Reading, granting, and backing up NTFS permissions with icacls and Get-Acl/Set-Acl

Goal

Inspect and change NTFS permissions on a folder tree from a remote session, with a real rollback path if the change is wrong.

Prerequisites

Sufficient rights to read or modify the target ACL (ownership or WRITE_DAC); enough free space to hold a saved ACL file for large trees.

Steps

1. Back up the current ACL tree before touching anything: icacls C:\Apps\Payroll /save payroll-acl-backup.aclfile /T /C. icacls's own syntax lists /save aclfile as a top-level mode alongside /verify and /reset.
2. Read current permissions: icacls C:\Apps\Payroll (or, as PowerShell objects, Get-Acl -Path C:\Apps\Payroll | Format-List).
3. Grant a permission with explicit inheritance: icacls C:\Apps\Payroll /grant "DOMAIN\PayrollApp:(OI)(CI)M" /T. (OI) is documented as "Object inherit. Objects in this container inherits this ACE," (CI) as "Container inherit. Containers in this parent container inherits this ACE" — both apply only to directories, so an ACE meant to reach every file and subfolder underneath needs both flags together.
4. To do the same from PowerShell objects instead of icacls syntax: $acl = Get-Acl C:\Apps\Payroll; $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("DOMAIN\PayrollApp","Modify","ContainerInherit,ObjectInherit","None","Allow"); $acl.AddAccessRule($rule); Set-Acl -Path C:\Apps\Payroll -AclObject $acl.
5. Verify the grant took effect: icacls C:\Apps\Payroll should list the new ACE with the expected rights and inheritance flags.

Expected result

The target account can access the tree with exactly the granted rights, and the backup file from step 1 exists and is non-empty.

Limits and test basis

icacls /save records the ACLs of the directory and its contents at the time it runs, not a live sync — a restore only reverts to that point in time, so re-run /save after any further intentional change. To undo the grant, restore the saved state — against the parent directory, because a /save ... /T file stores names relative to it (Payroll, Payroll\sub, …): icacls C:\Apps /restore payroll-acl-backup.aclfile /C. icacls's syntax documents this as icacls directory [/restore aclfile]. Pointing /restore at C:\Apps\Payroll itself fails with file-not-found errors for every entry. None of these steps needs a reboot; permission changes take effect on the next file access, though already-open handles keep their previously granted access until closed.