Using cacls to set permission on executables

Question

How exactly is it possible to restrict read and execute permissions of a file, and leave everything else in tact. So you can't open the file, although you can do things like move it and delete it etc.

Answer 1

Those are not supported permissions in cacls. The supported permissions are: Read, Write, Change, Full Control, None.

EDIT: If one can copy it, they can read it, and if they can write/change it, they can delete it.

Answer 2

Grant everything, but deny read/execute permissions:

icacls myfile /grant user:m /deny user:rx

Grant specific permissions:

icacls myfile /grant user:(gw,ge,d,wd,ra,rea)

Similar can be done with xcacls, but not with the old cacls.

Answer 3

This is the tool you want. You say you don't want them to be able to open it, but if they can read it, they can open it. As it came up in your conversation, you can restrict their ability to execute files.

http://support.microsoft.com/kb/318754