<div>
 
Can you show us what you'd like put back? 
 
I take it you're only modifying NTFS permissions rather than Share permissions? 
 
Chris
</div>

<div>
I am modifying the NTFS permissions. 
When you say like put back? 
I need to somehow import the setting into an xcacls format so that I can import it 
does that clarify? 
&nbsp; 

</div>

<div>
 
It would need something to read the Excel file, then construct the commands for xcacls or modify the permissions directly. 
 
That means we need to know the format you intend to use for the Excel file (after you've modified it). 
 
Chris
</div>

<div>
i did modify it. 
In the attached spreadsheet the last column the one in black says what the change should be made to 
 
Does that make sense? 

</div>

<div>
 
Ahhh sorry, I thought that was all the output from the original. 
 
First I'm a bit concerned that you want to change the permissions dynamically for a large number of default areas on the drive (C:, C:\Documents and Settings, and so on). Read and Execute (RX) for the areas under Documents and Settings is required if you want it to actually work afterwards. 
 
Otherwise it's a bit... well... simplistic. 
 
For each entry we add to an access control list we must define: 
 
1. Who to grant the right to (Trustee) 
2. The level of access, Full Control, Modify, Read, or anything inbetween (Access Mask) 
3. Whether the entry applies to Files and / or Folders when considering inheritance (Object Inherit, Container Inherit) 
 
Chris
</div>

<div>
The permissions I am setting I think I am happy with 
Some of my spread sheets change the user name, some leave it 
so do you think we can take that ntfs dump and script it to a xcacles for import? 

</div>

<div>
 
Well... mostly :) 
 
I don't like the two black columns, they're rather messy which means we have to do a lot of checking to see if we're reading it in the right context. 
 
Is it possible to split it up a bit? 
 
Something like this: 
 
Action &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Rights &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;User (if New) 
Remove, Modify or Add &nbsp; &nbsp; &nbsp; R/C/F/P/O/X/E/W/D &nbsp; &nbsp; &nbsp;&lt;Username&gt; 
 
What do you want to do with Inheritance? For example, your very first permission adds everyone RX replacing an Everyone R that applies only to the current folder. 
 
Chris
</div>

<div>
Right so I guess inheritance is something I would like to block 
&nbsp; 
when you say split if up a bit? I have about 300 spreadsheets with about 20,000 lines in them 

</div>

<div>
 
It's just with them as they are now the chance of the script doing something wrong / unexpected is very high (unpredictable values in the cells). Especially over such a large volume. 
 
Do bear in mind that the script needs to read the files and attempt to construct the commands to use with xcacls, no native importer for this kind of thing. 
 
You really only want the permissions we're assigning to only apply to the current object (no inheritance)? 
 
And we're going to end up with a lot of incorrectly ordered ACLs, xcacls doesn't re-order them for us. 
 
Chris
</div>

<div>
So u think if i went through the speadsheets and changed the black column to 3 separate columns it would work better? 
 
Action &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Rights &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;User (if New) 
Remove, Modify or Add, do nothing &nbsp; &nbsp; &nbsp; R/C/F/P/O/X/E/W/D &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;Username&gt; 
I will do the work for that if it will work much better 

</div>

<div>
 
It should do, we'll have predictable values in each column to work with. Is that likely to create a lot of work for you? 
 
Chris
</div>

<div>
It is work I can live with 
Can we put a colum another column witha &nbsp;y or no for intance? 
this way we can specify? 

</div>

<div>
 
Sure, that sounds good, then we'll stick with either full inheritance (files and folders, all sub-directories) or none at all, when the right applies only to the current folder. Good enough? 
 
Chris
</div>

<div>
 
Great, okay. I'll start building the script then :) 
 
Working with this as our column order: 
 
Path &nbsp; &nbsp;Account (User or Group) &nbsp; &nbsp;Account (ignoring) &nbsp; &nbsp;Own (ignoring) &nbsp; &nbsp;Action &nbsp; &nbsp;Rights &nbsp; &nbsp;User (if new) &nbsp; &nbsp;Inheritance 
 
Naturally we can change that later, the script will just refer to the columns by number. 
 
