How to: How to use QSUnlock


QSUnlock is a simple command-line based tool that allows the NSS administrator to unlock directories that have been locked with NSS' legacy ACL locking method - hard 'NAS Quotas'.

In normal conditions these locks are lifted automatically by NSS as users clean up and usage levels go back below locking thresholds. However in certain conditions, such as a failure of the NSS host, it may not be possible to have NSS remove these locks. The command-line tool QSUnlock is available for fast and semi-automated removal of ACL locks when these types of conditions arise.

When run, QSUnlock will parse the entire directory structure for the specified path and remove the QS-created ‘Deny’-roles for all files and directories within the Access Control Lists. This article describes how this is done in more detail.

Using the tool

QSUnlock should only be run with the same account as the Quota Server service is running with. The reason for this is that it needs to be able to find the ACL separator and be able read and write ACL-s to a directory or a file. It is possible to use the tool either on a local path or on an UNC path.

  1. Open up the Command Prompt as an administrator. The tool will not work unless it’s activated as an administrator.
  2. When inside the Command Prompt as an administrator, navigate to C:\Program Files\Northern\Storage Suite\QS
  3. Type QSUnlock and press Enter to receive a brief description of the tool.
  4. Specify the path of the location that you wish to unlock. Examples:

    QSUNLOCK D:\Users\JohnDoe
    QSUNLOCK \\server\share$\path

QSUnlock overview

Practical example of the tool

Here’s a locked NAS-quota where users have been given ‘Deny’-roles in the folder's access control list by Quota Server:

Locked ACL quota

An attempt to add files to this directory will be denied:

Access Denied

If we go to the Security settings for this directory we can see that the ‘Everyone’-group has been given Special permissions. If we click on ‘Advanced’ we can see what these permissions are. We can see that these are the Deny-roles that NSS created. Users are still able to read and access files, but they are not able to write to them. This is what makes it a ‘Special permission’.

Special permissions in ACLSpecial deny permissions in ACL

Removing the lock with QSUnlock:

The path to the locked directory is specified and the tool is launched. It goes through the entire directory structure for the specified path and effectively removes the Deny roles for all folders and files.

Unlocking Test

The Deny roles are gone:

Deny Roles GoneDeny Roles Gone 2

Confirm results

  1. Perform the QSUnlock-operation as suggested above.
  2. Confirm that the Deny-roles are removed from the Windows Access Control List.
  3. Try to add files to the directory to confirm that directory is unlocked.

For advanced troubleshooting, please contact the Technical Support team at Northern (

KB Article: 3038

Updated: 8/14/2014

  • Category
    • Usage
  • Affected versions
    • NSS 9.0
    • NSS 9.5

North America HQ

NORTHERN Parklife, Inc.
301Edgewater Place, Suite 100
Wakefield, MA 01880

Voice: 781.968.5424
Fax: 781.968.5301


Additional Contact Information


St. Göransgatan 66
112 33 Stockholm

Voice: +46 8 457 50 00

Northern Parklife

©2018 northern parklife

privacy statement 
terms of use