ATTRIB Command Guide - Display and Change File Attributes in Windows

The attrib command is a Windows Command Prompt utility that displays, sets, or removes file and directory attributes (read-only, archive, system, hidden). Use + to set and - to clear attributes; combine with /S and /D for recursive operations across entire directory trees.

Whether you're troubleshooting hidden malware, protecting critical files from accidental deletion, or managing system file attributes, mastering attrib gives you granular control over file properties that Windows Explorer can't easily access. IT professionals and system administrators rely on this command for bulk attribute changes, security hardening, and malware remediation across enterprise environments.

This comprehensive guide covers attrib syntax, all four attributes (R, A, S, H), practical examples for common scenarios, troubleshooting tips, related commands, and frequently asked questions. By the end, you'll confidently manage file attributes from the command line for system administration, security, and automation tasks.

What Is the Attrib Command?

The attrib command has been part of Windows (and MS-DOS before it) for decades, making it one of the most stable and reliable file management utilities. It lets you work with four core file attributes that control how Windows and applications interact with files:

R – Read-only (prevents modification)
A – Archive (marks files for backup)
S – System (identifies critical system files)
H – Hidden (conceals files from normal view)

You can display current attributes for any file or directory, or change them using plus (+) to set and minus (-) to clear. The command works in Command Prompt (CMD), Windows PowerShell (with CMD compatibility), and is available in all modern Windows versions, including Windows 11, Windows 10, Windows 8, Windows 7, and Windows Server editions.

Unlike Windows Explorer's limited attribute interface, attrib provides command-line power for batch operations, scripting, and remote administration. System administrators use attrib in login scripts, maintenance tasks, and security hardening procedures across thousands of workstations.

Attrib Command Syntax

The basic syntax for the attrib command is:

attrib [+r|-r] [+a|-a] [+s|-s] [+h|-h] [drive:][path][filename] [/S] [/D] [/L]

Parameters and Switches

Parameter	Description
`+r`	Set read-only attribute (prevents file modification)
`-r`	Clear read-only attribute (allows editing)
`+a`	Set archive attribute (marks file as modified)
`-a`	Clear archive attribute (marks file as backed up)
`+s`	Set system attribute (identifies critical system files)
`-s`	Clear system attribute (removes system designation)
`+h`	Set hidden attribute (hides file from normal view)
`-h`	Clear hidden attribute (makes file visible)
`/S`	Process files in current directory and all subdirectories recursively
`/D`	Process directories (folders) in addition to files; use with `/S`
`/L`	Work with symlink targets instead of the symlinks themselves

If you omit the path and filename, attrib displays attributes for all files in the current directory. This is useful for quick audits of file properties before making changes.

The Four Main File Attributes

Read-Only (R)

The read-only attribute prevents accidental modification or deletion of files. Files marked read-only cannot be edited, overwritten, or deleted without first clearing the attribute. This is essential for protecting configuration files, templates, reference documents, and any files that should remain unchanged.

Windows applications respect the read-only flag and typically display warnings when users attempt to modify read-only files. However, administrators can override read-only protection using the /F parameter with commands like DEL.

Example – set a file as read-only:

attrib +r C:\Config\settings.ini

This protects settings.ini from accidental changes. Users attempting to edit the file will receive an "Access denied" or "File is read-only" error.

Example – clear read-only to allow editing:

attrib -r C:\Config\settings.ini

After clearing the read-only attribute, the file can be modified normally.

Enterprise use case: IT departments set read-only on master configuration files, corporate templates, and policy documents to prevent unauthorized modifications while allowing read access for reference.

Archive (A)

The archive attribute marks files that have changed since the last backup. Backup software (like xcopy with /M or /A, Windows Backup, and third-party backup solutions) uses this attribute to perform incremental backups, copying only files with the archive bit set.

When a file is created or modified, Windows automatically sets the archive attribute. Backup software clears the attribute after successfully backing up the file, creating a simple but effective incremental backup mechanism.

Example – clear archive attribute after manual backup:

attrib -a C:\Backup\*.* /S

This marks all files in C:\Backup and subdirectories as backed up, clearing the archive bit. Subsequent incremental backups will skip these files unless they're modified.

Example – display files ready for backup:

attrib C:\Documents\*.* | find "A"

This shows only files with the archive attribute set, identifying files that need backup.

Automation tip: Combine attrib with xcopy in batch scripts for custom incremental backup solutions: xcopy C:\Source D:\Backup /M /E /Y copies files with archive set and clears the attribute after copying.

