Back Up and Restore NTFS Permissions with icacls on Windows 10, 11 and Server

Prerequisites and Scope of an icacls Backup​

Before exporting permissions prior to a folder migration, storage move, or bulk permission change, verify what icacls captures and what rights your account needs:

• Administrator elevation is required: Reading and writing ACLs across multi-user directory trees requires an elevated Command Prompt or Windows Terminal session running as Administrator. Without elevation, folders that restrict standard user read-control access will be skipped with Access is denied, and User Account Control (UAC) will block administrative privileges such as SeBackupPrivilege and SeRestorePrivilege.
• File system support: The target volume must use NTFS (or ReFS where standard Windows ACLs are supported). FAT32 and exFAT volumes do not store discretionary access control lists and will fail if targeted.
• What /save captures and omits: According to Microsoft's built-in icacls command specification, the /save switch exports only Discretionary Access Control Lists (DACLs)—including explicit allow/deny entries and inheritance flags—in Security Descriptor Definition Language (SDDL) format. It does not save file ownership (Owner), System Access Control Lists (SACLs used for security auditing), or mandatory integrity labels.
• Backup file storage location: Always save the exported .txt ACL file outside the directory tree you are backing up (for example, in C:\ACLBackups). Storing the backup file inside the target directory adds the backup file itself to the recursive scan and risks losing the file if the folder is accidentally deleted or locked during migration.
• Disk space and runtime on large trees: The output file is encoded in Unicode (UTF-16 Little Endian) and uses two lines per filesystem object: one line for the relative path and one line for its SDDL string. A directory with 100,000 files typically produces a 25 MB to 40 MB ACL file and takes several minutes to scan.

Open an Elevated Command Prompt​

While icacls.exe runs in both Command Prompt and PowerShell, running it inside Command Prompt (cmd.exe) avoids PowerShell parsing conflicts with asterisks (*), parentheses, and trailing backslashes inside quoted paths.

Windows 11​

1. Press Win + X on your keyboard or right-click the Start button.
2. Select Terminal (Admin) or Command Prompt (Admin).
3. When the User Account Control prompt appears, click Yes.
4. Look at the top tab bar of Windows Terminal. If the active profile says Windows PowerShell, click the downward chevron (v) next to the new-tab + button and select Command Prompt, or type cmd and press Enter to switch the shell to Command Prompt.

Windows 10​

1. Click the Start button, type cmd in the search box, and look at the best match for Command Prompt.
2. Right-click Command Prompt and select Run as administrator (or click Run as administrator in the right-hand pane).
3. Click Yes at the User Account Control prompt.
4. Confirm the window title bar begins with Administrator: Command Prompt.

Export NTFS Permissions with icacls /save​

How you format the target path in icacls /save determines whether the root folder itself is included in the backup and which directory you must specify during /restore. There are two standard approaches: saving the root folder alongside its contents, or saving only the contents inside the folder.

Warning: Never end a double-quoted path with a single trailing backslash—such as "D:\Shares\Finance\"—in Command Prompt. Native Windows command-line parsing treats \" as an escaped quotation mark rather than the end of the path string, causing icacls to misread the remaining switches as part of the folder name and fail with Invalid parameter.

Click to expand...

Method A: Save the Target Folder and All Subfolders and Files (Recommended)​

Use this method when you want to preserve the ACL on the top-level folder itself (Finance) as well as every subfolder and file inside it.

1. Create a dedicated folder to hold your permission backups if one does not already exist:
   mkdir "C:\ACLBackups"
2. Run icacls against the target folder without a trailing backslash or wildcard:
   icacls "D:\Shares\Finance" /save "C:\ACLBackups\Finance_ACL.txt" /t /c
   • /save "C:\ACLBackups\Finance_ACL.txt" writes the relative paths and SDDL strings to the specified file.
   • /t instructs icacls to recurse through all subdirectories and files under the specified path.
   • /c instructs icacls to continue processing the remaining files even if a locked or inaccessible file generates an error. (Add /q at the end if you want to suppress individual "processed file" output lines on large directory trees, which noticeably speeds up execution.)
3. Review the completion summary at the bottom of the Command Prompt output:
   Successfully processed 1420 files; Failed processing 0 files
   If the failed count is greater than 0, scroll up to identify which files returned Access is denied or The system cannot find the file specified before relying on the backup.

Method B: Save Only the Contents Inside a Folder (Wildcard Method)​

Use this method when you plan to restore permissions into a destination folder that has a different folder name than the original folder, or when you are backing up the root of a drive volume.

1. Run icacls with \* appended to the target folder path:
   icacls "D:\Shares\Finance\*" /save "C:\ACLBackups\Finance_Contents_ACL.txt" /t /c
2. Notice the difference in scope: using D:\Shares\Finance\* saves the DACLs for every file and subfolder inside Finance, but does not save the DACL of the Finance folder itself.

