XcAcls Syntax

xcacls filename [/T] [/E] [/C] [/G user:perm;spec] [/R user] [/P user:perm;spec [...]] [/D user [...]] [/Y]

Where:

filename

indicates the name of the file or directory to which the access control list (ACL) or access control entry (ACE) should be applied. All standard wildcard characters can be used.

/T

recursively walks through the current directory and all its subdirectories, applying the chosen access rights to the matching files and/or directories.

/E

edits the ACL instead of replacing it. If you specify the following command line:

XCACLS test.dat /G Administrator:F

only the Administrator has access to TEST.DAT. All ACEs applied earlier are lost.

/C

causes XcAcls to continue if an "access denied" error occurs. If /C is not specified, XcAcls stops on this error.

/G user:perm;spec

grants access to user to the matching file or directory. The perm variable applies the specified access right to files and represents the special file-access-right mask for directories. The Perm variable accepts the following values:

R: Read
C: Change (write)
F: Full Control
P: Change Permissions (special access)
O: Take Ownership (special access)
X: EXecute (special access)
E: REad (Special access)
W: Write (Special access)
D: D Delete (Special access)

The spec variable applies only to directories, and accepts the same values as perm, with the addition of the following special value:

T: NoT Specified. Sets an ACE for the directory itself without specifying an ACE that is applied to new files created in that directory. At least one access right has to follow. Entries between ; and T will be ignored.

Notes

The access options for files (for directories, special file access and special directory access) are identical. For detailed explanations of these options, see the Windows 2000 operating system documentation.
All other options, which can also be set in Windows Explorer, are subsets of all possible combinations of the basic access rights. Therefore, there are no special options for directory access rights like LIST or READ.

/R user

revokes all access rights for the specified user.

/P user:perm;spec

replaces access rights for user. The rules for specifying perm and spec are the same as for the /G option. See XcAcls Examples.

/D user

denies access to the file or directory for user.

/Y

disables confirmation when replacing user access rights. By default, CACLS asks for confirmation. Because of this feature, when CACLS is used in a batch routine, the routine hangs until the right answer is entered. The /Y option was introduced to avoid this confirmation, so XcAcls can be used in batch mode.