icacls
icacls displays and modifies discretionary access control lists (DACLs) on files and directories — the command-line replacement for the deprecated cacls, and the tool that tells you what the Explorer “Security” tab is actually saying. PowerShell’s Get-Acl $path | Format-List is the equivalent for scripting.
Reading the output
icacls prints ACEs in a compact mnemonic syntax that differs from the GUI’s friendly labels:
| Token | Meaning |
|---|---|
(I) | ACE inherited from the parent container |
(F) | Full control |
(M) | Modify |
(RX) | Read & execute |
(R) / (W) | Read / Write |
(OI) | Object inherit — files in this folder inherit the ACE |
(CI) | Container inherit — subfolders inherit the ACE |
(IO) | Inherit only — ACE doesn’t apply to this object, only children |
(AD) | Append data / add subdirectory |
(WD) | Write data / add file |
(DE) / (DC) | Delete / delete child |
So BUILTIN\Users:(OI)(CI)(M) means Users can modify everything below this point, inherited onward — a classic privilege-escalation find on service binary directories.
The two traps the GUI sets for you
- Explorer shows only the first ACE per principal. Windows happily applies multiple ACEs to the same user or group, and their union — not the single displayed line — determines effective access. Only icacls/
Get-Aclshows the full list. - Deny ordering. When ACEs conflict, an explicitly set deny wins over everything. Allow permissions override only inherited denies. A user in two groups with contradictory settings is resolved by this rule, not by “most permissive wins”.
This is why permission auditing for escalation paths (writable service binaries, writable directories in PATH, weak DACLs on auto-run locations) must be done from the command line, and why “but the Security tab says…” is not evidence.
Common operations
icacls C:\path\to\object :: show DACL
icacls C:\path /grant "DOMAIN\user:(OI)(CI)M" :: grant modify, inheritable
icacls C:\path /save acls.txt /T :: snapshot DACLs (restorable with /restore)The /save + /restore pair is the safe way to bulk-edit permissions: snapshot first, experiment, roll back if you brick inheritance.
Sources
Related
- windows-services — service configuration DACLs live in the registry (
HKLM\SYSTEM\CurrentControlSet\Services\<name>\Security), and weak ones enable service hijack escalation - windows-file-association-hijacking — registry hive permissions gate another persistence class
- netsh-windows-firewall — sibling built-in triage tool for a different control plane