How to re-permission the NUL device

Question

How to re-permission the NUL device

Peter Bishop 231

I have an application running on Windows Server 2022 which needs to access the NUL device; however I am getting a permissions issue. I've seen a fix relating to using "icacls" to grant permissions to the NUL device but I cannot work out the syntax to achieve this.

Can anyone advise? Thanks.

Answer accepted by question author

1 additional answer

Your answer

Answer 1

MotoX80 37,156

Interesting.

Open a command prompt and copy/paste/run these statements. What do you get?

sc query null
sc qc null
sc sdshow null
echo xxxx > nul
echo xxxx > c:\nul

Here's what I get on Win11.

C:\>sc query null
SERVICE_NAME: null
        TYPE               : 1  KERNEL_DRIVER
        STATE              : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
C:\>sc qc null
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: null
        TYPE               : 1  KERNEL_DRIVER
        START_TYPE         : 1   SYSTEM_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   :
        LOAD_ORDER_GROUP   : Base
        TAG                : 1
        DISPLAY_NAME       : Null
        DEPENDENCIES       :
        SERVICE_START_NAME :
C:\>sc sdshow null
D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)
C:\>echo xxxx > nul
C:\>echo xxxx > c:\nul
C:\>

If you have another WS2022 machine, run those 5 commands on it and test to see if it has a problem with nul.

Reference:

https://stackoverflow.com/questions/313111/is-there-a-dev-null-on-windows

https://ss64.com/nt/nul.html

Peter Bishop 231 Reputation points

2025-11-21T11:44:54.3166667+00:00
Hi.

OK, well that made me look stupid! I was only using 1 L in NULL (as per "echo text > nul"). When I used your commands I was able to get the same results as you did.

However, attempting to re-permission with the right device name in an Administrator command window I get:

C:\>icacls null /grant *S-1-15-2-1:(OI)(CI)RX /T config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5\*: Access is denied. Successfully processed 0 files; Failed processing 1 files

Any thoughts on how I can re-permission this device or why the Python script I'm running might be getting a "permission denied" when accessing the NULL device:

PermissionError: [Errno 13] Permission denied: 'nul'

Thanks again.
MotoX80 37,156 Reputation points

2025-11-21T13:29:00.3566667+00:00
By definition, nul doesn't exist. Or maybe consider it a black hole. Or the proverbial "bit bucket". I don't see how icacls could work. The only permissions that I could find was the "sc sdshow".

What is the statement that is causing the error? Does your script validate each variable to ensure that they contain a value?

In Powershell I would test it like this.

if ($prop.value -eq $null) {

Or suppress output like this.

Get-ChildItem | Out-Null

Python has a None keyword.

https://www.w3schools.com/python/ref_keyword_none.asp

Are you trying to run a program and suppress the output?

https://stackoverflow.com/questions/89228/how-do-i-execute-a-program-or-call-a-system-command

I suspect that you are being misled by the error message.

Disclaimer: I'm a Powershell guy.
Peter Bishop 231 Reputation points

2025-11-21T14:23:04.7933333+00:00
Hi again. This is a one-line Python script being executed from within SQL Server - so numerous moving parts. This works on all of our existing servers but not on a new one running a different version of SQL - when Python is supported differently. The script is simply:

import sys;print(sys.version)

I'm sure that the error message is a red herring but it's the only error I've got :-( I've also posted this on the SQL Server forum where I was asking a related problem so I'll see if they come back with anything.
MotoX80 37,156 Reputation points

2025-11-21T14:35:59.93+00:00
Sounds like more of a SQL problem with the way that it captures stdout/stderr.

What do you get if you have SQL run these commands? (One at a time.)

powershell.exe -command "write-host 'Hello world'" cmd.exe /c "echo %date% %time%" whoami.exe
Peter Bishop 231 Reputation points

2025-11-21T14:46:30.15+00:00
Output is below but the way that SQL Server runs Python is through the "EXEC sp_execute_external_script" command under the SQL LaunchPad service account, whereas the commands you've provided are run by "EXEC xp_cmdshell" under the SQL Server service account:

Hello world Sat 22/11/2025 1:42:01.31 <SQL Server service account>
MotoX80 37,156 Reputation points

2025-11-21T14:52:11.23+00:00

Can you save the Powershell command as a .ps1 file and use sp_execute_external_script to run it?
MotoX80 37,156 Reputation points

2025-11-21T15:00:25.5366667+00:00

I'm not going to be much help with SQL.

https://gist.github.com/james-otten/63389189ee73376268c5eb676946ada5

Those examples all reference OutputDataSet. Do you need to use that?
Peter Bishop 231 Reputation points

2025-11-21T15:15:29.2233333+00:00

"sp_execute_external_script" is only for Python, R Language and Java.

No worries. Thanks for your help.
MotoX80 37,156 Reputation points

2025-11-21T15:22:31.3066667+00:00

The tag assigned to your question is Windows for business | Windows Server | Devices and deployment | Other.

There should be SQL related tags. I'd recommend adding or changing to one of those. The SQL experts might not be seeing your question.

Answer 2

To set permissions for the NUL device on Windows Server, you can use the icacls command. However, it's important to note that the NUL device is a special file that represents a null device in Windows, and modifying its permissions is not a common practice and can lead to unexpected behavior.

If you still want to proceed, the syntax for granting permissions using icacls would typically look like this:

icacls NUL /grant <user-upn>:(f)

Replace <user-upn> with the user account that needs access. The (f) indicates full control. However, since the NUL device is a system resource, you may encounter limitations or restrictions when attempting to change its permissions.

If you're facing a permissions issue, consider checking if the application needs to run with elevated privileges or if there are other security settings that might be affecting access to the NUL device.

References:

NFS Server and File Permissions

Share via

How to re-permission the NUL device

1 additional answer

Your answer