System (S)

System files are critical to Windows operation. The system attribute identifies files essential for booting, system functionality, or core Windows services. These files are typically protected from casual deletion and hidden from normal Explorer view.

The system attribute is often combined with the hidden attribute for maximum protection. Important: If a file has both System and Hidden attributes set, you must clear both before successfully changing other attributes or modifying the file.

Example – clear system and hidden to modify the hosts file:

attrib -s -h C:\Windows\System32\drivers\etc\hosts

The Windows hosts file is commonly edited for DNS overrides, ad blocking, or development environments. Clearing system and hidden attributes allows editing in Notepad or other text editors.

Example – restore system and hidden after editing:

attrib +s +h C:\Windows\System32\drivers\etc\hosts

After editing, restore the original attributes to maintain system file protection.

Security note: Malware sometimes sets system and hidden attributes on malicious files to hide them from users. Use attrib -s -h /S /D in infected directories to reveal hidden malware files for removal.

Hidden (H)

The hidden attribute conceals files and folders from normal Windows Explorer view (unless "Show hidden files" is enabled in Folder Options). Users often use attrib +h to hide sensitive files, personal documents, or system files from casual browsing.

Hidden files remain accessible if you know the exact path or filename. The hidden attribute provides obscurity, not security—it's not encryption or access control.

Example – hide a folder and all contents:

attrib +h C:\Users\Documents\Private /S /D

The /S parameter applies the hidden attribute recursively to all files in subdirectories, and /D includes the directories themselves.

Example – unhide all files in a directory tree:

attrib -h C:\Data\*.* /S /D

This reveals all hidden files and folders in C:\Data and subdirectories. Useful for recovering files hidden by malware or accidental attribute changes.

Privacy note: Hidden files are visible to administrators, backup software, and anyone who enables "Show hidden files" in Explorer. For true security, use NTFS permissions, BitLocker encryption, or EFS (Encrypting File System).

Practical Attrib Command Examples

Display All File Attributes

To see attributes of all files in the current directory:

attrib

Output shows letters before each path indicating active attributes:

A    C:\Windows\system32\cmd.exe
A    C:\Windows\notepad.exe
A SH C:\Windows\System32\drivers\etc\hosts
     R C:\Config\template.docx

Legend: A = Archive, R = Read-only, S = System, H = Hidden. Blank spaces indicate the attribute is not set.

Hide a Single File

Hide a specific file from Explorer view:

attrib +h secret.txt

The file remains accessible by typing the full path but won't appear in directory listings.

Unhide a Single File

Reveal a hidden file:

attrib -h secret.txt

The file becomes visible in Explorer again.

Hide All Files in a Folder Recursively

Hide an entire directory tree including all files and subdirectories:

attrib +h C:\MyFolder\*.* /S /D

Use case: Hide personal files, work-in-progress projects, or sensitive data folders from shared computers.

Unhide All Files in a Folder

Reveal all hidden files and folders in a directory tree:

attrib -h C:\MyFolder\*.* /S /D

Critical for malware removal—many viruses and ransomware hide files to prevent user access.

Make a File Read-Only

Protect a document from accidental modification:

attrib +r report.docx

Users attempting to edit the file will receive read-only warnings.

Remove Read-Only Before Editing

Clear read-only protection to allow editing:

attrib -r report.docx

Necessary before modifying protected files or templates.

Clear Attributes Before Modifying System Files

For files like the Windows hosts file that have both System and Hidden:

attrib -s -h C:\Windows\System32\drivers\etc\hosts

Edit the file in Notepad, then restore attributes:

attrib +s +h C:\Windows\System32\drivers\etc\hosts

Use Wildcards for Batch Operations

Attrib supports * (any characters) and ? (single character) wildcards:

attrib +r *.docx
attrib -h project_?.txt
attrib +a C:\Documents\*.* /S

Wildcards enable bulk attribute changes across multiple files matching a pattern.

Combine Multiple Attribute Changes

Set multiple attributes in a single command:

attrib +r +h sensitive.txt

This makes the file both read-only and hidden, providing double protection.

Display Attributes for Specific File Types

Show attributes for all Excel files in a directory:

attrib *.xlsx

Useful for auditing file properties before batch operations.

