0

I am forced to add a user who may only have access to one folder. Therefore, I need to remove the users and domain users permissions from all of my files. Right now, every users can see eachother's folder. All the Users folders have read permissions for the builtin "DOMAIN\Users" group, I would like to remove this. I tried running in the users folder:

for /d %G in (*) do icacls %G /remove Users /t"

and it is doing something to all the files and folders, but when I go back and check, the Users permission is still there.

  • icacls /? says syntax … /remove[:[g|d]] Sid. You need to use SID. To obtain SID for the BUILTIN\Users local group, parse whoami /groups /FO CSV or wmic path win32_group where "Caption='%ComputerName%\\Users'" get Sid. Google for Get SID from AD (Active Directory) User / Group if you need it. – JosefZ Oct 31 '18 at 15:32
  • @JosefZ: It also has a note that "SIDs may be given in numerical or friendly-name form" – user1686 Oct 31 '18 at 15:34
1

Apparently, /remove does not affect inherited ACLs:

C:\Windows\System32> pushd d:\bat\files2

d:\bat\files2> for /d %G in (*) do @icacls %G /T | findstr /I "folder \\Users"
folder BUILTIN\Administrators:(F)
       BUILTIN\Users:(I)(RX)
       BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
folder\xxx.csv BUILTIN\Administrators:(F)
               BUILTIN\Users:(I)(RX)

d:\bat\files2> for /d %G in (*) do @icacls %G /remove Users /T
processed file: folder
processed file: folder\xxx.csv
Successfully processed 2 files; Failed processing 0 files

d:\bat\files2> for /d %G in (*) do @icacls %G /T | findstr /I "folder \\Users"
folder BUILTIN\Administrators:(F)
       BUILTIN\Users:(I)(RX)
       BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
folder\xxx.csv BUILTIN\Administrators:(F)
               BUILTIN\Users:(I)(RX)

One needs to disable inheritance and copy the ACEs first:

d:\bat\files2> for /d %G in (*) do @(icacls %G /inheritance:d /T&&icacls %G /remove Users /T)
processed file: folder
processed file: folder\xxx.csv
Successfully processed 2 files; Failed processing 0 files
processed file: folder
processed file: folder\xxx.csv
Successfully processed 2 files; Failed processing 0 files

d:\bat\files2> for /d %G in (*) do @icacls %G /T | findstr /I "folder \\Users"
folder BUILTIN\Administrators:(F)
folder\xxx.csv BUILTIN\Administrators:(F)

Note the use of && operator in the following one-liner

for /d %G in (*) do @(icacls %G /inheritance:d /T&&icacls %G /remove Users /T)

instead of

for /d %G in (*) do @icacls %G /inheritance:d /T
for /d %G in (*) do @icacls %G /remove Users /T

Example applied to the following file structure:

d:\bat\files2> tree . /f

D:\BAT\FILES2
│   SampleInput.eml
│
└───folder
        xxx.csv

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.