Copy NTFS permissions to another folder

JasminLandry

Hi TE, Does anyone know how to copy NTFS permissions of a folder and then "paste it" or export it to another folder? I tried icacls, robocopy, setacl, secedit but none of them really work. I am able to export the permissions with the commands but I'm not able to import them to a different folder. Any ideas would be greatly appreciated.

ptilsen

What did you try exactly, and under what circumstances? Robocopy /copy:SO or icacls /save and /restore come to mind.

Also, depends on what you are trying to accomplish. If you have different folders with different contents, you would do the above, then replace the subdirectory ACLs with icacls /T or within Explorer (Properties > Security > Advanced > Change Permissions > Replace all child...). If the files are the same, robocopy /copy:SO /e src dst should work.

JasminLandry

Thanks for your reply. I'll try my best explaining what I'm trying to accomplish. This is the tree: Server_Name->Shared_Folder->Other_Folder->Clients_Folders->Inbox folder and outbox folder (For every client folders (around 1 000 of them), we have an inbox and an outbox folder in them. The problem is that we are going to change the permissions for this and it will not eb possible to inherit the permissions from the parent folder. So what I'm trying to do is: change the permissions on the Client_Folders and then copy those permissions to all of the 999 other folders that we have for them. And then eventually create a script that automates the process of copying the permissions to newly added Client_Folders.

ptilsen

Depending on how complex the ACL looks like, duplicating each entry and running at the top level "ICACLS [target_directory] /[grant_or_deny] [username_or_SID]:[perms] /TCL" should accomplish what you seek. If it is a lot of permissions, this could take a while, of course. You would want to run ICACLS [target_directory] /reset /TCL first if you need to blow away their existing permissions and just use the ones being passed down.

Alternatively, using that last ICACLS command to blow away existing ACLs, then copying from a given source directory with robocopy with the command I gave before would work. Either a /E on the target folder to hit all children or a for-each script block to hit every target folder individually would work.

phoeneous

Robocopy has always worked for me. Specifically the /COPYALL switch.

/COPY:copyflagI]s[/I : What to COPY (default is /COPYDAT) (copyflags : D=Data, A=Attributes, T=Timestamps S=Security=NTFS ACLs, O=Owner info, U=aUditing info).

/SEC : Copy files with SECurity (equivalent to /COPYDATS).

/DCOPY:T : Copy Directory Timestamps. ##

/COPYALL : Copy ALL file info (equivalent to /COPYDATSOU).