Icacls Grant all users access to a folder including new files?

Question

I use the following command (in an admin batch file) to grant all users (specifically users on the network) full access to a folder and all its contents:

Icacls %fold% /grant Everyone:F /inheritance:e /T

However, it is not applying these settings to files newly created. What am I missing in the Icacls command?

Solution

You're enabling inheritance for this item separately from its ACL entries. This means it will receive ACEs from its parent. It has absolutely nothing to do with whether it'll give its own custom ACEs to be inherited by children.

You have to mark each ACL entry as inheritable, separately for child files (object inherit) and child folders (container inherit):

icacls foo /grant Everyone:(OI)(CI)F

This is equivalent to the "Inherit: [Files and subfolders]" drop-down in Properties – Security – Advanced.

When you add ACEs marked inheritable, icacls will propagate them automatically and the /T option is unnecessary (maybe even slightly harmful).

Comments

[Biswapriyo]

Tip: First use takeown then icacls. Everyone can be replaced with current user name.

[user1686]

@Biswapriyo: Why would you do that? OP specifically wants to grant access to all users, not just to themselves.

[Mark Deven]

question, what do I put in the place of foo? Or is that what I should have there?

[Vomit IT - Chunky Mess Style]

@MarkDodsons foo will be replaced by %fold%... it's just the folder path.

[Mark Deven]

thanks. Does foo usually refer to the folder or file in question?

[user1686]

It is a commonly used placeholder word. Just like your %Fold% in your own example, it refers to whatever it needs to refer at the given moment, and you're expected to substitute it with the real thing, be it a file or something else.