>

Grant and revoke NTFS permissions with icacls

The CLI behind the Security tab — add or strip ACEs on files and folders without opening Explorer.

WindowsFilespermissionssecurityHigh risk
Run icacls <path> /grant "<user>:(OI)(CI)M" to grant modify rights with inheritance; use /remove "<user>" to revoke them.

01Command

Command
$ icacls "C:\Shared\Reports" /grant "Users:(OI)(CI)M"

02What it does

Permission letters: R=read, W=write, M=modify, F=full control; (OI)(CI) make the ACE inherit to files and subfolders. /grant adds an ACE, /deny adds an explicit deny (which wins over allows), and /reset replaces the ACL with inherited defaults. icacls displays the current ACL when run with just a path, which is the quickest ACL inspection method.

03Risk

RiskHigh risk
RequirementsAdministrator rights for most operations
!Warning: A bad /grant or /reset can lock you out of a folder or expose it to other users — test on a scratch folder and note that /reset discards custom ACEs.

04Undo

Undo
$ icacls "C:\Shared\Reports" /remove "Users"

05Sources

  • icacls | Microsoft Learn
    Microsoft · vendor-doc · 2026-09-17
    Evidence: Microsoft documents icacls /grant with permission masks such as M (modify) and inheritance rights (OI)(CI), plus /remove and /reset.
  • ICACLS - Windows CMD
    SS64 · technical · 2026-09-17
    Evidence: SS64 details the icacls grant syntax including (OI)(CI) inheritance flags, permission letters R/W/M/F, and /remove to strip a principal's ACEs.

Last verified: 2026-09-17 · Category: Files & Folders

06Related solutions

Take ownership of a file or folder with takeown and icacls
WindowsFilessystemsecurity

Two-step command sequence that makes you the owner of a locked file tree and grants yourself full control — the standard fix for 'Access is denied' on old profiles and OS reinstall leftovers.

High risk ✓ 2026-09-17
Securely wipe free disk space with cipher /w
WindowsFilessystemsecurity

Windows' built-in tool for overwriting freed disk clusters so previously deleted files can't be recovered — no third-party shredder needed.

Medium risk ✓ 2026-09-17
Fix 'scripts is disabled on this system' with Set-ExecutionPolicy
WindowsTerminaldevelopersecurity

Understand PowerShell's execution policy scopes and set the one that lets you run your own local scripts without gutting the security model.

Medium risk ✓ 2026-09-17