>

View and change NTFS file permissions on Windows (icacls)

Dump the ACL of any file or folder with icacls, then grant, deny or reset permissions with inheritance control.

WindowsFilespermissionsaclMedium risk
Run icacls "D:\Data" to view the ACL, and icacls "D:\Data" /grant "Users:(OI)(CI)M" to grant modify rights that inherit to children.

01Command

Command
$ icacls "D:\Data"

02What it does

The forgotten part is the permission suffix grammar: (OI)(CI) means object-inherit plus container-inherit so new files and folders get the ACE too, and leaving them off is why 'I set the permission but it did not apply' happens. icacls /reset replaces a mangled ACL tree with inherited defaults, the fastest repair after a bad /deny. /save and /restore dump and reload ACLs in SID form, which survives account renames that plain text listings do not.

03Risk

RiskMedium risk
!Warning: A /deny entry overrides every /grant for that principal and is hard to see afterwards — prefer /remove over /deny unless you truly need an explicit denial.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • ICACLS - Windows CMD
    SS64 · technical · 2026-09-17
    Evidence: SS64 details icacls syntax for /grant, /deny, /remove and the inheritance rights letters (OI, CI, IO, NP) used in ACE entries.
  • icacls | Microsoft Learn
    Microsoft · vendor-doc · 2026-09-17
    Evidence: Microsoft documents icacls for displaying and modifying discretionary access control lists (DACLs), including /grant with inheritance flags like (OI)(CI).

Last verified: 2026-09-17 · Category: Security & Privacy

06Related solutions

Check a drive for file system errors with chkdsk
WindowsFilessystemDiagnostics

Diagnose NTFS file system errors and bad sectors on any volume — including the system drive while Windows is running — before committing to a repair.

Low risk ✓ 2026-09-17
Mirror folders with robocopy for exact backups
WindowsFilessystemTerminal

Robocopy is Windows' built-in robust file copier: use /MIR to keep a destination folder as an exact one-way mirror of a source, resumable and restartable.

High risk ✓ 2026-09-17
Take ownership of a file or folder with takeown and icacls
WindowsFilessystemsecurity

Two-step command sequence that makes you the owner of a locked file tree and grants yourself full control — the standard fix for 'Access is denied' on old profiles and OS reinstall leftovers.

High risk ✓ 2026-09-17