Skip to main content

PowerShell set Access rights or ACL

Setting access rights to shared folders and files is very important to control the security of the folders.

If there is no proper design for the security of shared folders, missing files and folders is expected to happen since users can accidentally or either purposely delete or modify the folders and files.

NTFS permissions can be messy if not properly plan or design. Shared folder structure  on how to organize or set the folders is necessary so permissions can easily be applied.

To manage hundreds or thousands of files and folders is quite scary if it has to be done manually.

PowerShell scripting can do the heavy task to automate settings of access rights to files and folders.

Below is a simple script that can modify or set the folder security settings. Delete and modify permission setting has to be carefully implemented. Set "Auditing" to enabled in order to trace back whoever delete or messed up with the file.

Access to individual files or folders has to be observed as well, in order not to accidentally set access to users who should not have the permission to access the file or folder.

Here's the script:
 #path to the shared folder

 #folder path that acl files will be modified

 $pathx = 'd:\test'

 $UsrObject = 'domain Users'

 #$UsrObject = 'Peter John'

 #$UsrObject = 'Authenticated Users'

 #$UsrObject = 'Just replace with any user name'

 #get the existing acl to be modified

 $acl = Get-Acl $pathx

#code below will set the folder to read and write only

#users can write to folder but cannot change or delete after that

#good settings for final report or archiving

$rule = New-Object System.Security.AccessControl.FileSystemAccessRule("$UsrObject", @("write", "Read"), "ContainerInherit, ObjectInherit", "None", "Allow") # This Folder, Subfolders and files only

#"ContainerInherit, ObjectInherit", "InheritOnly" =  Subfolders and files only

#Can set also the advance permissions

#$rule = New-Object System.Security.AccessControl.FileSystemAccessRule("$UsrObject", @("Create Folders / Append Data", "Delete Subfolders and files"), "ContainerInherit, ObjectInherit", "None", "Allow") # This Folder, Subfolders and files only

#$rule = New-Object System.Security.AccessControl.FileSystemAccessRule("$UsrObject", @("Modify"), "ContainerInherit, ObjectInherit", "None", "Allow") # This Folder, Subfolders and files only

#Modify will allow users to delete (use with discretion)

#set the access rule and applied to the path


Set-Acl $pathx $acl

To verify if the security settings or the ACL has been applied successfully use this code:

Get-ACL "d:\Test" | Format-List 

Use the code on a test folder before applying it to production to make sure it works as per expectation.

If an error is encountered from the above script such as:

 Set-Acl: The security identifier is not allowed to be the owner of this object.

Change this code: $acl = Get-Acl $pathx

Change it to:
 $acl = (Get-Item $pathx).GetAccessControl('Access')

To find out why, check the link below:

To easily copy folder permissions and apply to another folder use the code below.

Reference folder that has the permissions set; must be the desired output, once the code is executed folder permissions will be the same with the reference folder.

Here's the code:
$folder_ref_perm = 'd:\folder_permission_reference'

$folder = 'd:\folder_to_copy_or_apply_permission'

$acl = (Get-Item $folder_ref_perm).GetAccessControl('Access')

$acl.SetAccessRuleProtection($True, $True)
Set-Acl -Path $folder -AclObject $acl


That's it permission is apply to folder, sub-folders and files.

Cheers.. till next time. Hope it helps..

Excel Keyboard shortcuts guide

Linux Android App cheat sheet:


Popular posts from this blog

Copy a single file using robocopy

Copy a single file using robocopy from a local folder to a shared folder on the network.
A simple rule of thumb before any disaster strike, don't interchange the source and the destination.

If source and destination is mistakenly reverse, files might get overwritten. To avoid any loss of data do a test with a dummy file to ensure things work perfectly.
Robocopy [source][destination]   [file to be copied]
robocopy c:\local_c_folder  \\PC_network\shared_folder   file_to_be_copied_xx.txt
The command will be completed successfully provided the network access right has no issues.

Robocopy works quite good on large files. A simple copy or xcopy command will also work but the speed might vary.

However, if the file (ex. an ISO file) and is more than 4GB and the filesystem  of the thumbdrive or the storage is FAT system, then robocopy or any methods of copying will not work. Since FAT has a file size limitation of less than 3GB.

Robocopy is free it can be accessed from command line. No ne…

WMIC List printers

WMIC comes handy if you are a command line junkie.

To list printers via command line type:

wmic printer get name  = = = this will list all the printers installed on a workstation

To list the printer name and the port name of the printers, type this command:

wmic printer get name, portname

Type this command below to list the printer drivers:

wmic printer get name, drivername

To get the device id:

wmic printer get name, deviceid

You can deploy a batch file startup script to check which printer is installed on the computers and redirect the output to a shared folder.

PowerShell can also be used in conjunction with WMIC command:

To see more WMIC tips, click on WMIC label below.


Linux Android App cheat sheet:

WMIC get computer name

WMIC get computer model, manufacturer, computer name and  username.
WMIC is a command-line tool and that can generate information about computer model, its manufacturer, its username and other informations depending on the parameters provided.
Why would you need a command line tool if there’s a GUI to check?
If you have 20 or 100 computers, or even more. It’s quite a big task just checking the GUI to check the computer model and username.
If you have remote computers, you need to delegate someone in the remote office or location to check.
Or you can just write a batch file or script to automate the task.
Here’s the code below on how get computer model, manufacturer and the username.
Open an elevated command prompt and type:
wmic computersystem get "Model","Manufacturer", "Name", "UserName"
Just copy and paste the code above, the word “computersystem” does not need to be change to a computer name.
A sample output below will be generated if the co…