Common Use Cases for the Attrib Command

Hide sensitive files from casual viewing – Use attrib +h to conceal personal documents, financial records, or confidential files on shared computers. Remember this provides obscurity, not security.
Unhide files after malware infection – Ransomware and viruses often hide user files. Use attrib -h -s /S /D in affected directories to reveal hidden files for recovery or removal.
Protect configuration files from accidental changes – Set +r on critical config files (INI, XML, JSON) to prevent accidental overwrites by users or poorly-written scripts.
Backup workflows with archive attribute – Use the archive attribute with xcopy /M or custom backup scripts for efficient incremental backups that only copy modified files.
Fix "access denied" errors on read-only files – Clear read-only attributes before editing, moving, or deleting protected files that produce permission errors.
Edit Windows system files safely – Clear system and hidden attributes (-s -h) on files like hosts, boot.ini, or system DLLs before modification, then restore attributes after editing.
Prepare files for archiving or compression – Clear read-only attributes on files before adding to ZIP archives to avoid compression errors.
Audit file attributes across network shares – Use attrib \\server\share\*.* /S to review file attributes on network drives for compliance or security audits.
Automate attribute management in scripts – Incorporate attrib in batch files, PowerShell scripts, or scheduled tasks for automated file attribute management across enterprise environments.
Recover files from USB drives infected with shortcuts – Some malware hides original files and creates shortcuts. Use attrib -h -s /S /D on the USB drive to reveal hidden files.
Protect master templates in shared folders – Set read-only on template files in shared network folders to ensure users create copies instead of modifying originals.
Debug application file access issues – Display file attributes to diagnose why applications can't read, write, or modify specific files.

Tips and Best Practices

Order matters for system files – When a file has both System and Hidden attributes, clear both in one command: attrib -s -h filename. Attempting to clear only one may fail.
Use full paths for clarity – Specify complete paths when targeting specific locations to avoid ambiguity: attrib +r C:\Path\To\File.txt instead of relying on current directory.
Administrator rights for system files – Modifying attributes on system files, Windows directories, or protected locations requires running Command Prompt as Administrator. Right-click CMD and select "Run as administrator."
Backup before attribute changes – Before modifying attributes on critical system files or important data, create backups. Incorrect attribute changes can cause boot failures or application errors.
Test in a safe folder first – Practice attrib commands in a test directory with sample files before running bulk operations on production data.
Verify with attrib display – After changing attributes, run attrib filename without parameters to verify the changes took effect.
Combine with DIR for hidden file discovery – Use DIR /A:H to list hidden files before using attrib to unhide them, ensuring you know what you're revealing.
Use /S carefully on large directories – The /S parameter processes all subdirectories, which can take significant time on large directory trees. Ensure you target the correct path.
Quote paths with spaces – Always enclose paths containing spaces in double quotes: attrib +h "C:\My Documents\Private File.txt".
Document attribute changes in scripts – When using attrib in batch files or automation, add comments explaining why attributes are changed to aid future troubleshooting.
Check for read-only before file operations – In scripts, check file attributes before attempting to modify or delete files to avoid errors: attrib filename | find "R".
Restore original attributes after editing – When modifying system files, note the original attributes and restore them after editing to maintain system integrity.

Troubleshooting Common Issues

"Access is denied" Error

Problem: Attrib fails with "Access is denied" when trying to change file attributes.

Cause: Insufficient permissions, file in use by another process, or attempting to modify protected system files without administrator privileges.

Solution:

Run Command Prompt as Administrator (right-click CMD, select "Run as administrator")
Close applications that might have the file open
Check if the file is locked by another process using Resource Monitor
For network files, verify you have write permissions on the share

Prevention: Always run CMD as Administrator when working with system files or protected directories.

"The system cannot find the file specified"

Problem: Attrib reports it cannot find the specified file or path.

Cause: Incorrect path, typo in filename, file doesn't exist, or file is hidden and you're not using the correct path.

Solution:

Verify the path and filename with DIR command
Use DIR /A:H to list hidden files
Check for typos in the command
Use Tab completion to auto-complete filenames
Enclose paths with spaces in double quotes

Prevention: Copy and paste paths from Explorer or use Tab completion to avoid typos.

Cannot Clear System or Hidden Attributes

Problem: Using attrib -s or attrib -h doesn't remove the attribute.

Cause: File has both System and Hidden attributes set, and they must be cleared together.

Solution:

attrib -s -h filename

Clear both attributes in a single command. Windows protects files with both attributes from individual attribute removal.

Prevention: Always check current attributes with attrib filename before attempting to change them.

Attrib Changes Don't Persist After Reboot

Problem: File attributes revert to original state after restarting Windows.

Cause: Group Policy, security software, or system restore is resetting attributes. Some system files are protected by Windows Resource Protection (WRP).

