CACLS Confusion

Question

During my NSIS setup script for a WinForms app, I use the following CACLS command to give the Users group full rights to a subfolder:

Exec 'CACLS "$INSTDIR\SubFolder" /E /T /C /G "Users":F'

So in effect the CACLS command executed is something like:

CACLS "c:\Program Files\MyApp\SubFolder" /E /T /C /G "Users":F

When I then look at the Folder permissions in Windows Explorer (right click on the folder and choose Properties, go to the Security tab), the correct permissions are there but they are uneditable.

Furthermore, clicking the Advanced button for the 'Advanced Security Settings' shows that SubFolder is inheriting the "Users" group permissions from a 'Parent Object', but what is that Parent Object, because its not the folder above.

Why are the permissions added by CACLS uneditable, and why are they inherited from nonexistent parent object? I thinking I may have set the options on CACLS wrong.

I'm on Windows XP.

Answer 1

NSIS has a plugin to set permissions, you should probably use that (I can't remember if XP Home even has cacls)

The inherited permission for "Users" has to come from somewhere clearly, either the root of the drive or a parent of your parent folder (The advanced security dialog should have a inherited from column in the list)

Answer 2

I think I figured it out: Changing CACLS to use /P 'replace' rather than /G 'grant' seemed to work better:

CACLS "c:\Program Files\MyApp\SubFolder" /E /T /C /P "Users":F

The options that got created were then editable in the Windows Explorer 'security' tab.