> For the complete documentation index, see [llms.txt](https://www.shellspells.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.shellspells.net/windows/system-ops/security/permissions/page.md). # Page ## File Permissions

Command	Description
`icacls "file.txt" /grant "username:R"`	Grants read (R) permissions to the specified user.
`icacls "file.txt" /grant "username:F"`	Grants full control (F) permissions to the specified user.
`icacls "file.txt" /remove "username"`	Removes all explicitly set permissions for the user.
`icacls "file.txt" /deny "username:W"`	Denies write (W) permission to the specified user.
`icacls "file.txt" /reset`	Resets the permissions for "file.txt" to inherit from its parent directory.
`icacls "C:\folder" /grant "username:M" /T`	Grants modify (M) permissions to "username" on the folder and all its subfolders and files.
`icacls "file.txt" /save "C:\path\to\acls.txt"`	Saves the Access Control List (ACL) of "file.txt" to "acls.txt".
`icacls "C:\folder" /restore "C:\path\to\acls.txt"`	Restores the ACLs to the files in "folder" from "acls.txt".
`icacls <FilePathOrDirectory> /inheritance:r`	Removes inherited permissions from a file or directory.
`icacls <FilePathOrDirectory> /setowner <UserOrGroup>`	Changes the owner of a file or directory.
`takeown /f C:\<filename>.exe`	If you have SeTakeOwnership, you can own a process or file.

Grant permissions: {% code overflow="wrap" %} ```powershell Set-Acl -AclObject (Get-Acl ).Access | Add-AclEntry :(R,W,X) ``` {% endcode %} Revoke permissions: {% code overflow="wrap" %} ```powershell Set-Acl -AclObject (Get-Acl ).Access | Remove-AclEntry ``` {% endcode %} Change owner: ```powershell Set-Acl -Owner ``` ### Graphical User Interface (GUI) File/Folder Properties: Right-click the file or folder, select "Properties." Go to the "Security" tab. Click "Edit" to modify permissions. Add, remove, or change permissions for users or groups. Permissions Syntax: Use abbreviations for permissions: | Permission | Description | | ---------- | -------------- | | F | Full control | | M | Modify | | RX | Read & execute | | R | Read | | W | Write | ## User Permissions

Command	Description
`net user <Username> <Password> /add`	Creates a new user account with a password.
`net user <Username> /delete`	Deletes a user account.
`net user <username> /active:no`	Disables account.
`net user <username> /active:yes`	Enables account.
`net localgroup <group_name> <username> /add`	Adds user to group.
`net localgroup <group_name> <username> /delete`	Removes user from group.

## Group Permissions

Command	Description
`net localgroup <GroupName> <Username> /add`	Adds a user to a local group.
`net localgroup <GroupName> <Username> /delete`	Removes a user from a local group.
`net localgroup <GroupName> /add`	Creates a new local group.
`net localgroup <GroupName> /delete`	Deletes a local group.
`Add-LocalGroupMember -Group "<group_name>" -Member "<username>"`	Add member to group
`Remove-LocalGroupMember -Group "<group_name>" -Member "<username>"`	Remove member from group
`Add-ADGroupMember`	AD add member
`Remove-ADGroupMember`	AD remove member

### Graphical User Interface (GUI): Local Users and Groups (Windows 10 Pro and above): Open Computer Management (right-click "This PC" > "Manage"). Go to "Local Users and Groups" > "Groups." Right-click the group you want to modify and select "Properties." Go to the "Members" tab. Add or remove users as needed. ## Share Permissions

Command	Description
`net share <share_name> /grant:,<READ	CHANGE
`net share <ShareName> /delete`	Deletes a shared folder.
`icacls <FolderPath> /grant <UserOrGroup>:<Permission>`	Modifies NTFS permissions for the shared folder.
`New-SmbShare -Name <ShareName> -Path <FolderPath> -FullAccess <UserOrGroup>`	Creates a new SMB share with Full Access permissions (PowerShell).
`Remove-SmbShare -Name <ShareName>`	Removes an SMB share (PowerShell).
`Grant-SmbShareAccess`	Grants permissions to users or groups on a share.
`Revoke-SmbShareAccess`	Revokes permissions from users or groups.
`Remove-SmbShare`	Deletes a share.

## Registry Locations HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList Controls the visibility of user accounts on the Welcome screen. Can be used to hide specific user accounts. HKEY\_LOCAL\_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares Contains information about shared folders, including share permissions. HKEY\_CLASSES\_ROOT Contains file associations and COM object registrations, which include permissions for these objects. HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Stores system-level policies, including user rights assignments and security options. HKEY\_LOCAL\_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg Controls permissions for remote access to the registry. HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList Contains information about user profiles, including profile paths and permissions. HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions Defines known folders in Windows, including paths and permissions.