PowerShell To Set Folder Permissions

Question

I am trying to use the "default" options in applying folder permissions; by that, I mean that using the "Full Controll, Write, Read, etc" in the 'Properties' for a folder.

The following script works to add the user in, but it applies "Special Permissions" - not the ones with the tick boxes for the ones visible in the properties menu of the folder:

$Acl = Get-Acl "\\R9N2WRN\Share"

$Ar = New-Object System.Security.AccessControl.FileSystemAccessRule ("user","FullControl","Allow")

$Acl.SetAccessRule($Ar)
Set-Acl "\\R9N2WRN\Share" $Acl

What am I doing wrong please?

score 106 · Accepted Answer · edited Dec 28 '21 at 14:03

Specifying inheritance in the FileSystemAccessRule() constructor fixes this, as demonstrated by the modified code below (notice the two new constuctor parameters inserted between "FullControl" and "Allow").

$Acl = Get-Acl "\\R9N2WRN\Share"

$Ar = New-Object System.Security.AccessControl.FileSystemAccessRule("user", "FullControl", "ContainerInherit,ObjectInherit", "None", "Allow")

$Acl.SetAccessRule($Ar)
Set-Acl "\\R9N2WRN\Share" $Acl

According to this topic

"when you create a FileSystemAccessRule the way you have, the InheritanceFlags property is set to None. In the GUI, this corresponds to an ACE with the Apply To box set to "This Folder Only", and that type of entry has to be viewed through the Advanced settings."

I have tested the modification and it works, but of course credit is due to the MVP posting the answer in that topic.

score 7 · Answer 2 · edited Dec 28 '21 at 14:03

Referring to Gamaliel 's answer: $args is an array of the arguments that are passed into a script at runtime - as such cannot be used the way Gamaliel is using it. This is actually working:

$myPath = 'C:\whatever.file'
# get actual Acl entry
$myAcl = Get-Acl "$myPath"
$myAclEntry = "Domain\User","FullControl","Allow"
$myAccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule($myAclEntry)
# prepare new Acl
$myAcl.SetAccessRule($myAccessRule)
$myAcl | Set-Acl "$MyPath"
# check if added entry present
Get-Acl "$myPath" | fl

score 6 · Answer 3 · edited Dec 28 '21 at 14:04

In case you had to deal with a lot of subfolders contatining subfolders and other recursive stuff. Small improvment of @Mike L'Angelo:

$mypath = "path_to_folder"
$myacl = Get-Acl $mypath
$myaclentry = "username","FullControl","Allow"
$myaccessrule = New-Object System.Security.AccessControl.FileSystemAccessRule($myaclentry)
$myacl.SetAccessRule($myaccessrule)
Get-ChildItem -Path "$mypath" -Recurse -Force | Set-Acl -AclObject $myacl -Verbose

Verbosity is optional in the last line

score 5 · Answer 4 · edited Dec 28 '21 at 14:04

5

Another example using PowerShell for set permissions (File / Directory) :

Verify permissions

Get-Acl "C:\file.txt" | fl *

Apply full permissions for everyone

$acl = Get-Acl "C:\file.txt"
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("everyone","FullControl","Allow")
$acl.SetAccessRule($accessRule)
$acl | Set-Acl "C:\file.txt"

Screenshots:

Hope this helps

edited Dec 28 '21 at 14:04

Jérémie Bertrand

2,987
3
45
50

answered Mar 09 '18 at 07:10

Gamaliel

345
3
5

1

This does not appear to work - it ended up with "special permissions" set for the user, not full control. – Mark Hughes May 16 '18 at 11:32
Thanks for your comments, I just want to share another example whos could be adaptative to set permissions that can be usefull and it works for me. – Gamaliel May 17 '18 at 16:03
Interesting, I wonder why it didn't work for me - maybe I did it wrong! – Mark Hughes Jun 08 '18 at 17:37
the accessRule line returns: constructor not found – Bub Espinja Oct 17 '18 at 14:02
Sorry all, I'm just trying to remedy my mistake. – Gamaliel Apr 26 '19 at 06:21
1

Here is a set of arguments: https://blog.netwrix.com/2018/04/18/how-to-manage-file-system-acls-with-powershell-scripts/ – mggluscevic Apr 11 '21 at 17:56

score -1 · Answer 5 · edited Dec 28 '21 at 14:05

$path = "C:\DemoFolder"
$acl = Get-Acl $path
$username = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
$Attribs = $username, "FullControl", "ContainerInherit,ObjectInherit", "None", "Allow"
$AccessRule = New-Object System.Security.AcessControl.FileSystemAccessRule($Attribs)
$acl.SetAccessRule($AccessRule)
$acl | Set-Acl $path
Get-ChildItem -Path "$path" -Recourse -Force | Set-Acl -aclObject $acl -Verbose

PowerShell To Set Folder Permissions

5 Answers5

Verify permissions

Apply full permissions for everyone

Linked