Desktop platforms Toolkit

View and manage permissions in Windows 2000 from a console

Jim Boyce Tech Republic

Published: 23 Dec 2005 12:55 GMT

Windows 2000 provides several mechanisms that enable administrators to view and manage permissions. In many situations, however, it's useful to be able to manage permissions from a console. Showacls.exe and Cacls.exe are extremely useful for viewing and managing access control lists (ACLs), which control permissions, from a console or from a batch file or script.

Showacls.exe, included with the Windows 2000 Resource Kit, is a console tool that enumerates access rights for files, folders, and folder trees. The /S switch causes Showacls.exe to include subdirectories; the /U switch lets you specify a user. Replace <path> with the file or folder path for which you want to view permissions:

Showacls.exe /S /U:(domain)\(user) <path>

For archival purposes, you can redirect Showacls.exe's output to a file.

The Cacls.exe tool, included with Windows 2000, lets you modify ACLs. You can use Cacls.exe to modify permissions for a single user or multiple users, change ACLs for a single file or folder, or change them for an entire folder tree. Cacls.exe can add or remove permissions as needed.

For the Cacls.exe syntax and usage, execute the following command at a console prompt:

CACLS /?