guide · static export
PC

Fix Folder Permissions with Icacls

Read an ACL without guessing, grant modify instead of full control, break inheritance deliberately and take ownership when nothing else works.

by@guidox updated:10/31/26 time:25 min level:Intermediate tested on:Windows 11 24H2 works on:Windows 10, Windows 11 tools:Command Prompt as administrator, A test folder
TL;DR

Read with `icacls`, grant with **/grant Users:(OI)(CI)M**, break inheritance with **/inheritance:d** and take ownership with `takeown /f`. Full control is almost never the right answer.

Before you start

Requirements

  • Admin rights
  • A test folder
  • Twenty-five minutes
Step by step

Instructions

01

Read the entries and their origin

Each line shows the principal, the rights and the inheritance flags. A leading I marks an entry that is inherited, and inherited entries cannot be removed at this folder.

icacls C:\Projects
02

Grant modify, not full control

Modify allows read, write and delete but not permission changes. Full control lets the holder rewrite the ACL and lock everyone else out.

icacls C:\Projects /grant Users:(OI)(CI)M
⚠ warningThe brackets matter: OI is object inherit, CI is container inherit. Without them the grant applies to the folder only.
03

Break inheritance on purpose

Copying the inherited entries makes them explicit and editable. Removing them instead leaves only what you add afterwards, which is the clean state for a private folder.

icacls C:\Projects /inheritance:d
04

Take the entries away

Remove a grant for a principal, or only the group grants with the g switch. Check the result in the same breath, because a typo produces a silent no-op.

icacls C:\Projects /remove:g Everyone
05

Take ownership when access is denied

Ownership decides who may change the ACL at all. Taking it as the administrators group keeps it recoverable instead of personal.

takeown /f C:\Projects /r /a
⚠ warningRecursive ownership of a system folder breaks services. Use it on data folders only.
06

Test as the affected user

The ACL is theory until another identity tries it. Run one command as that user instead of trusting the listing.

runas /user:testuser cmd
tipInside that window, dir C:\Projects shows the real result within a second.
Troubleshooting

Common issues

Access denied even as administrator

The ACL denies you before elevation helps. Take ownership, then grant yourself modify on the folder.

The change reverts within minutes

The entry was inherited from the parent and re-applied. Disable inheritance first, then edit.

/grant fails with invalid parameter

A principal name with a space needs quotes around the whole SID:name pair, not only the name.

Users can open files but not delete them

Delete needs write access on the parent folder as well. Grant modify on both, not just the file.

FAQ

Frequently asked

Share permissions or NTFS permissions?

The share is the door, NTFS is the lock inside. The stricter of the two wins, so grant full control on the share and be precise on NTFS.

Does icacls work over the network?

It edits the same NTFS ACL when you point it at a UNC path and have the rights on the server.

How to undo this

Restore inheritance with icacls C:\Projects /inheritance:e and delete the explicit entries you added. Keep the output of the first icacls call as the record of the original state.

Changelog · 1 entry
  1. 2026-10-31
    First version
Interactive version: checklist, feedback, related guides →

Free · no account needed · tracks your progress