How to Design NTFS Permissions with AGDLP Groups
Applies to: Windows Server 2019, 2022 and 2025.
NTFS permissions are easier to audit when ACLs reference Domain Local resource groups and users enter through Global role groups.
Storage changes can cause data loss or access outages. Use tested backups, maintenance windows and representative access tests. Managed Windows VPS services are available at networkmanager.info.
Prerequisites
- Define read, modify and owner roles.
- Create AGDLP groups.
- Document inheritance boundaries.
- Back up existing ACLs.
Procedure
Step 1: Export current ACL
Capture a recovery copy.
icacls 'D:\Shares' /save 'D:\ACL-Backup.txt' /t /cStep 2: Disable inheritance at the intended boundary
Convert or remove inherited entries only after review.
icacls 'D:\Shares\Projects' /inheritance:rStep 3: Grant administration and system
Retain recovery access.
icacls 'D:\Shares\Projects' /grant 'SYSTEM:(OI)(CI)F' 'Administrators:(OI)(CI)F'Step 4: Grant business access
Use Domain Local resource groups.
icacls 'D:\Shares\Projects' /grant 'CORP\DL-Projects-Read:(OI)(CI)RX' 'CORP\DL-Projects-Modify:(OI)(CI)M'Step 5: Test effective access
Use representative read, modify and denied users.
Verification
Review ACL entries and group nesting.
icacls 'D:\Shares\Projects'
Get-ADGroupMember 'DL-Projects-Modify'Rollback and recovery
Restore ACLs with icacls /restore from the known backup after confirming the original root path.
Operational notes
Avoid explicit Deny unless required; it can create difficult-to-diagnose results through nested memberships.