Inspect and Verify the Saved ACL File​

Before making changes to your folders or starting a migration, always inspect the generated backup file to confirm it is populated and to see how the relative paths are structured.

1. Display the first several lines of the saved ACL file in Command Prompt, or open it in Notepad:
   notepad "C:\ACLBackups\Finance_ACL.txt"
2. Examine the alternating line structure. Every object occupies two lines: the odd-numbered line is the relative path, and the even-numbered line immediately below it is the SDDL string describing the DACL:
   
   Code:

   Finance
   D:PAI(A;OICI;FA;;;SY)(A;OICI;FA;;;BA)(A;OICI;0x1301bf;;;S-1-5-21-3623811015-3361044348-30300820-1013)
   Finance\Budgets
   D:AI(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;OICIID;0x1301bf;;;S-1-5-21-3623811015-3361044348-30300820-1013)
   Finance\Budgets\FY2026.xlsx
   D:AI(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1301bf;;;S-1-5-21-3623811015-3361044348-30300820-1013)

3. Check the very first line of the file:
   • If you used Method A ("D:\Shares\Finance"), the first line is Finance, and all child items begin with Finance\....
   • If you used Method B ("D:\Shares\Finance\*"), the first line is the name of the first child item inside the folder (such as Budgets), with no Finance\ prefix.
4. Understand the SDDL prefix flags on the second line of each entry:
   • D: marks the start of the Discretionary ACL.
   • P (SDDL_PROTECTED) means permission inheritance from the parent folder is disabled on that object.
   • AI (SDDL_AUTO_INHERITED) means permission inheritance is enabled and child entries are propagated automatically.
   • Each parenthetical block (A;OICI;FA;;;BA) represents an Access Control Entry (ACE), specifying the ACE type (A for Allow, D for Deny), inheritance flags (OI for Object Inherit, CI for Container Inherit, ID for Inherited), permission rights (FA for File All / Full Control), and the trustee security identifier (SY for Local System, BA for Built-in Administrators, or a full S-1-5-21-... domain/local SID).

Warning: If you edit the ACL backup file manually in a text editor, you must save it with UTF-16 LE encoding and preserve the exact two-line-per-entry structure with no blank lines. Re-saving the file as UTF-8 or ANSI will cause icacls /restore to fail immediately with syntax or file-not-found errors.

Click to expand...

Restore NTFS Permissions with icacls /restore​

Warning: Running icacls /restore overwrites the current DACLs of every matching file and folder with the exact DACLs recorded in the backup file, removing any new explicit permissions added since the backup was taken. Ensure you are pointing at the correct parent path before pressing Enter.

Click to expand...

When running /restore, icacls combines the directory path you pass on the command line with each relative path listed inside the backup file. Also note that /restore does not use or accept the /t parameter—it automatically processes every entry present in the ACL file.

Restore a Backup Created with Method A (Folder + Contents)​

Because the first line of Finance_ACL.txt is Finance, you must point icacls /restore at the parent directory (D:\Shares), not D:\Shares\Finance.

1. In your elevated Command Prompt, run:
   icacls "D:\Shares" /restore "C:\ACLBackups\Finance_ACL.txt" /c
   (If the parent directory is the root of a drive—for example, if you backed up "D:\Finance"—pass the drive letter without quotes or with a dot, such as icacls D:\ /restore "C:\ACLBackups\Finance_ACL.txt" /c.)
2. Wait for the command to finish and verify the summary line:
   Successfully processed 1420 files; Failed processing 0 files

Restore a Backup Created with Method B (Contents Only / Wildcard)​

Because Finance_Contents_ACL.txt starts directly with the names of the items inside the folder (Budgets, Budgets\FY2026.xlsx), point icacls /restore directly at the target folder itself:

1. In your elevated Command Prompt, run:
   icacls "D:\Shares\Finance" /restore "C:\ACLBackups\Finance_Contents_ACL.txt" /c
   This also allows you to apply the exact same interior permission structure to a newly created folder with a different name—for example:
   icacls "E:\NewServerShares\Accounting" /restore "C:\ACLBackups\Finance_Contents_ACL.txt" /c

Verify the Restored Permissions​

After icacls /restore reports zero failed files, verify that both explicit and inherited permissions match your expectations using the command line and File Explorer.

1. Run icacls against the restored folder and a sample subfolder without any switches to inspect their live ACLs:
   
   Code:

   icacls "D:\Shares\Finance"
   icacls "D:\Shares\Finance\Budgets"

2. Check the human-readable output:
   
   Code:

   D:\Shares\Finance NT AUTHORITY\SYSTEM:(OI)(CI)(F)
                     BUILTIN\Administrators:(OI)(CI)(F)
                     CONTOSO\Finance_Modify:(OI)(CI)(M)

   Confirm that (I) appears on child folder entries where inheritance should be active, and does not appear on folders where inheritance was intentionally broken (D:PAI in the backup file).
3. To verify via the graphical interface in File Explorer:
   • Windows 11: Right-click the restored folder in File Explorer and select Properties (or press Alt + Enter with the folder selected), switch to the Security tab, and click Advanced.
   • Windows 10: Right-click the restored folder in File Explorer, select Properties, switch to the Security tab, and click Advanced.
4. In the Advanced Security Settings window, confirm that the permission entries, Inherited from column, and the Enable inheritance / Disable inheritance button state match the pre-change configuration.

