Windows - Set permission on folder only without recursing subobjects (slow for large directory trees)Useful Command-line Commands on Windowsicacls, Network Service, and setting ACLs on Windows Server 2008How do you use environment variables, such as %CommonProgramFiles%, in the PATH and have them recognized by services.exe?Write access to EVERYONE works, IUSR, IIS_IUSRS, DefaultAppPool does not work. why?Windows folder mounted in Unix, unable to touch anything 'permission denied'What permissions do I need to move a folder?What is the most efficent way to grant a user ready-only permisson to all folders and files on a file server?windows server C drive and shared folder permissionEvaluating current ACEs on NTFS ACLs with PowerShellchange ownership using Icacls on windows
Ex-manager wants to stay in touch, I don't want to
My perfect evil overlord plan... or is it?
Noob at soldering, can anyone explain why my circuit wont work?
Does the 500 feet falling cap apply per fall, or per turn?
Why was the ancient one so hesitant to teach Dr Strange the art of sorcery
Examples where existence is harder than evaluation
Intersecting with the x-axis / intersecting the x-axis
Watching the game, having a puzzle
Is it a Munchausen Number?
Why should password hash verification be time constant?
How to select certain lines (n, n+4, n+8, n+12...) from the file?
Why are low spin tetrahedral complexes so rare?
How to make a language evolve quickly?
Has there been evidence of any other gods?
What does formal training in a field mean?
Names of the Six Tastes
Why is it wrong to *implement* myself a known, published, widely believed to be secure crypto algorithm?
Extending Kan fibrations, without using minimal fibrations
date to display the EDT time
Is every story set in the future "science fiction"?
Why does it take longer to fly from London to Xi'an than to Beijing
Why does a variable size struct not compile in the Arduino IDE?
Are there variations of the regular runtimes of the Big-O-Notation?
Would encrypting a database protect against a compromised admin account?
Windows - Set permission on folder only without recursing subobjects (slow for large directory trees)
Useful Command-line Commands on Windowsicacls, Network Service, and setting ACLs on Windows Server 2008How do you use environment variables, such as %CommonProgramFiles%, in the PATH and have them recognized by services.exe?Write access to EVERYONE works, IUSR, IIS_IUSRS, DefaultAppPool does not work. why?Windows folder mounted in Unix, unable to touch anything 'permission denied'What permissions do I need to move a folder?What is the most efficent way to grant a user ready-only permisson to all folders and files on a file server?windows server C drive and shared folder permissionEvaluating current ACEs on NTFS ACLs with PowerShellchange ownership using Icacls on windows
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
There are many times when I wish to set a permission on a folder only, but all the programs i've tried will recurse through all sub files and folders during the process. As this is slow, is there any way to avoid this?
Things i've tried:
Windows Explorer: fails, as you can see in the gui, it will loop
through all subobjects.SetAcl.exe from Helge Klein: fails, as revealed by a nifty tool called ProcessMonitor
SetACL.exe -on "PATH" -ot file -actn ace -ace "n:USER;p:read_ex;i:np;m:set" -rec noFor those who don't know, the "i:np" clause means the permission shall apply to "this folder only".
icacls: fails (Process Monitor)
icacls "PATH" /grant USER:(NP)RX(does the same thing as the setacl command above)
(command lines just examples)
windows permissions windows-10 access-control-list
asked Apr 30 at 21:48
iPherianiPherian
1084
add a comment |
There are many times when I wish to set a permission on a folder only, but all the programs i've tried will recurse through all sub files and folders during the process. As this is slow, is there any way to avoid this?
Things i've tried:
Windows Explorer: fails, as you can see in the gui, it will loop
through all subobjects.SetAcl.exe from Helge Klein: fails, as revealed by a nifty tool called ProcessMonitor
SetACL.exe -on "PATH" -ot file -actn ace -ace "n:USER;p:read_ex;i:np;m:set" -rec noFor those who don't know, the "i:np" clause means the permission shall apply to "this folder only".
icacls: fails (Process Monitor)
icacls "PATH" /grant USER:(NP)RX(does the same thing as the setacl command above)
(command lines just examples)
windows permissions windows-10 access-control-list
asked Apr 30 at 21:48
iPherianiPherian
1084
Incidentally, you don't actually need the (NP) flag in those examples, so long as you don't say (OI) or (CI) then the permission will not be inherited. (NP) is meant to be used in combination with (CI) to limit the inheritance to a single level - it means that only the direct children of the object should inherit the permission, rather than the entire tree. (It isn't often used.)
