SOLVED! Thanks for the support everyone. It turned out I simply needed to redirect stderr as well as stdout, like so: <install cmd='%COMSPEC% /C icacls C:\Users /t /c /remove:d Admin /grant Admin:r >C:\icacls.log 2>&1'/> Works redirecting to NUL too.