Search code examples
windowsnsisfile-permissionscacls

CACLS Confusion

During my NSIS setup script for a WinForms app, I use the following CACLS command to give the Users group full rights to a subfolder:

Exec 'CACLS "$INSTDIR\SubFolder" /E /T /C /G "Users":F'

So in effect the CACLS command executed is something like:

CACLS "c:\Program Files\MyApp\SubFolder" /E /T /C /G "Users":F

When I then look at the Folder permissions in Windows Explorer (right click on the folder and choose Properties, go to the Security tab), the correct permissions are there but they are uneditable.

Furthermore, clicking the Advanced button for the 'Advanced Security Settings' shows that SubFolder is inheriting the "Users" group permissions from a 'Parent Object', but what is that Parent Object, because its not the folder above.

Why are the permissions added by CACLS uneditable, and why are they inherited from nonexistent parent object? I thinking I may have set the options on CACLS wrong.

I'm on Windows XP.

Solution

  • I think I figured it out: Changing CACLS to use /P 'replace' rather than /G 'grant' seemed to work better:

    CACLS "c:\Program Files\MyApp\SubFolder" /E /T /C /P "Users":F

    The options that got created were then editable in the Windows Explorer 'security' tab.