Tuesday, September 13, 2011

Don't set files and folders permissions manually!

...unless you have to do it and as your last resort. My late father used to say, in a sort of philosophical way, something to the effect of "messing up is how you learn." And that's exactly what happened this weekend. I wasted many hours in the process trying to fix the access to my personal folders and files located in a separate partition, some 8 GB! But I learned a great deal. By default, any folder or file you create in your computer will have an owner (the person logged in to Windows) and "everyone" will have full access to them. Don't ask me how I decided to change these settings manually, really not knowing what I was doing, I admit. Next thing, access denied (!) to most of those files and the ones still visible had the dreaded little padlock icon. Then after much manual fixing, a Windows 7 (Vista and NT as well) utility came to the rescue: icacls. This command line utility is capable of displaying and modifying Access Control List (ACL) on folders and files explicit permissions. Warning: use it at you own risk; only advanced users should try it. This tool comes in handy when you have to make permissions changes to hundreds and even thousands of files at once. You can start by opening a DOS console with admin rights and then type icacls /? to see all the possibilities, but, let's face it, this is more complicated that it seems. Yet on the other hand, let me give you the skinny with actual examples (you replace parameters accordingly).

  1. Before assigning permissions you need to take ownership of the files and folders, assuming the owner is not the current logged user (as it should be). Use this syntax:
    takeown /F YourPath /A /R
    Notice how we are using still another application (takeown.exe) where /F is for the filename or directory, /A gives ownership to the administrators group instead to the current user (a necessary step, before you can assign it manually to the current user, by rather using the GUI tool —right-click on the file or folder / Properties / Security tab, etc.), /R applies changes to directories and subdirectories. You may have to repeat this operation a number of times for other folders since not always the changes trickle down to all files and folders. To learn more, type takeown /?
  2. Now, this is the command line for assigning or reassigning the actual permissions:
    icacls YourPath /inheritance:r /grant:r Everyone:(OI)(CI)F /T
    /inheritance:r removes all inherited ACEs (note that each assignment of permissions to a user or group is represented in the system as an access control entry or ACE); /grant:r assigns the specified user access rights but with the :r switch the explicit permissions previouly granted are replaced; (OI): object (file) inherit, (CI): container (folder) inherit, F: full access, /T: operation performed on all files/directories below the directory specified in YourPath. Once this command line has run, you may still have to do some manual adjustments using the GUI tool.  
Please NOTE: these command lines have worked for me, but this may not be your situation. Use them at your own risk, and, again, this resource is to be used only when you are in trouble. Do not use this for normal assignment of permissions. Leave the OS and/or an experienced administrator take care of that. No wonder, information and documentation for these 2 utilities (takeown.exe and icacls) is not readily available, in a sort of "handbook" form, but I'm sure I overlooked a lot of information out there. Here, for example you can watch at your leisure this bunch of videos on the subject. Finally, given the complexity of this subject, I have to say that I did not even start to scratch the surface of it.

No comments:

Post a Comment