How to edit the security attributes of more than one file at a time

Raymond Chen

In Windows XP, you could select multiple files, right-click them, then select Properties. The resulting property sheet includes a Security page which lets you edit the security attributes of those files. But when you repeat this exercise on Windows Vista or Windows 7, the Security page is missing. Why doesn’t Explorer let you edit the security attributes of more than one file at a time? Windows might need to display an elevation prompt if any of the files in the collection require administrator privileges in order to modify the security attributes. The security prompt needs to tell you why you are elevating, but if you selected twenty files, there isn’t room to display all twenty of them in the elevation dialog. Truncating the results means that users may be tricked into changing the security of files they didn’t intend. “Grant everyone full access to X, Y, Z, and 17 other files?” How do you know your multiselect didn’t accidentally include MergerPlans.doc? (Maybe there’s some malware that waits for people to change security on multiple items and quietly sneaks NTOSKRNL.EXE into the file list.) Alexander Grigoriev says, “Holding forever to dangerous features is BAD BAD BAD.” If you need to modify the security attributes on a whole bunch of files, you can use the CACLS program, one of the command line tools that messes with security descriptors. If you want to modify the attributes of all the files in a directory tree, you can edit the security attributes of the root of the tree and indicate that you want to propagate inheritable attributes.

Pre-emptive hate: “I hate Microsoft for removing this feature.” (Okay, that was too tame. A PROPER HATE REQUIRES SENTENCES IN ALL-CAPS.) And you wonder why I don’t do Tips/Support topics often. Whenever I provide a tip that lets you work around something, everybody rants about the problem the workaround exists to address.

Raymond Chen

Follow