# Win\_acl Is Not Removing ACL's

**URL:** <https://forum.ansible.com/t/win-acl-is-not-removing-acls/6986>\
**Category:** Get Help\
**Tags:** windows\
**Created:** [July 2, 2024, 7:11pm UTC](https://forum.ansible.com/t/win-acl-is-not-removing-acls/6986 "2024-07-02T19:11:56Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![tompurl1](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/tompurl1/32/4058_2.png) [@tompurl1](https://forum.ansible.com/u/tompurl1)\
**Post date:** [July 2, 2024, 7:11pm UTC](https://forum.ansible.com/t/win-acl-is-not-removing-acls/6986/1 "2024-07-02T19:11:56Z")

</div>

I have applied acl’s for user `MYDOMAIN\GARY` on directory `D:\BIN`. On occasion, I would like to remove all ACL’s for GARY on that directory and the re-add them with inheritance.

Here’s the ACL’s before:

| Type | Principal | Access | Inherited From | Applies To |
| --- | --- | --- | --- | --- |
| Allow | Gary@mydomain.local | Read | None | This folder, subfolders and files |

I then have a task that looks like this:

```yaml
- name: Remove ACL's
  ansible.windows.win_acl:
    user: MYDOMAIN\GARY
    path: D:\BIN
    rights: Read
    type: allow
    state: absent

```

When I run this tasks I get the following output:

```auto
TASK [Remove ACL's] **********************************************************************************
ok: [myserver.local]

```

This appears to tell me that nothing changed, and when I check the ACL’s I see that nothing has changed: Gary still has read access.

Is this how the module is supposed to work? Is there a better way to remove a user’s access to a directory?

---

<div class="post-metadata">

**Author:** ![mikemorency](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mikemorency/32/2672_2.png) [@mikemorency](https://forum.ansible.com/u/mikemorency)\
**Post date:** [July 17, 2024, 8:15pm UTC](https://forum.ansible.com/t/win-acl-is-not-removing-acls/6986/2 "2024-07-17T20:15:44Z")

</div>

Im not familiar with the module, but it looks like the criteria for removing ACLs is overly strict.

It looks like if the existing ACL is any different than what the user specifies, then it wont be removed. [ansible.windows/plugins/modules/win\_acl.ps1 at main · ansible-collections/ansible.windows · GitHub](https://github.com/ansible-collections/ansible.windows/blob/main/plugins/modules/win_acl.ps1#L261)  
Like if any of [these](https://github.com/ansible-collections/ansible.windows/blob/main/plugins/modules/win_acl.ps1#L227-L233) other settings are different for some reason, the ACL wont be removed even though it exists and matches the user/path etc that you specified

I cant tell what setting is causing the issue though. they all look like they would be equal. Maybe the username? You could try using `Gary@mydomain.local` instead of `MYDOMAIN\GARY`