Chris
</div>

<div>
 
Hmm looks like xcacls.exe doesn't give us any choice on Inheritance anyway. /T is a bit of a rubbish option. That means anything we add will be set to apply to all files and folders in all sub-directories. 
 
We can potentially work around that, but that's much much less trivial so perhaps see if it's necessary first. 
 
With that in mind, this is the first draft. It simply constructs the xcacls commands using the file format above. I imagine we'll need to tweak it a fair bit. 
 
Chris 

<pre><code class="code-10 nolinks" id="code-271019">Dim objExcel : Set objExcel = CreateObject(&quot;Excel.Application&quot;)
Dim objWorkbook : Set objWorkbook = objExcel.Workbooks.Open(EXCEL_FILE)
 
Dim objFSO : Set objFSO = CreateObject(&quot;Scripting.FileSystemObject&quot;)
Dim objLogFile : Set objLogFile = objFSO.OpenTextFile(&quot;commands.log&quot;, 2, True, 0)
Dim objShell : Set objShell = CreateObject(&quot;WScript.Shell&quot;)
 
Dim intRow : intRow = 2
Dim intNumBlankRows : intNumBlankRows = 0
Do Until intNumBlankRows = 2
 
 Dim strPath : strPath = objExcel.Cells(intRow, 1).Value
 If strPath = &quot;&quot; Then
 intNumBlankRows = intNumBlankRows + 1
 Else
 intNumBlankRows = 0
 
 Dim strUser : strUser = objExcel.Cells(intRow, 2).Value
 Dim strAction : strAction = LCase(objExcel.Cells(intRow, 5).Value)
 Dim strRights : strRights = objExcel.Cells(intRow, 6).Value
 Dim strInheritance : strInheritance = objExcel.Cells(intRow, 8).Value
 
 If strAction = &quot;add&quot; Then
 strUser = objExcel.Cells(intRow, 7).Value
 End If
 
 Select Case strAction
 Case &quot;add&quot;
 strCommand = &quot;xcacls.exe &quot;&quot;&quot; &amp; strPath &amp; &quot;&quot;&quot; /E /G &quot; &amp; strUser &amp; &quot;:&quot; &amp; strRights
 objLogFile.WriteLine strCommand
 ' objShell.Run strCommand, 0, True
 
 Case &quot;modify&quot;
 strCommand = &quot;xcacls.exe &quot;&quot;&quot; &amp; strPath &amp; &quot;&quot;&quot; /E /R &quot; &amp; strUser
 objLogFile.WriteLine strCommand
 ' objShell.Run strCommand, 0, True
 
 strCommand = &quot;xcacls.exe &quot;&quot;&quot; &amp; strPath &amp; &quot;&quot;&quot; /E /G &quot; &amp; strUser &amp; &quot;:&quot; &amp; strRights
 objLogFile.WriteLine strCommand
 ' objShell.Run strCommand, 0, True
 
 Case &quot;remove&quot;
 objShell.Run &quot;xcacls.exe &quot;&quot;&quot; &amp; strPath &amp; &quot;&quot;&quot; /E /R &quot; &amp; strUser
 objLogFile.WriteLine strCommand
 ' objShell.Run strCommand, 0, True
 
 End Select
 End If
 
 intRow = intRow + 1
Loop
 
Set objShell = Nothing
Set objLogFile = Nothing
Set objFSO = Nothing
 
Set objWorkbook = Nothing
objExcel.Quit
Set objExcel = Nothing
</code></pre>
</div>

<div>
ok, 
Do I run this as a macro? 
&nbsp; 

</div>

<div>
 
Just as a separate .vbs file. Haven't a clue about Macros, totally outside my field I'm afraid. 
 
Chris
</div>

<div>
so when i create it as vb file how do i point it to do the output.xls file?
</div>

<div>
 
Sorry dude, I missed off the constant at the top that tells you where it is... Helpful... 
 
Here you go, modify the EXCEL_FILE constant for now, we can make it loop when we're happy with what it does. At the moment it just logs the commands it would use to commands.log, no changes. 
 
Chris 

<pre><code class="code-10 nolinks" id="code-271117">Const EXCEL_FILE = &quot;C:\somefile.xls&quot;
 
Dim objExcel : Set objExcel = CreateObject(&quot;Excel.Application&quot;)
Dim objWorkbook : Set objWorkbook = objExcel.Workbooks.Open(EXCEL_FILE)
 
Dim objFSO : Set objFSO = CreateObject(&quot;Scripting.FileSystemObject&quot;)
Dim objLogFile : Set objLogFile = objFSO.OpenTextFile(&quot;commands.log&quot;, 2, True, 0)
Dim objShell : Set objShell = CreateObject(&quot;WScript.Shell&quot;)
 
Dim intRow : intRow = 2
Dim intNumBlankRows : intNumBlankRows = 0
Do Until intNumBlankRows = 2
 
 Dim strPath : strPath = objExcel.Cells(intRow, 1).Value
 If strPath = &quot;&quot; Then
 intNumBlankRows = intNumBlankRows + 1
 Else
 intNumBlankRows = 0
 
 Dim strUser : strUser = objExcel.Cells(intRow, 2).Value
 Dim strAction : strAction = LCase(objExcel.Cells(intRow, 5).Value)
 Dim strRights : strRights = objExcel.Cells(intRow, 6).Value
 Dim strInheritance : strInheritance = objExcel.Cells(intRow, 8).Value
 
 If strAction = &quot;add&quot; Then
 strUser = objExcel.Cells(intRow, 7).Value
 End If
 
 Select Case strAction
 Case &quot;add&quot;
 strCommand = &quot;xcacls.exe &quot;&quot;&quot; &amp; strPath &amp; &quot;&quot;&quot; /E /G &quot; &amp; strUser &amp; &quot;:&quot; &amp; strRights
 objLogFile.WriteLine strCommand
 ' objShell.Run strCommand, 0, True
 
 Case &quot;modify&quot;
 strCommand = &quot;xcacls.exe &quot;&quot;&quot; &amp; strPath &amp; &quot;&quot;&quot; /E /R &quot; &amp; strUser
 objLogFile.WriteLine strCommand
 ' objShell.Run strCommand, 0, True
 
 strCommand = &quot;xcacls.exe &quot;&quot;&quot; &amp; strPath &amp; &quot;&quot;&quot; /E /G &quot; &amp; strUser &amp; &quot;:&quot; &amp; strRights
 objLogFile.WriteLine strCommand
 ' objShell.Run strCommand, 0, True
 
 Case &quot;remove&quot;
 objShell.Run &quot;xcacls.exe &quot;&quot;&quot; &amp; strPath &amp; &quot;&quot;&quot; /E /R &quot; &amp; strUser
 objLogFile.WriteLine strCommand
 ' objShell.Run strCommand, 0, True
 
 End Select
 End If
 
 intRow = intRow + 1
Loop
 
Set objShell = Nothing
Set objLogFile = Nothing
Set objFSO = Nothing
 
Set objWorkbook = Nothing
objExcel.Quit
Set objExcel = Nothing
</code></pre>
</div>

<div>
ok, 
So &nbsp;I ran it, and it gave me an error 
Line 45 char 9 
the system could not find the file specified. 
Also the output of this file with be something we can import using xcacls correct? 

</div>

<div>
 
Fixed, it shouldn't have been doing that. 
 
At worst it'll create a Batch File full of xcacls commands, at best it will run xcacls for us. It's the best we'll get really. 
 
Chris 

<pre><code class="code-10 nolinks" id="code-271162">Const EXCEL_FILE = &quot;C:\somefile.xls&quot;
 
Dim objExcel : Set objExcel = CreateObject(&quot;Excel.Application&quot;)
Dim objWorkbook : Set objWorkbook = objExcel.Workbooks.Open(EXCEL_FILE)
 
Dim objFSO : Set objFSO = CreateObject(&quot;Scripting.FileSystemObject&quot;)
Dim objLogFile : Set objLogFile = objFSO.OpenTextFile(&quot;commands.log&quot;, 2, True, 0)
Dim objShell : Set objShell = CreateObject(&quot;WScript.Shell&quot;)
 
Dim intRow : intRow = 2
Dim intNumBlankRows : intNumBlankRows = 0
Do Until intNumBlankRows = 2
 
 Dim strPath : strPath = objExcel.Cells(intRow, 1).Value
 If strPath = &quot;&quot; Then
 intNumBlankRows = intNumBlankRows + 1
 Else
 intNumBlankRows = 0
 
 Dim strUser : strUser = objExcel.Cells(intRow, 2).Value
 Dim strAction : strAction = LCase(objExcel.Cells(intRow, 5).Value)
 Dim strRights : strRights = objExcel.Cells(intRow, 6).Value
 Dim strInheritance : strInheritance = objExcel.Cells(intRow, 8).Value
 
 If strAction = &quot;add&quot; Then
 strUser = objExcel.Cells(intRow, 7).Value
 End If
 
 Select Case strAction
 Case &quot;add&quot;
 strCommand = &quot;xcacls.exe &quot;&quot;&quot; &amp; strPath &amp; &quot;&quot;&quot; /E /G &quot; &amp; strUser &amp; &quot;:&quot; &amp; strRights
 objLogFile.WriteLine strCommand
 ' objShell.Run strCommand, 0, True
 
 Case &quot;modify&quot;
 strCommand = &quot;xcacls.exe &quot;&quot;&quot; &amp; strPath &amp; &quot;&quot;&quot; /E /R &quot; &amp; strUser
 objLogFile.WriteLine strCommand
 ' objShell.Run strCommand, 0, True
 
 strCommand = &quot;xcacls.exe &quot;&quot;&quot; &amp; strPath &amp; &quot;&quot;&quot; /E /G &quot; &amp; strUser &amp; &quot;:&quot; &amp; strRights
 objLogFile.WriteLine strCommand
 ' objShell.Run strCommand, 0, True
 
 Case &quot;remove&quot;
 strCommand = &quot;xcacls.exe &quot;&quot;&quot; &amp; strPath &amp; &quot;&quot;&quot; /E /R &quot; &amp; strUser
 objLogFile.WriteLine strCommand
 ' objShell.Run strCommand, 0, True
 
 End Select
 End If
 
 intRow = intRow + 1
Loop
 
Set objShell = Nothing
Set objLogFile = Nothing
Set objFSO = Nothing
 
Set objWorkbook = Nothing
objExcel.Quit
Set objExcel = Nothing
</code></pre>
</div>

<div>
I think I would prefer a file so that I can verify the changes before they go in 
can that work? 

</div>

<div>
is it possible to export the results to bat file and view the output before making the changes to the system?
</div>

<div>
 
Sure of course. In effect, that's what command.log already is, just change the name to command.bat. 
 
We'll take out the objShell.Run lines, they're commented out at the moment, but they don't need to be there at all if we're making batch files. 
 
Chris
</div>

<div>
Excellent 
so does something need to be changed in the script? 

</div>

<div>
 
Not really, but here's a version with the file renamed for clarity :) 
 
I've made it write remarks (REM) to the batch file as well, just says what it's doing. Output file is &quot;commands.bat&quot; now, it'll pop up in the same folder as the script. 
 
Chris 

<pre><code class="code-10 nolinks" id="code-271923">Const EXCEL_FILE = &quot;C:\somefile.xls&quot;
 
Dim objExcel : Set objExcel = CreateObject(&quot;Excel.Application&quot;)
Dim objWorkbook : Set objWorkbook = objExcel.Workbooks.Open(EXCEL_FILE)
 
Dim objFSO : Set objFSO = CreateObject(&quot;Scripting.FileSystemObject&quot;)
Dim objFile : Set objFile = objFSO.OpenTextFile(&quot;commands.bat&quot;, 2, True, 0)
 
Dim intRow : intRow = 2
Dim intNumBlankRows : intNumBlankRows = 0
Do Until intNumBlankRows = 2
 