Solution:

Check Group Policy settings for file attribute enforcement
Disable system restore temporarily for testing
For WRP-protected files, use takeown and icacls to take ownership before changing attributes
Verify antivirus or security software isn't resetting attributes

Prevention: Document which files are protected by WRP or Group Policy before attempting modifications.

Wildcards Affect Unintended Files

Problem: Using attrib +h *.* hides more files than intended.

Cause: Wildcards match all files in the current directory, including important system or application files.

Solution:

Use more specific wildcards: attrib +h *.txt instead of *.*
Preview files before applying attributes: DIR *.txt then attrib +h *.txt
Use /S parameter cautiously—it processes all subdirectories

Prevention: Always use DIR with the same wildcard pattern to preview affected files before running attrib.

"Not resetting system file" Warning

Problem: Attrib displays "Not resetting system file" warning and doesn't change attributes.

Cause: Windows Resource Protection (WRP) prevents modification of critical system files even with administrator privileges.

Solution:

Boot into Safe Mode and try the command
Use takeown to take ownership: takeown /F filename
Use icacls to grant permissions: icacls filename /grant administrators:F
Consider if modifying the file is truly necessary—WRP exists to protect system stability

Prevention: Research whether the file is WRP-protected before attempting modifications. Many WRP files should not be modified.

Related Commands

icacls – Advanced NTFS Permissions

While attrib handles basic file attributes (R, A, S, H), icacls manages NTFS permissions (read, write, execute, full control, modify). Use icacls for security-focused permission changes and attrib for simple attribute toggles.

When to use icacls: Setting user or group permissions, granting/denying access, managing inheritance, or configuring advanced security settings.

When to use attrib: Quick attribute changes, hiding files, setting read-only, or managing archive bits for backups.

Example: icacls C:\Data /grant Users:R grants read permission to Users group.

cacls – Legacy Permissions Tool

cacls is the predecessor to icacls for managing file permissions. Still available in Windows for backward compatibility, but deprecated. Use icacls instead for modern Windows systems—it offers more features, better syntax, and continued support.

Migration tip: Replace cacls commands in old scripts with equivalent icacls commands for future compatibility.

takeown – Take Ownership of Files

takeown changes file ownership to the current user or administrators group. Use before attrib or icacls when "Access denied" errors occur due to ownership restrictions.

Example: takeown /F C:\Windows\System32\drivers\etc\hosts /A takes ownership of the hosts file.

Workflow: takeown (change ownership) → icacls (grant permissions) → attrib (change attributes) → edit file → attrib (restore attributes).

xcopy – Copy Files with Attribute Control

xcopy is an advanced file copy command that respects and manipulates file attributes. Use /M to copy files with archive attribute set and clear it after copying (incremental backup), or /A to copy archived files without clearing the attribute.

Example: xcopy C:\Source D:\Backup /M /E /Y copies modified files and clears archive attribute.

Integration: Combine attrib and xcopy for custom backup solutions that track file changes via the archive attribute.

robocopy – Robust File Copy with Attribute Preservation

robocopy (Robust File Copy) is the enterprise-grade file copy tool that preserves all file attributes, timestamps, and NTFS permissions. Use for large-scale file migrations, backups, or synchronization.

Example: robocopy C:\Source D:\Destination /MIR /COPYALL mirrors directories with all attributes preserved.

Advantage: robocopy automatically handles attribute preservation, retries on errors, and provides detailed logging—ideal for enterprise file operations.

compact – NTFS Compression

compact manages NTFS file compression, another file attribute not controlled by attrib. Use to compress files and folders to save disk space while maintaining transparency to applications.

Example: compact /C /S:C:\Data compresses all files in C:\Data recursively.

Note: Compression is a separate attribute from R, A, S, H and requires NTFS file system.

Frequently Asked Questions

What does attrib +h do?

attrib +h sets the hidden attribute on a file or folder, hiding it from normal Windows Explorer view unless "Show hidden files" is enabled in Folder Options. Combine with /S /D to apply recursively to subdirectories: attrib +h foldername /S /D. Hidden files remain accessible if you know the exact path.

How do I unhide files with attrib?

Use attrib -h path /S /D to clear the hidden attribute recursively. For a single file: attrib -h filename. The /S parameter processes subdirectories, and /D includes directories themselves. Example: attrib -h C:\Data\*.* /S /D unhides all files and folders in C:\Data.

What is the difference between attrib and icacls?

Attrib manages four basic file attributes: Read-only (R), Archive (A), System (S), and Hidden (H). Icacls manages NTFS permissions: read, write, execute, full control, modify, and access control lists (ACLs). Use attrib for simple attribute changes; use icacls for security permissions and user/group access control.