– Harry Johnston
May 2 at 1:46
add a comment |
There are many times when I wish to set a permission on a folder only, but all the programs i've tried will recurse through all sub files and folders during the process. As this is slow, is there any way to avoid this?
Things i've tried:
Windows Explorer: fails, as you can see in the gui, it will loop
through all subobjects.SetAcl.exe from Helge Klein: fails, as revealed by a nifty tool called ProcessMonitor
SetACL.exe -on "PATH" -ot file -actn ace -ace "n:USER;p:read_ex;i:np;m:set" -rec noFor those who don't know, the "i:np" clause means the permission shall apply to "this folder only".
icacls: fails (Process Monitor)
icacls "PATH" /grant USER:(NP)RX(does the same thing as the setacl command above)
(command lines just examples)
windows permissions windows-10 access-control-list
asked Apr 30 at 21:48
iPherianiPherian
1084
There are many times when I wish to set a permission on a folder only, but all the programs i've tried will recurse through all sub files and folders during the process. As this is slow, is there any way to avoid this?
Things i've tried:
Windows Explorer: fails, as you can see in the gui, it will loop
through all subobjects.SetAcl.exe from Helge Klein: fails, as revealed by a nifty tool called ProcessMonitor
SetACL.exe -on "PATH" -ot file -actn ace -ace "n:USER;p:read_ex;i:np;m:set" -rec noFor those who don't know, the "i:np" clause means the permission shall apply to "this folder only".
icacls: fails (Process Monitor)
icacls "PATH" /grant USER:(NP)RX(does the same thing as the setacl command above)
(command lines just examples)
windows permissions windows-10 access-control-list
windows permissions windows-10 access-control-list
asked Apr 30 at 21:48
iPherianiPherian
1084
asked Apr 30 at 21:48
iPherianiPherian
1084
edited Apr 30 at 21:59
iPherian
asked Apr 30 at 21:48
iPherianiPherian
1084
asked Apr 30 at 21:48
iPherianiPherian
1084
asked Apr 30 at 21:48
iPherianiPherian
1084
1084
Incidentally, you don't actually need the (NP) flag in those examples, so long as you don't say (OI) or (CI) then the permission will not be inherited. (NP) is meant to be used in combination with (CI) to limit the inheritance to a single level - it means that only the direct children of the object should inherit the permission, rather than the entire tree. (It isn't often used.)
– Harry Johnston
May 2 at 1:46
add a comment |
Incidentally, you don't actually need the (NP) flag in those examples, so long as you don't say (OI) or (CI) then the permission will not be inherited. (NP) is meant to be used in combination with (CI) to limit the inheritance to a single level - it means that only the direct children of the object should inherit the permission, rather than the entire tree. (It isn't often used.)
– Harry Johnston
May 2 at 1:46
Incidentally, you don't actually need the (NP) flag in those examples, so long as you don't say (OI) or (CI) then the permission will not be inherited. (NP) is meant to be used in combination with (CI) to limit the inheritance to a single level - it means that only the direct children of the object should inherit the permission, rather than the entire tree. (It isn't often used.)
– Harry Johnston
May 2 at 1:46
Incidentally, you don't actually need the (NP) flag in those examples, so long as you don't say (OI) or (CI) then the permission will not be inherited. (NP) is meant to be used in combination with (CI) to limit the inheritance to a single level - it means that only the direct children of the object should inherit the permission, rather than the entire tree. (It isn't often used.)
– Harry Johnston
May 2 at 1:46
add a comment |
1 Answer
1
active
oldest
votes
The modern Windows API automatically recurses through the directory tree when a program changes the permissions on a directory, there is no option to prevent this from happening. Nor is Windows quite smart enough to realize when a particular change has no effect on the child objects.
However, if a program uses the older SetFileSecurity function this does not happen.
