Inspect and set NTFS permissions with icacls
On a canned Windows 11 NTFS folder, use icacls to read real ACE shapes, grant the sample HelpDesk principal Read and execute, and remove that principal to restore the practice state. Interpret the OI, CI, IO, NP, and I inheritance flags and the F, M, RX, R, and W rights codes. The simulation does not inspect or change the learner's files. Practice, not exam questions. Not a score predictor. Nothing taken from any exam.
Steps
- 1
Run icacls C:\Lab\SecureDocs. Record the Administrators, SYSTEM, and Users ACEs, then interpret their OI, CI, F, and RX codes before changing the DACL.
- 2
Run icacls C:\Lab\SecureDocs /grant HelpDesk:(RX). Read the processed-file line and the Successfully processed 1 files; Failed processing 0 files summary.
- 3
Run icacls C:\Lab\SecureDocs /remove HelpDesk. Read the processed-file line and success summary, then remember that real work also requires a final DACL inspection and effective-access test.
What you should see
The inspection prints three ACE rows and Successfully processed 1 files; Failed processing 0 files. Both the grant and remove commands print processed file: C:\Lab\SecureDocs followed by the same success summary; neither command is silent.