Can attrib delete files?

No, attrib only displays and modifies file attributes—it cannot delete files. To delete files, use the DEL or ERASE command. However, attrib can remove read-only attributes that prevent deletion: attrib -r filename then DEL filename.

How do I make a file read-only with attrib?

Use attrib +r filename to set the read-only attribute. This prevents the file from being modified or deleted without first clearing the attribute. To remove read-only: attrib -r filename. Example: attrib +r C:\Config\settings.ini protects the configuration file from accidental changes.

What does the archive attribute do?

The archive attribute marks files that have changed since the last backup. Windows automatically sets the archive bit when a file is created or modified. Backup software clears it after successful backup. Use attrib -a to manually clear the archive attribute, or attrib +a to mark files as needing backup.

How do I remove system and hidden attributes?

Use attrib -s -h filename to clear both system and hidden attributes in a single command. Both must be cleared together for files with both attributes. Example: attrib -s -h C:\Windows\System32\drivers\etc\hosts allows editing the hosts file.

Can attrib work with network drives?

Yes, attrib works with UNC network paths and mapped network drives, provided you have appropriate permissions. Example: attrib \\server\share\file.txt or attrib Z:\file.txt for mapped drives. Administrator credentials may be required for modifying attributes on network files.

What does attrib /S /D do?

/S processes files in the current directory and all subdirectories recursively. /D includes directories (folders) in the operation, not just files. Combined, attrib +h *.* /S /D hides all files and folders in the current directory tree. Without /D, only files are affected, leaving directories visible.

How do I display all hidden files in a directory?

Use attrib C:\Path\*.* | find "H" to display only files with the hidden attribute. Alternatively, use DIR /A:H to list hidden files. To unhide all: attrib -h C:\Path\*.* /S /D.

Can I use attrib in batch scripts?

Yes, attrib is commonly used in batch files for automated file attribute management. Example script:

@echo off
attrib -r -h C:\Data\*.txt
echo Files are now editable
pause

Combine with IF EXIST for conditional attribute changes: IF EXIST file.txt attrib +r file.txt.

Why can't I change attributes on some files?

Windows Resource Protection (WRP) prevents attribute changes on critical system files even with administrator privileges. Files in use by running processes also cannot have attributes changed. Solutions: close applications using the file, run CMD as Administrator, use takeown and icacls to take ownership, or boot into Safe Mode.

Quick Reference Card

Command	Purpose	Example Use Case
`attrib`	Display all file attributes	Audit current attributes before changes
`attrib +r file.txt`	Make file read-only	Protect configuration files
`attrib -r file.txt`	Remove read-only	Allow editing protected files
`attrib +h folder /S /D`	Hide folder recursively	Conceal private files
`attrib -h folder /S /D`	Unhide folder recursively	Recover files after malware
`attrib +a *.docx`	Set archive attribute	Mark files for backup
`attrib -a . /S`	Clear archive attribute	Mark files as backed up
`attrib -s -h hosts`	Clear system & hidden	Edit Windows hosts file
`attrib +s +h hosts`	Set system & hidden	Restore hosts file protection
`attrib . \| find "R"`	Show read-only files	Find protected files

Try the Attrib Command in Our Simulator

Practice the attrib command safely in our Windows Command Simulator. No installation required—run attrib, attrib +r file.txt, and other examples in your browser. Perfect for learning, testing commands before running them on production systems, or demonstrating attrib functionality in training environments.

Visit the Commands Reference for a full list of supported Windows CMD commands, including file management, directory navigation, and system administration utilities.

Summary

The attrib command is essential for managing file attributes in Windows Command Prompt and batch scripts. Use + to set and - to clear the four main attributes: Read-only (R) protects files from modification, Archive (A) tracks files needing backup, System (S) identifies critical system files, and Hidden (H) conceals files from normal view.

Combine attrib with /S for recursive operations across subdirectories and /D to include directories in addition to files. Always handle System and Hidden attributes together when clearing them on protected files: attrib -s -h filename.

Master attrib for system administration tasks like protecting configuration files, recovering files after malware infections, managing backup workflows with the archive attribute, and editing protected system files safely. The command's simplicity and power make it indispensable for IT professionals, system administrators, and power users managing Windows file systems.

For advanced permission management beyond basic attributes, explore related commands like icacls for NTFS permissions, takeown for ownership changes, and robocopy for enterprise file operations with full attribute preservation.