← All cheat sheets

ICACLS

Plain-text reference · 7 KB. Read it, search it (Ctrl-F) or print it.

Windows Integrity Control Access Control List Tool.
View and modify file/folder permissions (ACLs).

VIEW PERMISSIONS#

icacls file.txt                      # View file permissions
icacls folder                        # View folder permissions
icacls folder /t                     # Recursive
icacls C:\*                          # All items in C:\
icacls . /t                          # Current dir recursive

PERMISSION NOTATION#


            

                        

                
INHERITANCE FLAGS#

                
(OI)    Object Inherit               # Files inherit
(CI)    Container Inherit            # Folders inherit
(IO)    Inherit Only                 # Not applied to current
(NP)    No Propagate                 # Don't pass to children
(I)     Inherited                    # Permission was inherited

            

                        

                
BASIC RIGHTS#

                
F       Full Control
M       Modify (read, write, execute, delete)
RX      Read and Execute
R       Read only
W       Write only
D       Delete

            

                        

                
SPECIFIC RIGHTS#

                
DE      Delete
RC      Read Control (permissions)
WDAC    Write DAC (change permissions)
WO      Write Owner
S       Synchronize
AS      Access System Security
MA      Maximum Allowed
GR      Generic Read
GW      Generic Write
GE      Generic Execute
GA      Generic All
RD      Read Data / List Directory
WD      Write Data / Add File
AD      Append Data / Add Subdirectory
REA     Read Extended Attributes
WEA     Write Extended Attributes
X       Execute / Traverse
DC      Delete Child
RA      Read Attributes
WA      Write Attributes

            

                        

                
GRANT PERMISSIONS#

                
icacls file.txt /grant User:R        # Grant read
icacls file.txt /grant User:F        # Grant full control
icacls file.txt /grant User:M        # Grant modify
icacls file.txt /grant User:RX       # Grant read/execute
icacls file.txt /grant User:(R,W)    # Grant read and write
icacls file.txt /grant "Domain Users":R
icacls file.txt /grant Everyone:R

# With inheritance
icacls folder /grant User:(OI)(CI)F  # Full, inherit to all
icacls folder /grant User:(OI)(CI)M  # Modify, inherit to all
icacls folder /grant User:(CI)R      # Read folders only

# Replace existing (use :r)
icacls file.txt /grant:r User:F      # Replace, not add

            

                        

                
DENY PERMISSIONS#

                
icacls file.txt /deny User:F         # Deny full control
icacls file.txt /deny User:W         # Deny write
icacls file.txt /deny User:(D)       # Deny delete

            

                        

                
REMOVE PERMISSIONS#

                
icacls file.txt /remove User         # Remove all for user
icacls file.txt /remove:g User       # Remove grants only
icacls file.txt /remove:d User       # Remove denies only

            

                        

                
RECURSIVE OPERATIONS#

                
icacls folder /grant User:R /t       # Recursive
icacls folder /grant User:(OI)(CI)F /t
icacls folder /remove User /t
icacls folder /deny User:W /t

            

                        

                
RESET & INHERITANCE#

                
icacls file.txt /reset               # Reset to inherited
icacls folder /reset /t              # Reset recursive

# Inheritance control
icacls folder /inheritance:e         # Enable inheritance
icacls folder /inheritance:d         # Disable (keep ACEs)
icacls folder /inheritance:r         # Disable (remove ACEs)

            

                        

                
OWNERSHIP#

                
icacls file.txt /setowner User       # Change owner
icacls folder /setowner User /t      # Recursive
icacls file.txt /setowner Administrators /t

            

                        

                
SAVE & RESTORE#

                
icacls folder /save acls.txt /t      # Save ACLs
icacls folder /restore acls.txt      # Restore ACLs

            

                        

