Icacls Command regaining Permission by Administrator and Everyone

icaclswindows-server-2012windows-server-2012-r2

Accidentally I gave Deny permission to 'Everyone' folder which points to my website. I am using Windows 2012.

Now I get access denied for Administrator and Website shows 500 error.

Can anyone give any icacls command how 'Administrator' get back access to Website D:\website\mysite and 'Everyone' can read/execute the site.

Following the answer It worked to pull up the site once Again. Now I am facing a New Challenge
1. To Certain Image Folders only "Administrator" has access no one else. !!
Means NETWORK SERVICES, SYSTEM, ADMINISTRATORS,USERS are not in the Security List.
Image Folder Permission Screen Shot

Can Anyone say How we Include these Access List to the Specified Folders, Please ?

Best Answer

You may need to take ownership of the directory before you can change permissions on it:

takeown /f D:\website\mysite /r /d y

(That's /r for recursive, and /d for default answer of y for yes.)

Then you should hopefully be able to run something like:

icacls  D:\website\mysite\*.*  /remove:d everyone /T

Related Solutions

Windows – Force ownership of folder structure without replacing other permissions – Windows Server 2008 R2 – takeown is erasing all other permissions

Ended up achieving what I wanted with Setacl. I wrote the following script which ripped through the entire folder structure and files, and gave ownership to the local Administrators group, then went through again and added a full control ACE for our IT domain group. It did this without replacing or removing the existing permissions/ACEs (other than replacing the owner), and I didn't get any access denied errors:

setlocal

set logDir=%1
set targetDir=%2
set logFileName=%~n2
set logFileNameEnding=%3

SetACL.exe -on %targetDir% -ot file -actn setowner -ownr "n:S-1-5-32-544;s:y" -rec cont_obj -log "%logDir%\%logFileName%-TAKEOWN-%LogFileNameEnding%.txt" -silent

SetACL.exe -on %targetDir% -ot file -actn ace -ace "n:domain\group;p:full;s:n;m:set;w:dacl" -rec cont_obj -log "%logDir%\%logFileName%-ADD-DOMAIN-GROUP-%LogFileNameEnding%.txt" -silent

endlocal

Access denied connecting to a share using Windows 10

You can only give permissions on Security Groups, double check that you haven't created a Distribution Group (you can see that in the group's properties, under "Group type").

Then, don't forget that you must logoff and logon again on the client before the group membership is effective. If you logon as User1 on PC1, and then you add User1 to Group1 in Active Directory, you have to logoff/logon again on PC1 with User1 before the group membership is effective.

Take a look at the "Effective Access" tab in the advanced Security Options of the folder, you will be able to choose a username and ask Windows to check if the user has access or not, and eventually why the access is denied.

Best Answer

Related Solutions

Windows – Force ownership of folder structure without replacing other permissions – Windows Server 2008 R2 – takeown is erasing all other permissions

Access denied connecting to a share using Windows 10

Related Topic