hello, I want to set certain ACLs to let users create files and folders in a usb drive formatted with NTFS. Is it possible that I exclude some folders when processing cacls? For example: cacls.exe F:\ /t /c /e /grant everyone:F (but to exclude a folder f:\TopSecret ,which I don't want anyone else to touch it ) Of cause I can do: cacls.exe F:\TopSecret /t /c /e /revoke everyone afterwards to restore previous ACLs but the TopSecret folder may contain large amounts of files.

Sorry, but you can only do that as a 2-step process. However, you can combine the commands into a batch file to achieve this. @ECHO OFF CACLS F:\ /T /C /E /G everyone:F CACLS F:\TopSecret /T /C /E /R everyone You can substitute the following as the 3rd line of the above batch code. The difference being is that instead of being Revoked, they are Denied. CACLS F:\TopSecret /T /C /D everyone I suggest that you try both options to see which works best in your situation.