Skip to main content

How to Recursively Set Permissions on a Directory Tree in Batch Script

Applying permissions to a single folder is useful, but in professional environments, you often deal with nested directory structures containing hundreds or thousands of files. Manually setting permissions for each subfolder would be impossible.

In Batch scripting, the ability to "recurse", or cascade changes down through every branch of a folder tree, is a vital skill for managing shared drives, application deployments, and user data migrations.

In this guide, we will focus on the most effective tools for recursive permission management: the built-in icacls command and the takeown utility for overcoming ownership hurdles.

The Power of the Recursion Switch​

The primary tool for managing NTFS permissions in modern Windows is icacls. To make this command work across an entire directory tree, we use the /T switch.

Basic Recursive Syntax​

icacls "C:\MasterFolder" /grant "UserName:(Permission)" /T

The /T parameter tells icacls to start at the specified folder and travel down into every subfolder and file it finds, applying the requested change to each one.

Using Inheritance vs. Recursive Overwriting​

There is a subtle but critical difference between Enabling Inheritance and Recursive Processing.

  1. Inheritance: You set a rule on the Top folder, and new files created later automatically "inherit" that rule.
  2. Recursive Processing (/T): You actively go through every existing file right now and force the new rule onto them.

For the most reliable results, you should use both: set the inheritance flags (OI)(CI) so future files are covered, and use /T to fix existing files.

The Professional Way to Set Recursive Permissions​

@echo off
setlocal

set "targetDir=D:\SharedData\Projects"
set "account=DOMAIN\AppServiceAccount"

if not exist "%targetDir%\" (
    echo [ERROR] Directory not found: %targetDir%
    pause
    exit /b 1
)

echo Recursively applying Full Control to %targetDir%...

REM Grant Full Control (F) with Object Inherit (OI) and Container Inherit (CI)
icacls "%targetDir%" /grant "%account%:(OI)(CI)(F)" /T /C /Q

if %ERRORLEVEL% equ 0 (
    echo [SUCCESS] Permissions applied successfully to %targetDir%.
) else (
    echo [ERROR] One or more errors occurred. Verify admin rights and account name.
)

endlocal
pause

Switch Explanations:​

  • /T: Traverses all subdirectories.
  • /C: Continues even if access is denied to a specific file (very useful for large trees where one locked file shouldn't stop the whole process).
  • /Q: Quiet mode; suppresses success messages for every single file.

Overcoming "Access Denied" with TAKEOWN​

Sometimes, even an Administrator cannot set permissions on a directory tree because an old user account "owns" the files. To fix this recursively, you must first take ownership.

Creating a "Force" Script​

If you need to forcefully take control of a folder tree and then apply permissions, use this two-step approach:

@echo off
setlocal

set "lockedDir=C:\Backups\OldServerData"

if not exist "%lockedDir%\" (
    echo [ERROR] Directory not found: %lockedDir%
    pause
    exit /b 1
)

echo Step 1: Recursively taking ownership...
REM /F = File/Folder
REM /R = Recursive
REM /D Y = Automatically answer "Yes" to prompts

takeown /F "%lockedDir%" /R /D Y >nul 2>nul

if %ERRORLEVEL% neq 0 (
    echo [WARNING] Some files could not have ownership changed. Continuing...
)

echo.
echo Step 2: Resetting permissions to inherited defaults...
REM /reset replaces everything with the parent's rules
icacls "%lockedDir%" /reset /T /C /Q

if %ERRORLEVEL% equ 0 (
    echo [SUCCESS] System has reclaimed the directory tree.
) else (
    echo [WARNING] Permissions reset completed, but some files may have been skipped.
)

endlocal
pause

Handling Errors and Logging​

When running recursive tasks on large volumes, it is best practice to log the results. If a few files fail due to being "in use" or having corrupted ACLs, you need to know which ones they were.

Wrong Case: Blind Execution​

REM If this fails for 5 files out of 5000, you won't know which ones
icacls "C:\LargeRoot" /grant "User:(OI)(CI)(F)" /T /Q

Correct Way: Redirecting Errors to a Log​

@echo off
setlocal

set "TARGET_DIR=C:\Data"
set "TARGET_ACCOUNT=Admin"
set "LOG_FILE=results_log.txt"

if not exist "%TARGET_DIR%\" (
    echo [ERROR] Directory not found: %TARGET_DIR%
    pause
    exit /b 1
)

REM Clear previous log
if exist "%LOG_FILE%" del "%LOG_FILE%"

echo Starting recursive process on %TARGET_DIR%...

REM 2>> redirects the error stream (stderr) to the log file
icacls "%TARGET_DIR%" /grant "%TARGET_ACCOUNT%:(OI)(CI)(F)" /T /C /Q 2>>"%LOG_FILE%"

if %ERRORLEVEL% equ 0 (
    echo [SUCCESS] Process finished.
) else (
    echo [WARNING] Process finished with errors.
)

echo Check %LOG_FILE% for any failures.

endlocal
pause

Comparisons: ICACLS vs. PowerShell​

While PowerShell's Set-Acl is extremely powerful, it is often significantly slower than icacls when processing millions of small files. icacls is a highly optimized C++ binary specifically tuned for directory traversal. For pure speed in recursive permission setting, Batch + icacls remains the preferred choice for many systems engineers.

Summary Checklist​

When recursing through a directory tree:

  1. Always use /T to ensure existing files are updated.
  2. Include (OI)(CI) flags to ensure future files inherit the settings.
  3. Add /C so the script doesn't stop if it hits a single locked file.
  4. Use takeown /R first if you encounter "Access Denied" errors despite being an admin.
  5. Log your errors using 2>> so you have an audit trail of skipped files.

By following these patterns, you can manage complex file systems with confidence, ensuring security policies are applied consistently from the top of the tree to the tip of the furthest branch.

Table of Contents