---
name: feedback_rmm_setacl_timeout_password_loss
description: RMM Set-Acl/icacls ACL propagation on large folder trees exceeds the command timeout; stdout is dropped on timeout so any value printed in that script (e.g. a generated password) is lost.
metadata:
  type: feedback
---

When dispatching `/rmm` commands that change NTFS ACLs (`Set-Acl`, `icacls /grant`) on a
**large folder tree**, ACL inheritance propagation to existing children can take minutes and
**exceed `timeout_seconds`** — the agent reaper marks the command `failed` with
`"Execution error: Command timeout"`, and **stdout is discarded**. Proven 2026-06-25 setting up
Nick's SMB share on REDNOURCARRIEVI (Carrie's `Documents` tree): the same script generated a
random password and printed it, then ran `Set-Acl` and timed out — the password was gone twice.

**Why:** PowerShell `Set-Acl` (and `icacls` even without `/T`) re-stamps inheritable ACEs onto
all existing children; on a big tree that blows past 90–120s. `Set-LocalUser`/`New-LocalUser`
themselves are instant — the cost is the ACL walk.

**How to apply:**
- **Never depend on a value you can only read back from stdout in a command that might time out.**
  Generate passwords/secrets **locally** in the Bash tool (retain them), inject via a placeholder
  in a `<<'PS'` heredoc (`SCRIPT="${SCRIPT/__PW__/$PW}"`) so PowerShell `$env:` survives — then
  even a timeout doesn't lose the value.
- **Isolate the slow ACL step** into its own command with a long `timeout_seconds` (>=600) and
  poll across multiple Bash calls (each Bash call is capped ~2 min).
- For share access, share-level perms (`Grant-SmbShareAccess`) and the account creation are fast;
  only the NTFS grant is slow.

See errorlog (`rmm/acl`, --friction) and [[reference_gururmm]].
