My Problem

I have sometimes had to copy the permissions on one directory over to another directory. Sometimes it’s simply due to the migration of files from one server to another. Other times it’s for the purpose of backing up ACL entries before an ACE edit. When frobbing around with permissions, it’s often nice to make a dummy folder or file and copy the pre-frobbed permissions over. That way any post-frobbing disasters can be rectified rather quickly.

At first, I thought copying permissions would be a simple matter of using icacls to perform some kind of permission dump. Sadly, and somewhat surprisingly, I was not able to find an easy way to do that. Certainly you can simply pipe the output of icacls to a text file, however I could not find an easy way to consume that text-based permission record. That’s where the wonder of RoboCopy comes in.

My Solution

Reading Microsoft KB323275 reveals yet another interesting use of RoboCopy.

robocopy [source] [destination] /secfix [include appropriate exclusion filters here]

Yes, once again RoboCopy comes to the rescue for things other than copying files and folders. If you’ve been an admin on Windows boxxen for terribly long, I hope you’re at least moderately familiar with RoboCopy.

In this usage, have a peek at the /secfix switch. The official TechNet help for the switch simply says:

Fixes file security on all files, even skipped ones.

However there is a larger note at the bottom of the help document that states:

When using the /SECFIX copy option, specify the type of security information you want to copy by also using one of these additional copy options:

  • /COPYALL
  • /COPY:O
  • /COPY:S
  • /COPY:U
  • /SEC

If you’re simply performing a permissions copy, make sure that you use the proper file selection options (/XO, /XN, /XF, etc.) to get only the files and/or folders you want. No use in copying an entire directory structure if you only need the permissions on one folder to be copied. Also, if you’re only interested in copying permissions and not the files themselves, keep in mind the /CREATE switch:

/CREATE - Creates a directory tree and zero-length files only.

Perhaps I should start collecting various uses for RoboCopy and compile them into a series of “Stupid RoboCopy Tricks” posts. =)