icacls, Network Service, and setting ACLs on Windows Server 2008

Solution 1:

This line worked for me:

icacls testdir /grant "NT AUTHORITY\NetworkService":(OI)(M)

and

icacls testdir /grant "NT AUTHORITY\NetworkService":(CI)(M)

Update: And this too:

icacls testdir /grant "NT AUTHORITY\NetworkService":(OI)(CI)(M)

Solution 2:

You need to add OI and CI to effect the change to folder permission settings.

Example setting Modify permission to test folder for Network Service account:

icacls C:\Test /grant "NT AUTHORITY\NetworkService":(OI)(CI)(M)

---

Solution 3:

You can use the sid for network service like so:

icacls testdir /grant *S-1-5-20:(OI)(M)