Edit Granular ACL Permissions in Windows XP

Windows XP relied on the Advanced Security Settings dialog—an interface powered by the Access Control Editor—to manage granular Access Control Lists (ACLs) on NTFS file systems. This interface allowed administrators to assign explicit, special permissions to files and folders that went beyond standard read, write, and execute rights. Accessing this granular interface required disabling the default Simple File Sharing feature in Windows XP Professional.

The Access Control Editor Interface

The primary graphical interface for modifying granular ACLs in Windows XP was the Advanced Security Settings dialog, followed by the specific Permission Entry window.

While the standard Security tab offered high-level permission presets (such as Full Control, Modify, Read & Execute, Read, and Write), clicking the Advanced button launched the deeper Access Control Editor. From there, selecting a user or group and clicking Edit opened the Permission Entry dialog, exposing thirteen distinct granular permissions:

  • Traverse Folder / Execute File
  • List Folder / Read Data
  • Read Attributes
  • Read Extended Attributes
  • Create Files / Write Data
  • Create Folders / Append Data
  • Write Attributes
  • Write Extended Attributes
  • Delete Subfolders and Files
  • Delete
  • Read Permissions
  • Change Permissions
  • Take Ownership

This dialog also contained settings for permission inheritance, allowing administrators to apply rules to subfolders, files, or both.

How to Access the Interface

Windows XP Home Edition lacked the graphical interface for ACL management entirely, while Windows XP Professional hidden it behind "Simple File Sharing" by default.

To reveal the granular permissions interface in Windows XP Professional:

  1. Open My Computer, click Tools, and select Folder Options.
  2. Go to the View tab.
  3. Scroll down and uncheck Use simple file sharing (Recommended), then click OK.
  4. Right-click any file or folder on an NTFS partition and select Properties.
  5. Select the newly visible Security tab.
  6. Click the Advanced button to open the Advanced Security Settings window.
  7. Select an account on the Permissions tab and click Edit to modify granular ACLs.

Command-Line Alternative

For environments where the graphical user interface was unavailable or inconvenient, Windows XP included the command-line utility CACLS (cacls.exe), as well as the downloadable resource kit tool XCACLS (xcacls.exe). These tools allowed administrators to view and configure granular Access Control Lists directly from the command prompt or through automated batch scripts.