                
COMMON USERS & GROUPS#

                
Everyone                             # All users
Administrators                       # Admin group
Users                                # Standard users
"Domain Users"                       # AD domain users
"Domain Admins"                      # AD domain admins
"Authenticated Users"                # Logged in users
SYSTEM                               # System account
"NETWORK SERVICE"                    # Network service
"LOCAL SERVICE"                      # Local service
CREATOR OWNER                        # File creator

# SIDs can also be used
S-1-5-32-545                         # Users group

            

                        

                
COPY PERMISSIONS#

                
icacls target /setowner User /t
icacls source /save acls.txt /t
icacls target /restore acls.txt

            

                        

                
SECURITY ANALYSIS#

                
# Find world-writable files
icacls C:\ /t /c /q 2>nul | findstr /i "Everyone:(.*W"
icacls C:\ /t /c /q 2>nul | findstr /i "BUILTIN\\Users:(.*W"

# Find files writable by all authenticated users
icacls C:\ /t /c /q 2>nul | findstr /i "Authenticated Users:(.*W"

# Check specific sensitive files
icacls C:\Windows\System32\config\SAM
icacls C:\Windows\System32\config\SYSTEM
icacls C:\Windows\repair\SAM

# Check program directories
icacls "C:\Program Files" /t /c

# Check service binaries
icacls "C:\path\to\service.exe"

            

                        

                
PRIVILEGE ESCALATION CHECKS#

                
# World-writable folders in PATH
for %p in ("%PATH:;=" "%") do @icacls "%~p" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos"

# Writable service binaries
for /f "tokens=2" %s in ('sc query state^= all ^| findstr SERVICE_NAME') do @for /f "tokens=3*" %a in ('sc qc %s ^| findstr BINARY_PATH_NAME') do @icacls "%a %b" 2>nul | findstr /i "(M) (F) (W)"

# Check scheduled task folders
icacls "C:\Windows\System32\Tasks" /t

            

                        

                
COMMON OPERATIONS#

                

            

                        

                
LOCK DOWN FILE#

                
icacls file.txt /inheritance:r       # Remove inheritance
icacls file.txt /grant Administrators:F
icacls file.txt /grant SYSTEM:F

            

                        

                
SHARE WITH USERS#

                
icacls folder /grant Users:(OI)(CI)RX

            

                        

                
FULL CONTROL FOR ADMIN ONLY#

                
icacls folder /reset
icacls folder /inheritance:r
icacls folder /grant:r Administrators:(OI)(CI)F
icacls folder /grant SYSTEM:(OI)(CI)F

            

                        

                
MAKE FOLDER PRIVATE#

                
icacls C:\Users\User\Private /inheritance:r
icacls C:\Users\User\Private /grant:r User:(OI)(CI)F
icacls C:\Users\User\Private /grant SYSTEM:(OI)(CI)F

            

                        

                
COMPARISON: ICACLS VS CACLS#

                
# icacls is the modern replacement for cacls
# icacls supports:
# - More granular permissions
# - Unicode paths
# - Integrity levels
# - Better inheritance control

            

                        

                
QUICK REFERENCE#

                
# View
icacls file.txt                      # View permissions
icacls folder /t                     # Recursive view

# Grant
icacls file /grant User:R            # Read
icacls file /grant User:M            # Modify
icacls file /grant User:F            # Full control
icacls folder /grant User:(OI)(CI)F  # Full + inherit

# Remove
icacls file /remove User             # Remove all
icacls file /remove:g User           # Remove grants

# Deny
icacls file /deny User:W             # Deny write

# Reset
icacls file /reset                   # Reset to inherited

# Inheritance
icacls folder /inheritance:e         # Enable
icacls folder /inheritance:d         # Disable (keep)
icacls folder /inheritance:r         # Disable (remove)

# Ownership
icacls file /setowner User

# Save/Restore
icacls folder /save acls.txt /t
icacls folder /restore acls.txt

# Flags
/t                                   # Recursive
/c                                   # Continue on errors
/q                                   # Quiet

            

                    

                
        
Defensive reference on CyberRamen. Offensive / red-team sheets live on
            OffensiveRamen.com.