mark Deven Sep 25 '18 at 16:12
  • @MarkDodsons foo will be replaced by %fold%... it's just the folder path. – Pillsbury IT Doughboy Sep 25 '18 at 16:32
  • thanks. Does foo usually refer to the folder or file in question? – Mark Deven Sep 25 '18 at 16:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.