1

I do auditing of Windows Systems, I need a simple and robust CLI tool that can take ownership of any file to the full extent.

I've dabbled with takeown and icacls but they seem to be quite limited, especially with system files.

While I do have success most of the time, there are certain files that just won't budge.
And those files most of the time require the machine to be rebooted into a separate environment to actually make the changes needed.

Any tools like chmod that changes ALL permissions on a resource, not just partial entries.

1 Answer 1

1

After thorough research I've come up with this script:

@echo off

rem Copyright (C) 2017-2023 Nurudin Imsirovic
rem ownfile - Take full ownership of a resource
rem Created: 2017-04-21 11:23 AM
rem Updated: 2023-08-16 04:49 PM

rem Developer notes
rem
rem  takeown's /SKIPSL option only applies
rem  if recursion is used.  Meaning that
rem  setting the ownership on a symlink
rem  will affect its target.

set file=%1
set recursive=%2
set skip_symlinks=%3
set quiet=%4

if /I [%file%] equ [] goto usage

set suffix_t=
set suffix_i=

if [%recursive%] equ [1] (
    set suffix_t=/d y /r
    set suffix_i=/T
)

if [%skip_symlinks%] equ [1] (
    set suffix_t=%suffix_t% /SKIPSL
    set suffix_i=%suffix_i% /L
)

if [%quiet%] equ [1] (
    set suffix_t=%suffix_t% ^>nul 2^>^&1
    set suffix_i=%suffix_i% ^>nul 2^>^&1
)

goto process

:process
@takeown /f %file% /a %suffix_t%
@takeown /f %file% %suffix_t%
@icacls %file% /grant Administrators:(F,MA) /c %suffix_i%
@icacls %file% /grant Users:(F,MA) /c %suffix_i%
@icacls %file% /grant SYSTEM:(F,MA) /c %suffix_i%
@icacls %file% /grant "LOCAL SERVICE":(F,MA) /c %suffix_i%
@icacls %file% /grant "NETWORK SERVICE":(F,MA) /c %suffix_i%
@icacls %file% /grant "RESTRICTED":(F,MA) /c %suffix_i%
@icacls %file% /grant "ALL APPLICATION PACKAGES":(F,MA) /c %suffix_i%
@icacls %file% /grant "ALL RESTRICTED APPLICATION PACKAGES":(F,MA) /c %suffix_i%
@icacls %file% /grant TrustedInstaller:(F,MA) /c %suffix_i%
@icacls %file% /setintegritylevel L /c %suffix_i%
@icacls %file% /inheritance:r /c %suffix_i%
@icacls %file% /inheritance:d /c %suffix_i%
@icacls %file% /setowner "%username%" /c %suffix_i%
@icacls %file% /grant "%username%":(F,MA) /c %suffix_i%
goto exit

:usage
echo.ownfile ^<file^> ^<recursive^> ^<skip symlinks^> ^<quiet^>
goto exit

:exit
exit /B 0

If the script is outdated you may find the latest changes here.

I don't know how good of an idea this is but it works for me.

6
  • Please post the script here Aug 11, 2023 at 6:27
  • I've referenced the link in case I make changes.
    – user84454
    Aug 11, 2023 at 15:55
  • You should still post the script here, in case you randomly remove GH account or repository. Answers should be as self-sufficient as possible.
    – Destroy666
    Aug 15, 2023 at 16:28
  • 1
    @Destroy666 Done
    – user84454
    Aug 15, 2023 at 17:21
  • Sounds like this script does not only take ownership but also grants permissions to almost everyone. I'm not sure, but the script may only work on English systems. Aug 17, 2023 at 17:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.