In linux, ls -l lists files permissions, like this:

-rw-r--r--  1 user user      924 2011-07-01 20:23 test.txt

In Windows, commands tree and dir don't have the options to list permissions. How is it possible to list files and their permissions using command line only?


Use icacls:

> icacls Music
Music SNOW\grawity:(I)(F)

The older cacls tool is the only choice on Windows XP [although you can copy icacls.exe from Server 2003]. cacls does not know about some ACL modes, but displays most of them fine.

> cacls Music
F:\Users\Mantas\Music SNOW\grawity:F
                      CREATOR OWNER:(OI)(CI)(IO)F
                      NT AUTHORITY\SYSTEM:(OI)(CI)F

In both outputs, (OI) means "object inherit" (files will inherit this ACE), (CI) is "container inherit" (containers – i.e. folders – will inherit this ACE), (IO) is "inherit only".

Microsoft also used to provide an xcacls tool separately, but its functionality is now part of icacls.


You can use Powershell and the Get-Acl command

PS C:\> Get-Acl


Path              Owner                            Access  
----              -----                            ------  
C:\               NT SERVICE\TrustedInstaller      Everyone Allow  FullControl

Use it in conjunction with Get-ChildItem (aliased with dir and ls) to get the permissions for the files.

PS C:\> Get-ChildItem | Get-Acl

Or, using the alias:

PS C:\> Dir | Get-Acl
  • 13
    PS C:\> Get-Acl | fl for a nicer list. – AWippler Dec 2 '13 at 17:10
  • Can I alter this to skip a folder that I don't have access to? for example, when I ran this (not as admin) I got an error ("unauthorized operation") and the report stopped at the folder I did not have access to – Ben Jan 18 '18 at 0:14

You might also take a look at AccessChk from Sysinternals. The output can be parsed much easier.

C:\Users\jeremy>accesschk myad\simmonsj c:\inetpub

Accesschk v5.11 - Reports effective permissions for securable objects
Copyright (C) 2006-2012 Mark Russinovich
Sysinternals - www.sysinternals.com

RW c:\inetpub\custerr
RW c:\inetpub\history
RW c:\inetpub\logs
RW c:\inetpub\Roadkill
RW c:\inetpub\smartadmin
RW c:\inetpub\temp
RW c:\inetpub\wwwroot
  • It does a different thing though; it lists the effective access for the current (or specified) user, rather than the full configured access list. – grawity Aug 5 '14 at 6:18
  • 1
    I believe the OP's question could have been interpreted either way. Judging by the recent up-vote on my answer, this was useful to at least one other person besides me. My answer is not meant to argue with or disprove your answer. It is a different way to approach the problem to get a very similar answer. – JJS Aug 6 '14 at 20:13

dir /Q gives you the owner of the directories.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy