{"id":2859,"date":"2016-02-29T16:19:35","date_gmt":"2016-02-29T12:19:35","guid":{"rendered":"https:\/\/rakhesh.com\/?p=2859"},"modified":"2016-02-29T16:19:35","modified_gmt":"2016-02-29T12:19:35","slug":"use-setacl-if-you-want-to-overcome-the-260-character-limit-when-setting-acls-2","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/windows\/use-setacl-if-you-want-to-overcome-the-260-character-limit-when-setting-acls-2\/","title":{"rendered":"Use SetACL if you want to overcome the 260 character limit when setting ACLs"},"content":{"rendered":"

I had to set folder & file permissions (basically, take ownership and enable inheritance) for a bunch of Windows folders the other day. Thing is the folders had levels and levels of sub-folders so Windows Explorer kept failing when applying permissions. I tried to use takeown<\/code> and icacls<\/code> via the command prompt but these too kept failing.<\/p>\n

One workaround I had in mind was use subst<\/code> or make junctions but these didn’t work either. When I mapped part of the folder name to a drive letter using subst<\/code> the command line tools kept complaining that it wasn’t a file system that supported ACLs. Junctions didn’t do that well either. Mainly coz once you map part of a folder to a path\/ drive letter, there’s no way to select the multiple<\/em> sub-folders in there and assign permissions – when you select multiple folders, the security tab is missing.<\/p>\n

Anyhoo, long story short, I came across this Server Fault thread<\/a> from where I learnt the following –<\/p>\n

\n

In the Windows API, there is an infamous constant known as MAX_PATH<\/code>. MAX_PATH is 260 characters. The NTFS file system actually supports file paths of up to 32,767 characters. And you can still use 32,767 character long path names by accessing the Unicode (or “wide”) versions of the Windows API functions, and also by prefixing the path with \\\\?\\<\/code>.<\/p>\n

MAX_PATH<\/code> was set in stone a very long<\/em> time ago in the Windows world. I think it has something to do with ANSI standards at the time… but it’s one of those things that’s very difficult for Microsoft to change now, as now we have thousands of programs and applications, including some written by Microsoft themselves, that use MAX_PATH<\/code> and would fail in strange new ways if the constant were suddenly changed. (Buffer overflows, heap corruption, etc.)<\/p>\n<\/blockquote>\n

See this MSDN page<\/a> too.<\/p>\n

So what I needed was a tool that made use of the Unicode versions of the Windows API functions. A quick Google search bought me to SetACL<\/a> – an amazing command-line tool that is able to set ACLs without the path limitations and that also has a nice syntax (I don’t know why, but icacls<\/code> and even PowerShell has such obscure syntax for setting file ACLs). Check out this example page<\/a> to get started. In my case all I really needed to do was run a command like this to (1) enable permissions inheritance and (2) set the ownership, and the command would do it recursively for all the files and folders in that path. Amazing!<\/p>\n

setacl -on \"c:\\path\\to\\folder\" -ot file -actn setprot -op \"dacl:np;sacl:np\" -rec cont_obj -actn setowner -ownr \"n:mydomain\\administrators\"<\/pre>\n
The only gotcha I encountered was that I got the following error message after a while with the above command:<\/p>\n
SetACL error message: The call to SetNamedSecurityInfo () failed Operating system error message: Access is denied.<\/p><\/blockquote>\n
Thankfully a forum post<\/a> from the SetACL forums sorted that out for me. Trick is to do the take ownership first, and then the permission inheritance – apparently doing both together causes the above error.<\/p>\n
So I did this first:<\/p>\n
setacl -on \"c:\\path\\to\\folder\" -ot file -actn setowner -ownr \"n:mydomain\\administrators\" -rec cont_obj<\/pre>\n
Followed by this:<\/p>\n
setacl -on \"c:\\path\\to\\folder\" -ot file -actn setprot -op \"dacl:np;sacl:np\" -rec cont_obj<\/pre>\n
SetACL is free but but command-line oriented. If you want a GUI version there’s SetACL Studio<\/a>. That’s a paid product with a 30-day trial. I haven’t tried it yet. There is a SetACL t-shirt<\/a> I might buy coz I was quite pleased with this tool yesterday. :)<\/p>\n","protected":false},"excerpt":{"rendered":"
I had to set folder & file permissions (basically, take ownership and enable inheritance) for a bunch of Windows folders the other day. Thing is the folders had levels and levels of sub-folders so Windows Explorer kept failing when applying permissions. I tried to use takeown and icacls via the command prompt but these too … Continue reading Use SetACL if you want to overcome the 260 character limit when setting ACLs<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[85],"tags":[117,414,598],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/2859"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=2859"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/2859\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=2859"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=2859"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=2859"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}