How to Copy File and Directory Permissions in Windows Using RoboCopy

My Problem

I have sometimes had to copy the permissions on one directory over to another directory. Sometimes it’s simply due to the migration of files from one server to another. Other times it’s for the purpose of backing up ACL entries before an ACE edit. When frobbing around with permissions, it’s often nice to make a dummy folder or file and copy the pre-frobbed permissions over. That way any post-frobbing disasters can be rectified rather quickly.

At first, I thought copying permissions would be a simple matter of using icacls to perform some kind of permission dump. Sadly, and somewhat surprisingly, I was not able to find an easy way to do that. Certainly you can simply pipe the output of icacls to a text file, however I could not find an easy way to consume that text-based permission record. That’s where the wonder of RoboCopy comes in.

My Solution

Reading Microsoft KB323275 reveals yet another interesting use of RoboCopy.

robocopy [source] [destination] /secfix [include appropriate exclusion filters here]

Yes, once again RoboCopy comes to the rescue for things other than copying files and folders. If you’ve been an admin on Windows boxxen for terribly long, I hope you’re at least moderately familiar with RoboCopy.

In this usage, have a peek at the /secfix switch. The official TechNet help for the switch simply says:

Fixes file security on all files, even skipped ones.

However there is a larger note at the bottom of the help document that states:

When using the /SECFIX copy option, specify the type of security information you want to copy by also using one of these additional copy options:

  • /COPY:O
  • /COPY:S
  • /COPY:U
  • /SEC

If you’re simply performing a permissions copy, make sure that you use the proper file selection options (/XO, /XN, /XF, etc.) to get only the files and/or folders you want. No use in copying an entire directory structure if you only need the permissions on one folder to be copied. Also, if you’re only interested in copying permissions and not the files themselves, keep in mind the /CREATE switch:

/CREATE – Creates a directory tree and zero-length files only.

Perhaps I should start collecting various uses for RoboCopy and compile them into a series of “Stupid RoboCopy Tricks” posts. =)


  1. the_angry_angel

    January 9, 2012 at 8:49 am

    If you’re just wanting to export the file security, subinacl, whilst old can be quite handy.


  2. ademar

    January 9, 2012 at 11:50 am

    I recently had to migrate ~4 TB worth of data from an old EMC Celerra unit to an EqualLogic array via CIFS.

    I found out that RoboCopy was not robust enought, often choking on corrupted file entries and making impossible to complete an already lengthy task.
    I and end up coding an FSharp script to migrate/synchronize files and permissions across volumes.

    The script can be found here:

    It has a couple of nice properties, it uses the async IO api and you can control how many copy operations can go on at the same time.


    • Wesley David

      January 9, 2012 at 11:52 am

      Excellent tip, Ademar!


    • Micke

      April 24, 2012 at 5:23 am

      hi ademar,
      interesting snippet.
      as hint – in robocopy u can use /mt for multithreading operations


  3. Angel

    July 5, 2012 at 10:28 am

    Whew, I finally found the arguments that work for me!

    ROBOCOPY e:User Z:User /MIR /SEC /SECFIX /DCOPY:T /R:1 /W:1 /LOG+:E:Robocopylog.txt /TEE
    /MIR ans /SEC- Mirrors the directories keeping the file and directory permissions
    /DCOPY:T - Keeps the folder timestamps
    /R:1 /W:1 - Makes one retry and waits one second before retrying
    /LOG+:E:Robocopylog.txt /TEE - Makes a log of the operation without overwriting and also displays the status on the cmd window.

    Created a bat of the contents and created a Shedules Task. Now it backups my data daily to my NAS!


    • Wesley David

      July 5, 2012 at 10:39 am

      Wow, thanks for sharing all of that!

      My preferred options are /MIR /R:0 /V /LOG:path /TEE. I should probably reconsider /SEC and /SECFIX though. =)


  4. Karen

    February 2, 2013 at 2:12 am

    Hi. I am using robocopy for my project. I wanted to copy *.xsl files from C:WindowsSystem32wbemen-US to C:WindowsSystem32wbem. However, I always encounter Error 5: Accessing Destination Directory [path] Access Denied. Is there a way to fix this problem?


    • Wesley David

      February 2, 2013 at 1:46 pm

      You’ll need to run RoboCopy as an administrator or within an administrative shell. You can use runas /user:user to do that in a script or if you’re using it interactively just open up cmd.exe as an admin.


  5. albertwt

    July 15, 2014 at 2:15 am

    Does the Robocopy command is still applicable to the Windows Server 2012 R2 version of the Robocopy ?


    • WesleyDavid

      July 17, 2014 at 10:34 am

      Yep, 2012 R2 still has RoboCopy and there are no major changes that I’m aware of.


Leave a Reply

Follow TheNubbyAdmin!

follow us in feedly

Raw RSS Feed:

Contact Me!

Want to hire me as a consultant? Have a job you think I might be interested in? Drop me a line:

Contact Me!

Subscribe via Email

Your email address is handled by Google FeedBurner and never spammed!

The Nubby Archives

Circle Me on Google+!

Photos from Flickr

Me on StackExchange

The IT Crowd Strava Group

%d bloggers like this: