PowerShell script to add permission to directory and child items

Hello,

I could really use some help with my script. The purpose of my script is to add Modify rights to a folder and it's child folders for a domain user.

The script works to accomplish this, however, as you will see in my script I retrieve the access list for each folder at the End{}. What I am finding is that the domain user account that is added, is in there twice for all the child folders. The parent folder does not have this occurrence.

In other words, after I run the script, I go into Properties > Security > Advanced for any of the child folders and what I will see is that my domain\User is not only being Inheritedfrom "ParentFolder" but also is added a second time to permissions under Inheritedfrom "None" as seen in below screenshot.


This is a step up from what it used to do though, it was previously adding the System, NTAccount, and another default system permission a second time also. All under the Inheritedfrom "None". I was able to adjust script enough so that at least it is now only doubling up on the domain\User.

Am I even doing this the best way? I am adding the $acl to the parent folder and then adding the $acl to the child items. If I only save the child items to a variable and add the $acl by way of piping to the variable objects, it doesn't include the parent. There must be a better way? Feel free to offer feedback. Ultimately, I just want it to stop adding the domain\User twice.

function Set-Permission {
<#
.Synopsis
   Short description
.DESCRIPTION
   Long description
.EXAMPLE
   Example of how to use this cmdlet
.EXAMPLE
   Another example of how to use this cmdlet
.INPUTS
   Inputs to this cmdlet (if any)
.OUTPUTS
   Output from this cmdlet (if any)
.NOTES
   General notes
.COMPONENT
   The component this cmdlet belongs to
.ROLE
   The role this cmdlet belongs to
.FUNCTIONALITY
   The functionality that best describes this cmdlet
#>

    [CmdletBinding()]
    [OutputType([String])]
    Param (
        # Param1 help description
        [Parameter(Mandatory=$true,Position=0)]
        [Alias("Path")]
        [string]
        $dirPath,

        # Param2 help description
        [Parameter(Mandatory=$true,Position=1)]
        [string]
        $samAccountName,

        # Param3 help description
        [Parameter(Mandatory=$true, Position=2)]
        [ValidateSet("Modify")]
        [string]
        $accessLevel,
        
        # Param4 help description
        [Parameter(Mandatory=$false)]
        [string]
        $domain = 'domainName'
    )
    Begin {
        $domainAccount = $domain + "\" + $samAccountName
        $inheritanceFlags = "ContainerInherit, ObjectInherit"                     
        $propagationFlags = "None"                    
        $accessControlType = "Allow"

        $AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule(
                        $domainAccount,$accessLevel,$inheritanceFlags,$propagationFlags,$accessControlType)
        Write-Verbose 'Print New Access Rule object'
        $AccessRule

        Write-Verbose 'Access Control List of parent folder before applying new rules'
        $Parent = gi $dirPath | where {$_.psIsContainer -eq $true}
        $pFN = $Parent.FullName
        $pFN

        $ParentRecurse = gci $dirPath -Recurse | where {$_.psIsContainer -eq $true}

        $acl = ($Parent).GetAccessControl("Access")
        $acl.SetAccessRule($AccessRule)
    }
    Process {
        Write-Verbose "Applying $samAccountName $accessLevel permissions to parent $pFN"
        ($Parent).GetAccessControl("Access") |select accesstostring |fl
        $acl |Set-Acl -Path $Parent.FullName

        $ParentRecurse |
        ForEach-Object {
            $fnDir = $_.FullName
            Write-Verbose "Applying $samAccountName $accessLevel permissions to child $fnDir"
            ($_).GetAccessControl('Access') |select accesstostring |fl
            $acl |Set-Acl -Path $_.FullName
        }# \ForEach
    } # \Process
    End {
        Write-Verbose 'New permissions have been set'
        $Parent.FullName
        ($Parent).GetAccessControl("Access") |select accesstostring |fl
        ForEach ($dir in $ParentRecurse) {
            $dir.FullName
            ($dir).GetAccessControl("Access") |select accesstostring |fl
        }
    }# \End
}

Select allOpen in new window

What you will find in my script is that during the Process{}, I am calling the Access Control List for each folder Before the permissions are added and then at the end I call the ACL again After the permissions are added to compare.

It does that thing where it has doubled all the system account permissions, but looks like it cleans it up for the most part after the $acl is set, but again it still leaves a domain\User account double with Inheritedfrom "None" for some reason unknown to me.

Hope this makes sense, thanks for your time!