Hi Juke, you're right but on the other hand, wenn I customize ACEs for folders or regkeys, I can set both, (different) grant and deny permissions. And exactly this I don't manage with subinacl.exe. But why? Regards, Andreas

Hi, I've been trying to set ACE for my user group on some of the Windows service. For that purpose I use the tool subinacl.exe. Example: I want to configure my service with the 'MyServiceId' and define access rights for the group 'MyGroup': the group should be allowed to read the service configuration but not allowed to change it. Therefor my call: subinacl.exe /service MyServiceId /grant=MyGroup=R /deny=MyGroup=W The problem is that the two actions, grant and deny, are processed sequentially by subinacl and the last action (deny) overwrites the first one (grant)! Why? Is it possible to write both, grant and deny entries to an ACL of a service? Thanks in advance, Andreas

Hi, For this command line, /deny Sid:perm explicitly denies the specified user access rights. An explicit deny ACE is added for the stated permissions and the same permissions in any explicit grant are removed.Juke Chou TechNet Community Support

Hi, That is normal. The deny permission will always override grant permission.Juke Chou TechNet Community Support