none
How to use SUBINACL.EXE tool with both, /grant and /deny options?

    Question

  • Hi,

    I've been trying to set ACE for my user group on some of the Windows service. For that purpose I use the tool subinacl.exe.

    Example:
    I want to configure my service with the 'MyServiceId' and define access rights for the group 'MyGroup': the group should be allowed to read the service configuration but not allowed to change it. Therefor my call:
    subinacl.exe /service MyServiceId /grant=MyGroup=R /deny=MyGroup=W

    The problem is that the two actions, grant and deny, are processed sequentially by subinacl and the last action (deny) overwrites the first one (grant)! Why? Is it possible to write both, grant and deny entries to an ACL of a service?

    Thanks in advance,
    Andreas

    Monday, April 02, 2012 8:22 AM

All replies

  • Hi,

    How about changing the command as follow?

    subinacl.exe /service MyServiceId /grant=MyGroup=LQSE /deny=MyGroup=CTOP

    If the issue persists, please don’t use deny command for a test.


    Niki Han

    TechNet Community Support

    Wednesday, April 04, 2012 6:09 AM
    Moderator
  • Hi Niki,

    unfortunately it doesn't work what you suggested. The latter command (/deny) replaces what the former (/grant) did.

    Regards,
    Andreas

    Thursday, April 05, 2012 8:01 AM
  • Hi,

    Please don't use /deny command for a test.


    Niki Han

    TechNet Community Support

    Friday, April 06, 2012 9:07 AM
    Moderator