Knowledge Base:   KB Home | File Access Control on XP Home | Basic Network Testing | Date Formatting | Web Design Tips

XP Home and File Level Security Controls

This page is used to change security settings (ACL-access control lists) on files or entire directories. Example: Tired of your kid's addiction to that instant messaging software? You can stop the IM tool from running in just a few simple steps, no software purchase or install, even if you have XP Home.

XP Home users may have noticed that when you right-click a file or folder you don't see the "Security" tab like you see at work or on most XP Professional systems. That's because XP Home uses "simple sharing" and doesn't include the network-based security tool as XP Professional with a network attached. Instead, XP Home has a "cacls.exe" tool that is installed and registered into XP Home Edition and XP Professional with out networking installed. It's not too difficult to use and can save you a lot of headaches from poorly written "freeware" or expensive "security" tools.

The CACLS tool is a commandline tool that you can call from any folder on your PC. Since it's a commandline based tool, you need to open a comand prompt. Just click the "Start" button and select the "Run" command, then type CMD in the little window and click the "OK" button. That will open the black window. For this task you only need to know one command: CD is change directory, which allows you to move across folders. You can shortcut the rest by using Windows Explorer with the "Address Bar" turned on (click the "View" >> "Toolbars" >> "Address Bar") option to turn on the address bar. Next turn on "Display the full path in the address bar" option (located under "Tools" >> "Folder Options" >> "View" tab). This will display the 'path' to any folder on your PC.

Using your new Window Explorer "Address Bar" you can locate the 'path' to any file on you PC you wish to change permissions on. Just navigate to that file or program, like "C:\Program Files\Messenger" for MSN Messenger and look for the executable (EXE) file that runs the software tool. In this case, MSN Messenger's executable is "msmsgs.exe" with that nice, colorful icon. If you move your mouse up to the top of that window, you see the address line has that 'path' listed for you, just highlight it and copy it to you clipboard. Now click that comand prompt and type CD\ to jump to the base of C-drive or the drive letter and colon (sample F:) that is at the beginning of your 'path.'

Now type CD and a space then right-click in the black box and select "paste" from the menu and your 'path' will magically appear. Use you arrow keys to move backwards across the 'path' and delete the drive letter, colon and first slash. Hit the "Enter" key on you keyboard and you'll be magically transported to the correct directory. Now, lets build you CACLS commandline code in "notepad" to cut & paste next. Say you want disable that MSN Messenger tool from Britney's access. Her user name is "Britney" and MSN Messenger's executable file is "msmsgs.exe" you can use the following: cacls.exe msmsgs.exe /P Britney:N to give Britney's account "none" access on that executable. It will no longer run for poor Britney.

After Britney gets her grades back up, you can simply replace the "N" at the en of that line with a "C" and run it again. This will restore Britney's ability to use MSN Messenger. Example: cacls.exe msmsgs.exe /P Britney:C

.

For a full list of 'cacls.exe' options, just type: cacls.exe at the command prompt or click here for a handy picture.

 

Back to Knowledge Base Articles