How can I read and modify the Integrity Labels of specified user folders and files on Windows 7 and later via the command line. For my use case, I need the command to be able to read the Integrity Labels without requiring admin privileges.

By Integrity Label, I mean:

  1. an Integrity Level: typically LOW, MEDIUM or HIGH

  2. a policy: NO-WRITE-UP, NO-READ-UP, NO-EXECUTE-UP, or arbitrary combinations thereof,

  3. inheritance flags: e.g. OI (Object Inherit), CI (Container Inherit), IO (Inherit Only) and so on.

I cannot find a native Windows command to do this. I have tried a few 3rd-party apps, but have run into the problems specified below.

Here is what I've tried so far:

CACLS.EXE - no support.

ICACLS.EXE - fully supports (1) and (3), but not (2) - it only does NO-WRITE-UP.

CHML.EXE by Mark Minasi http://www.minasi.com/apps - fully supports (1) and (2) and (3), , but not (3) - you can only get (OI)(CI), or nothing, but it doesn't support Unicode file or folder names.

SETACL.EXE by Helge Klein https://helgeklein.com/setacl - fully supports (1), (2) and (3), but incorrectly requires admin privileges just to read a mandatory label (which kills my use case).

  • This question was a straight request for a product recommendation (sorry, that's off-topic for this site). I edited it so that it focuses more on the problem. I think it is now a valid question, though maybe it belongs on a different SE site? May 7 '16 at 17:56
  • Please do not deface your question.
    – schroeder
    May 9 '16 at 4:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.