PowerShell set Access rights or ACL

Setting access rights to shared folders and files is very important to control the security of the folders.

If there is no proper design for the security of shared folders, missing files and folders is expected to happen since users can accidentally or either purposely delete or modify the folders and files.

NTFS permissions can be messy if not properly plan or design. Shared folder structure  on how to organize or set the folders is necessary so permissions can easily be applied.

To manage hundreds or thousands of files and folders is quite scary if it has to be done manually.

PowerShell scripting can do the heavy task to automate settings of access rights to files and folders.

Below is a simple script that can modify or set the folder security settings. Delete and modify permission setting has to be carefully implemented. Set "Auditing" to enabled in order to trace back whoever delete or messed up with the file.

Access to individual files or folders has to be observed as well, in order not to accidentally set access to users who should not have the permission to access the file or folder.

Here's the script:

 

 #path to the shared folder

 #folder path that acl files will be modified

 $pathx = 'd:\test'

 $UsrObject = 'domain Users'

 #$UsrObject = 'Peter John'

 #$UsrObject = 'Authenticated Users'

 #$UsrObject = 'Just replace with any user name'

 #get the existing acl to be modified

 $acl = Get-Acl $pathx

#code below will set the folder to read and write only

#users can write to folder but cannot change or delete after that

#good settings for final report or archiving

$rule = New-Object System.Security.AccessControl.FileSystemAccessRule("$UsrObject", @("write", "Read"), "ContainerInherit, ObjectInherit", "None", "Allow") # This Folder, Subfolders and files only

#"ContainerInherit, ObjectInherit", "InheritOnly" =  Subfolders and files only

#Can set also the advance permissions

#$rule = New-Object System.Security.AccessControl.FileSystemAccessRule("$UsrObject", @("Create Folders / Append Data", "Delete Subfolders and files"), "ContainerInherit, ObjectInherit", "None", "Allow") # This Folder, Subfolders and files only

#$rule = New-Object System.Security.AccessControl.FileSystemAccessRule("$UsrObject", @("Modify"), "ContainerInherit, ObjectInherit", "None", "Allow") # This Folder, Subfolders and files only

#Modify will allow users to delete (use with discretion)

#set the access rule and applied to the path

$acl.SetAccessRule($rule)

Set-Acl $pathx $acl

To verify if the security settings or the ACL has been applied successfully use this code:

Get-ACL "d:\Test" | Format-List 

Use the code on a test folder before applying it to production to make sure it works as per expectation.

If an error is encountered from the above script such as:

 Set-Acl: The security identifier is not allowed to be the owner of this object.

Change this code: $acl = Get-Acl $pathx

Change it to:
 $acl = (Get-Item $pathx).GetAccessControl('Access')

To find out why, check the link below:
http://stackoverflow.com/questions/6622124/why-does-set-acl-on-the-drive-root-try-to-set-ownership-of-the-object

To easily copy folder permissions and apply to another folder use the code below.

Reference folder that has the permissions set; must be the desired output, once the code is executed folder permissions will be the same with the reference folder.

Here's the code:
#======================
$folder_ref_perm = 'd:\folder_permission_reference'

$folder = 'd:\folder_to_copy_or_apply_permission'

$acl = (Get-Item $folder_ref_perm).GetAccessControl('Access')


$acl.SetAccessRuleProtection($True, $True)
Set-Acl -Path $folder -AclObject $acl
#======================

That's it permission is apply to folder, sub-folders and files.

Cheers.. till next time. Hope it helps..


Excel Keyboard shortcuts guide
https://play.google.com/store/apps/details?id=chrisjoms.myexcelapplicationguide

Linux Android App cheat sheet:
https://play.google.com/store/apps/details?id=com.LinuxMobileKit