Alternate Workflow: Substitute SIDs When Restoring Across Systems or Domains​

When you back up permissions on one PC or domain and restore them onto a different standalone PC or a new Active Directory domain, built-in groups like BUILTIN\Administrators (BA) and NT AUTHORITY\SYSTEM (SY) map automatically because they use universal well-known shorthand codes in SDDL. However, local user accounts and domain security groups are recorded as full Security Identifiers (S-1-5-21-...).

If you restore an ACL file onto a system where those SIDs do not exist, Windows applies the raw SIDs anyway, and the Security tab displays them as orphaned Account Unknown (S-1-5-21-...) entries. You can swap an old SID for a new SID on the fly during the restore using the /substitute parameter.

1. Find the old and new SIDs in Command Prompt using whoami /user (for the current account) or PowerShell's Get-LocalUser / Get-ADGroup:
   powershell -NoProfile -Command "Get-LocalGroup -Name 'FinanceUsers' | Select-Object Name,SID"
2. Run icacls with /substitute placed before /restore:
   icacls "D:\Shares" /substitute S-1-5-21-3623811015-3361044348-30300820-1013 S-1-5-21-987654321-123456789-456789123-1005 /restore "C:\ACLBackups\Finance_ACL.txt" /c
   You can chain multiple old-and-new SID pairs after /substitute in a single restore command.

Troubleshooting Common icacls Save and Restore Failures​

Error: The system cannot find the file specified or Successfully processed 0 files; Failed processing 1 files​

• Cause: You pointed icacls /restore at the target folder itself ("D:\Shares\Finance") when the backup file already begins with the folder name (Finance). As a result, icacls looked for a nonexistent "D:\Shares\Finance\Finance" path.
• Fix: Open the ACL backup file in Notepad and read line 1. If line 1 is Finance, run /restore against the parent directory ("D:\Shares").

Error: Invalid parameter When Running /save or /restore​

• Cause 1: You included /t on an icacls /restore command. While some administrators habitually type /t on every icacls command, the official icacls syntax for /restore accepts only /c, /l, and /q. Depending on the argument order, passing /t with /restore can trigger a parameter error.
• Cause 2: You enclosed a path ending in a backslash inside double quotes, such as "D:\Shares\".
• Fix: Remove /t from the /restore command, and remove the trailing backslash from any quoted folder path ("D:\Shares"). If you are targeting a root drive letter such as D:\, either omit the quotes (D:\) or add a period after the slash ("D:\.").

Error: Access is denied During /restore Even in an Elevated Command Prompt​

• Cause: An administrator account can only overwrite a file or folder's DACL if the administrator group has Write DAC (WDAC) permissions on the object, or if the administrator is the current Owner of the object. If a faulty script or user locked out BUILTIN\Administrators and changed ownership to another account (or TrustedInstaller), icacls /restore will be blocked on those items.
• Fix (Rollback and Ownership Recovery):
  

  Warning: Do not run takeown or icacls /reset recursively on operating system directories such as C:\Windows, C:\Program Files, or C:\Users\Default. Taking ownership away from NT SERVICE\TrustedInstaller on system files breaks Windows servicing and application sandboxes. Use this recovery procedure only on user data shares and non-system folders.

  Click to expand...

  1. Take ownership of the affected data folder tree and assign ownership to the local Administrators group (/a):
     takeown /f "D:\Shares\Finance" /r /a /d y
  2. Grant Administrators Full Control so icacls can write to every child ACL:
     icacls "D:\Shares\Finance" /grant Administrators:(OI)(CI)F /t /c
  3. Re-run your icacls /restore command from the parent directory to overwrite the temporary ACL with your saved backup:
     icacls "D:\Shares" /restore "C:\ACLBackups\Finance_ACL.txt" /c

Resetting a Broken Folder Tree When No Valid Backup Exists​

If a permission change goes wrong and you discover that your saved ACL file is incomplete or missing, you can strip all corrupted explicit permissions and force the folder tree to inherit clean default permissions from its parent folder:

1. Check the parent folder first (icacls "D:\Shares") to confirm NT AUTHORITY\SYSTEM and BUILTIN\Administrators have Full Control (OI)(CI)(F).
2. Reset the target folder and all items inside it to inherit from the parent:
   icacls "D:\Shares\Finance" /reset /t /c