Windows 7: Icacls, syntax question.

zzpack · 24 May 2011

I want to give interactive user folder permissions, with icacls.
But I can´t find the correct syntax for the interactive user.

e.g.
icacls folder1 /grant user1:(M) ---> Works very well. User1 gets modify rights to the folder "folder1".

Now I want to give interactive user the same modify rights.
icacls folder1 /grant INTERACTIVE:(M)

But that syntax does not work. Anyone that can help?

Dwarf · 24 May 2011

What do you mean by interactive user? If you mean the currently logged in user, then this syntax will not work. With this command, you need to repeat it and explicitly name each user for whom you wish to grant rights to.

zzpack · 25 May 2011

Quote: Originally Posted by Dwarf

What do you mean by interactive user? If you mean the currently logged in user, then this syntax will not work. With this command, you need to repeat it and explicitly name each user for whom you wish to grant rights to.

The syntax icacls folder1 /grant *S-1-5-4:(M), should work.

Here you can read some more about Windows security identifiers,
http://technet.microsoft.com/en-us/l...8WS.10%29.aspx

Dwarf · 25 May 2011

I'm not particularly familiar with this command. However, do you have a sub-key in the registry under HKEY_USERS called S-1-5-4? See if the syntax works with one of the keys that is there. I suggest S-1-5-21.

Dwarf · 25 May 2011

Strange. I've just tried it on a dummy folder, and it appears to have worked.

Code:

Microsoft Windows [Version 6.2.7955]
Copyright (c) 2011 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>icacls c:\users\cyclops\desktop\test /grant cyclops:(m)
processed file: c:\users\cyclops\desktop\test
Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>icacls c:\users\cyclops\desktop\test /grant *S-1-5-4:(m)
processed file: c:\users\cyclops\desktop\test
Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>

zzpack · 25 May 2011

Quote: Originally Posted by Dwarf

Strange. I've just tried it on a dummy folder, and it appears to have worked.

...

Yep, works fine for me too. I´m happy I found a solution.

Dwarf · 25 May 2011

You're welcome. Did you find out what was causing the error? I'm guessing something in the syntax.

zzpack · 25 May 2011

I found the solution on another forum, I just wanted to share.

Dwarf · 25 May 2011

Ahh, I think I get it now. You mean you needed to substitute *S-1-5-4 for INTERACTIVE, correct?

zzpack · 26 May 2011

Quote: Originally Posted by Dwarf

Ahh, I think I get it now. You mean you needed to substitute *S-1-5-4 for INTERACTIVE, correct?

Exactly. I didn´t know about the SID syntaxes, S-1-5-4 e.g.
Another way is of course to right-click on a folder and
give out permissions via properties, but that is not a solution for software
distribution.

Windows 7: Icacls, syntax question.

Icacls, syntax question. problems?