 Dim strPath : strPath = objExcel.Cells(intRow, 1).Value
 If strPath = &quot;&quot; Then
 intNumBlankRows = intNumBlankRows + 1
 Else
 intNumBlankRows = 0
 
 Dim strUser : strUser = objExcel.Cells(intRow, 2).Value
 Dim strAction : strAction = LCase(objExcel.Cells(intRow, 5).Value)
 Dim strRights : strRights = objExcel.Cells(intRow, 6).Value
 Dim strInheritance : strInheritance = objExcel.Cells(intRow, 8).Value
 
 If strAction = &quot;add&quot; Then
 strUser = objExcel.Cells(intRow, 7).Value
 End If
 
 Select Case strAction
 Case &quot;add&quot;
 objFile.WriteLine &quot;REM Add command for &quot; &amp; strPath
 strCommand = &quot;xcacls.exe &quot;&quot;&quot; &amp; strPath &amp; &quot;&quot;&quot; /E /G &quot; &amp; strUser &amp; &quot;:&quot; &amp; strRights
 objFile.WriteLine strCommand
 
 Case &quot;modify&quot;
 objFile.WriteLine &quot;REM Modify commands for &quot; &amp; strPath
 strCommand = &quot;xcacls.exe &quot;&quot;&quot; &amp; strPath &amp; &quot;&quot;&quot; /E /R &quot; &amp; strUser
 objFile.WriteLine strCommand
 
 strCommand = &quot;xcacls.exe &quot;&quot;&quot; &amp; strPath &amp; &quot;&quot;&quot; /E /G &quot; &amp; strUser &amp; &quot;:&quot; &amp; strRights
 objFile.WriteLine strCommand
 
 Case &quot;remove&quot;
 objFile.WriteLine &quot;REM Remove command for &quot; &amp; strPath
 strCommand = &quot;xcacls.exe &quot;&quot;&quot; &amp; strPath &amp; &quot;&quot;&quot; /E /R &quot; &amp; strUser
 objFile.WriteLine strCommand
 
 End Select
 End If
 
 intRow = intRow + 1
Loop
 
Set objFile = Nothing
Set objFSO = Nothing
 
Set objWorkbook = Nothing
objExcel.Quit
Set objExcel = Nothing
</code></pre>
</div>

<div>
if I am taking no action on a field do i need to input no action?
</div>

<div>
When I run the bat this is the error I get for every line 
&nbsp;C:\Documents and Settings\myaccount\Desktop&gt;xcacls.exe &quot;\\workstation\c$\2007of 
fice\&quot; /E /R workstations\Users 
The filename, directory name, or volume label syntax is incorrect. 

</div>

<div>
 
&gt;&nbsp;if I am taking no action on a field do i need to input no action? 
 
No, it can be blank. It will ignore it unless it explicitly matches one of the three values we're testing. 
 
&gt;&nbsp;The filename, directory name, or volume label syntax is incorrect. 
 
Can you access the path directly? e.g. 
 
Start, Run, \\workstation\c$\2007office 
 
Chris
</div>

<div>
yes, that is my local pc 

</div>

<div>
 
I did wonder if it would work through the admin shares. Can you try the same using a regular share? 
 
Chris
</div>

<div>
i can just tell me what u want to chane in the xls file
</div>

<div>
 
&gt;&nbsp;i can just tell me what u want to chane in the xls file 
 
Nothing because I can't see anything wrong. 
 
It does work through administrative shares after a spot of testing, and the command with the syntax above is fine. I ran this one on my PC and it was fine: 
 
xcacls &quot;\\lon01-00301\c$\Stuff\Scripts\Test\Permissions&quot; /e /r administrator 
 
When you access the Administrative Share, it doesn't pop up a login box does it? That is, the account executing the script has full access to that share? 
 
Chris
</div>

<div>
I dont understand 
Here is one of the commands in the bat 
xcacls.exe &quot;\\workstation54\c$\.zenmap\&quot; /E /R workstation54\Users &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
 
<a href="https://filedb.experts-exchange.com/incoming/2009/03_w11/115937/shareview.JPG" target="_blank" class="file-inline" title="share (46 KB)"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M67.508 468.467c-58.005-58.013-58.016-151.92 0-209.943l225.011-225.04c44.643-44.645 117.279-44.645 161.92 0 44.743 44.749 44.753 117.186 0 161.944l-189.465 189.49c-31.41 31.413-82.518 31.412-113.926.001-31.479-31.482-31.49-82.453 0-113.944L311.51 110.491c4.687-4.687 12.286-4.687 16.972 0l16.967 16.971c4.685 4.686 4.685 12.283 0 16.969L184.983 304.917c-12.724 12.724-12.73 33.328 0 46.058 12.696 12.697 33.356 12.699 46.054-.001l189.465-189.489c25.987-25.989 25.994-68.06.001-94.056-25.931-25.934-68.119-25.932-94.049 0l-225.01 225.039c-39.249 39.252-39.258 102.795-.001 142.057 39.285 39.29 102.885 39.287 142.162-.028A739446.174 739446.174 0 0 1 439.497 238.49c4.686-4.687 12.282-4.684 16.969.004l16.967 16.971c4.685 4.686 4.689 12.279.004 16.965a755654.128 755654.128 0 0 0-195.881 195.996c-58.034 58.092-152.004 58.093-210.048.041z"/></svg>shareview.JPG</a>
</div>

shareview.JPG

<div>
 
Perhaps drop out the &quot;workstation54&quot; and leave it with just Users? Just to test the command? 
 
Chris
</div>

<div>
C:\&gt;xcacls.exe &quot;\\workstation54\c$\.zenmap\&quot; /E /R Users 
The filename, directory name, or volume label syntax is incorrect.
</div>

<div>
 
Well that's... very annoying. 
 
xcacls works if you pass it &quot;c:\.zenmap&quot; I assume? 
 
Try dropping the final &quot;\&quot; from the share path above? If that's it we can just remove it in the script. 
 
Chris
</div>

<div>
U are right 
It is that last slash that is causing the problem. 
Another thing, if I do Modify, and then put a new user in the user field it does not process that 
now comes the tough question, how do we deal with inheritance? 

</div>

<div>
If you change the user then the Revoke we made for the original entry will fail. Can't do much about that, that's why we have a New option to play with for new entries :) 
 
Inheritance... 
 
Well... We'd have to move away from xcacls. We can do it using WMI however, that's, just a little &nbsp;more complex because we have to convert every path into a local path (not to mention having to rewrite the security descriptors). 
 
Heh, or I could try and encourage you to move to PowerShell again which can rewrite them far more efficiently and should be able to continue using the UNC paths we have :) 
 
Chris
</div>

<div>
will powershell make everything perfect? 
If it will I am ok with it 

</div>

<div>
 
Perfect? Probably not but we can try :) 
 
It is considerably better at handling permissions that we would have to suffer if we were to go down the WMI road with VbScript. It's all entirely possible, but very long-winded. 
 
Chris
</div>

<div>
 
We are, just haven't had time to pop it together quite yet (ended up with some work to do :)). I'll endeavour to get it put together this weekend so we can test it out. 
 
Chris
</div>

<div>
Hi, 
Do you think we will be ready to test soon? 

</div>

<div>
 
Slowly ;) 
 
You can give this bit a shot if you like? It only does the &quot;Add&quot; action at the moment, but it'd be good to make sure it reads the file properly. 
 
Chris 

<pre><code class="code-10 nolinks" id="code-275821">$ExcelFile = &quot;C:\somefile.xls&quot;
# Just in case we need to change the domain name. Otherwise defaulting to the domain 
# listed in the environmental variable %UserDomain%
$DomainName = $Env:UserDomain
 
$Excel = New-Object -comobject Excel.Application
$Excel.Workbooks.Open($ExcelFile)
 
$RowNum = 0
$BlankPath = 0
While ($BlankPath -lt 2) {
 $Path = $Excel.Cells($RowNum, 1)
 If ($Path -eq &quot;&quot;) {
 
 $BlankPath++
 
 } else {
 
 $BlankPath = 0
 
 $User = $Excel.Cells($RowNum, 2)
 
