Windows 2000 provides several mechanisms that enable
administrators to view and manage permissions. In many situations, however,
it’s useful to be able to manage permissions from a console. Showacls.exe and
Cacls.exe are extremely useful for viewing and managing access control lists
(ACLs), which control permissions, from a console or from a batch file or
script.

Showacls.exe, included with the Windows 2000 Resource Kit,
is a console tool that enumerates access rights for files, folders, and folder
trees. The /S switch causes Showacls.exe to include subdirectories; the /U
switch lets you specify a user. Replace <path> with the file or folder
path for which you want to view permissions:

Showacls.exe /S /U:(domain)\(user) <path>

For archival purposes, you can redirect Showacls.exe’s
output to a file.

The Cacls.exe tool, included with Windows 2000, lets you
modify ACLs. You can use Cacls.exe to modify permissions for a single user or
multiple users, change ACLs for a single file or folder, or change them for an
entire folder tree. Cacls.exe can add or remove permissions as needed.

For the Cacls.exe syntax and usage, execute the following
command at a console prompt:

CACLS /?

Miss a tip?

Check out the Windows 2000 Server Archive,
and catch up on the most recent tips from this newsletter.

Want more Win2K tips
and tricks? Automatically
sign up for our free Windows 2000 Server newsletter, delivered each
Tuesday!