1

I am trying to build an assortment of batch files that control permissions on files and folders via right click context menu. I know there are existing solutions out there but I am trying to code it myself.

Ideally I'd like the following separate commands:

  • Take Ownership of a Directory (Recursive)
  • Take Ownership of a File
  • Set Owner to Current User
  • Set Owner to Administrators
  • Set Owner to TrustedInstaller

Right now I'm focused on the Take Ownership functions. My problem is that I don't know the "Proper" way to Take Ownership of a directory and all its files and sub-directories.

There are various implementations scattered around the internet that "work", but the resulting permissions look really polluted with a lot of duplicate entries.

The "Take Ownership" commands floating around are all basically this:

cmd.exe /c takeown /f "%~1" /r /d Y && icacls "%~1" /grant *S-1-3-4:F /t /c /l /q

But when I run that command on a directory located in Program Files, this is what I get:

Duplicate Permission Entries

I don't know about you, but I think the access list looks pretty ugly/polluted. There are duplicates for every entry.

So I started messing with the /inheritance:d flag, which disables inheritance and copies the ACEs:

cmd.exe /c takeown /r /d Y /f "%~1" && icacls "%~1" /inheritance:d /grant *S-1-3-4:(OI)(CI)F /T /C /L /Q icacls "%~1" /grant administrators:(OI)(CI)F /T /C /L /Q

This command transfers ownership to the current user recursively, disables inheritance, grants the current user and Administrators full access for "This folder, subfolders, and files." (OI)(CI)

This is what I get now:

Cleaner ACLs

The access list looks a lot cleaner, but there is no inheritance.

I guess my questions are:

  1. When taking ownership of a folder recursively, should I keep inheritance enabled?
  2. How do I de-duplicate permission entries correctly, hopefully without completely disabling inheritance?
  3. Should I be using iCACLS /grant:r to replace permissions?
  4. Am I over-thinking things?!

Really appreciate any input on this.

2
  • "Am I over-thinking things?!" - Yes.
    – harrymc
    Jul 14 at 20:08
  • @harrymc :( Sorry if my question is a bit trivial. Even though it's a small problem to solve, I'd like to know if there is a Right Way™
    – Jay
    Jul 14 at 20:12

1 Answer 1

0

Yes I would always keep the inhertance. Instead of icacls I would use PowerShell: Copy permissions:

Get-ACL C:\Shared | Set-Acl C:\Shared1

Before you set permissions on the multiple files and folders, it is always recommended that you use the -WhatIf parameter to know on which file or folder permissions are being applied. lthough Set-ACL works fine, it's a clunky bit of code that isn't very 'powershelly'. As tfl mentioned, there's an external module called NTFSSecurity that makes this a lot easier: https://www.powershellgallery.com/packages/NTFSSecurity/4.2.4

Powershell

List folder ACLs and their current inheritance

Get-Item .\Data -Recurse | where {$_.psiscontainer -eq $true} | Get-NTFSAccess | select fullname,inheritanceenabled

To change the permissions you would need to change the inherance otherwise you can't modify it. But with $permissions = Get-Acl, you can save it in a variable and reapply if needed, or export to an csv and so on. https://thesleepyadmins.com/2020/04/28/export-folder-permission-using-powershell/

I always recommend it to export it first, and then changing, because you can restore if you make a mistake.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.