So you might try looking for old utilities, e.g., written for Windows 2000 or earlier.
Or you can use the built-in cacls command line tool, it is not as convenient to use as icacls and is officially deprecated, but it does not affect child objects unless you pass the /t option.
answered Apr 30 at 22:58
Harry JohnstonHarry Johnston
4,02012040
Beautiful. Saved me a lot of time.
– iPherian
Apr 30 at 23:41
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f965336%2fwindows-set-permission-on-folder-only-without-recursing-subobjects-slow-for-l%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
The modern Windows API automatically recurses through the directory tree when a program changes the permissions on a directory, there is no option to prevent this from happening. Nor is Windows quite smart enough to realize when a particular change has no effect on the child objects.
However, if a program uses the older SetFileSecurity function this does not happen.
So you might try looking for old utilities, e.g., written for Windows 2000 or earlier.
Or you can use the built-in cacls command line tool, it is not as convenient to use as icacls and is officially deprecated, but it does not affect child objects unless you pass the /t option.
answered Apr 30 at 22:58
Harry JohnstonHarry Johnston
4,02012040
Beautiful. Saved me a lot of time.
– iPherian
Apr 30 at 23:41
add a comment |
The modern Windows API automatically recurses through the directory tree when a program changes the permissions on a directory, there is no option to prevent this from happening. Nor is Windows quite smart enough to realize when a particular change has no effect on the child objects.
However, if a program uses the older SetFileSecurity function this does not happen.
So you might try looking for old utilities, e.g., written for Windows 2000 or earlier.
Or you can use the built-in cacls command line tool, it is not as convenient to use as icacls and is officially deprecated, but it does not affect child objects unless you pass the /t option.
answered Apr 30 at 22:58
Harry JohnstonHarry Johnston
4,02012040
Beautiful. Saved me a lot of time.
– iPherian
Apr 30 at 23:41
add a comment |
The modern Windows API automatically recurses through the directory tree when a program changes the permissions on a directory, there is no option to prevent this from happening. Nor is Windows quite smart enough to realize when a particular change has no effect on the child objects.
However, if a program uses the older SetFileSecurity function this does not happen.
So you might try looking for old utilities, e.g., written for Windows 2000 or earlier.
Or you can use the built-in cacls command line tool, it is not as convenient to use as icacls and is officially deprecated, but it does not affect child objects unless you pass the /t option.
answered Apr 30 at 22:58
Harry JohnstonHarry Johnston
4,02012040
The modern Windows API automatically recurses through the directory tree when a program changes the permissions on a directory, there is no option to prevent this from happening. Nor is Windows quite smart enough to realize when a particular change has no effect on the child objects.
However, if a program uses the older SetFileSecurity function this does not happen.
So you might try looking for old utilities, e.g., written for Windows 2000 or earlier.
Or you can use the built-in cacls command line tool, it is not as convenient to use as icacls and is officially deprecated, but it does not affect child objects unless you pass the /t option.
answered Apr 30 at 22:58
Harry JohnstonHarry Johnston
4,02012040
answered Apr 30 at 22:58
Harry JohnstonHarry Johnston
4,02012040
answered Apr 30 at 22:58
Harry JohnstonHarry Johnston
4,02012040
answered Apr 30 at 22:58
Harry JohnstonHarry Johnston
4,02012040
4,02012040
Beautiful. Saved me a lot of time.
– iPherian
Apr 30 at 23:41
add a comment |
Beautiful. Saved me a lot of time.
– iPherian
Apr 30 at 23:41
Beautiful. Saved me a lot of time.
– iPherian
Apr 30 at 23:41
Beautiful. Saved me a lot of time.
– iPherian
Apr 30 at 23:41
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f965336%2fwindows-set-permission-on-folder-only-without-recursing-subobjects-slow-for-l%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Incidentally, you don't actually need the (NP) flag in those examples, so long as you don't say (OI) or (CI) then the permission will not be inherited. (NP) is meant to be used in combination with (CI) to limit the inheritance to a single level - it means that only the direct children of the object should inherit the permission, rather than the entire tree. (It isn't often used.)
– Harry Johnston
May 2 at 1:46