Summary

Windows Vista makes a number of interesting changes to ACLs. Many of these changes are in support of other features, such as service hardening and UAC, and result in a somewhat different experience when managing ACLs from previous versions of Windows. There is also a new tool, icacls, for managing ACLs. Anyone who is serious about managing ACLs, however, needs to spend some time with subinacl, which is far more powerful than any prior Microsoft tool for managing ACLs. It is also the only command-line tool for managing registry ACLs. icacls does have a very nice feature to reset permissions to inherited permissions, which does not exist in subinacl. It is well worth becoming familiar with both tools.