 # Get the Rights and make it into an AccessMask
 $Rights = $Excel.Cells($RowNum, 6).ToUpper()
 $AccessMask = @()
 If ($Rights.Contains(&quot;R&quot;)) { $AccessMask += &quot;ReadAndExecute&quot; }
 If ($Rights.Contains(&quot;C&quot;)) { $AccessMask += &quot;Modify&quot; }
 If ($Rights.Contains(&quot;F&quot;)) { $AccessMask += &quot;FullControl&quot; }
 If ($Rights.Contains(&quot;P&quot;)) { $AccessMask += &quot;ChangePermissions&quot; }
 If ($Rights.Contains(&quot;O&quot;)) { $AccessMask += &quot;TakeOwnership&quot; }
 If ($Rights.Contains(&quot;X&quot;)) { $AccessMask += &quot;ExecuteFile&quot; }
 If ($Rights.Contains(&quot;E&quot;)) { $AccessMask += &quot;Read&quot; }
 If ($Rights.Contains(&quot;W&quot;)) { $AccessMask += &quot;Write&quot; }
 If ($Rights.Contains(&quot;D&quot;)) { $AccessMask += &quot;Delete&quot; }
 
 # Figure out if Inheritance is to be enabled for this Entry
 $Inheritance = $Excel.Cells($RowNum, 8).ToLower()
 Switch ($Inheritance) {
 &quot;yes&quot; : $Inheritance = @(&quot;ObjectInherit&quot;, &quot;ContainerInherit&quot;)
 &quot;no&quot; : $Inheritance = $Null
 }
 
 # Not doing anything with Propagation...
 $Propagation = $Null
 
 # Type (Allow, Deny, or Audit)
 $Type = &quot;Allow&quot;
 
 $Action = $Excel.Cells($RowNum, 5).ToLower()
 Switch ($Action.ToLower()) {
 &quot;add&quot; {
 # Create the new access rule
 $Rule += New-Object System.Security.AccessControl.FileSystemAccessRule( `
 &quot;$($DomainName\$User)&quot;, $AccessMask, $Inheritance, $Propagation, $Type)
 
 $ACL = Get-ACL $Path
 $ACL.AddAccessRule($Rule)
 Set-ACL $Path -aclObject $ACL
 }
 &quot;modify&quot; { }
 
 &quot;remove&quot; { }
 }
 }
 $RowNum++
}
</code></pre>
</div>

<div>
&gt;&gt; 
Missing statement block in switch statement clause. 
At line:23 char:13 
+ &nbsp; &nbsp; &nbsp; &quot;yes&quot; : &lt;&lt;&lt;&lt;&nbsp; $Inheritance = @(&quot;ObjectInherit&quot;, &quot;ContainerInherit&quot;) 
PS C:\&gt; &nbsp; &nbsp; # Not doing anything with Propagation... 
PS C:\&gt; &nbsp; &nbsp; $Propagation = $Null 
PS C:\&gt; 
PS C:\&gt; &nbsp; &nbsp; # Type (Allow, Deny, or Audit) 
PS C:\&gt; &nbsp; &nbsp; $Type = &quot;Allow&quot; 
PS C:\&gt; 
PS C:\&gt; &nbsp; &nbsp; $Action = $Excel.Cells($RowNum, 5).ToLower() 
Method invocation failed because [System.__ComObject#{000208d5-0000-0000-c000-000000000046}] doesn't contain a method n 
amed 'Cells'. 
At line:1 char:27 
+ &nbsp; &nbsp; $Action = $Excel.Cells( &lt;&lt;&lt;&lt;&nbsp;$RowNum, 5).ToLower() 
PS C:\&gt; &nbsp; &nbsp; Switch ($Action.ToLower()) { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;&quot;add&quot; { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# Create the new access rule 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$Rule += New-Object System.Security.AccessControl.FileSystemAccessRule( ` 

</div>

<div>
 
Out of curiosity, do you even get this far? 
 
$Excel = New-Object -comobject Excel.Application 
$Excel.Workbooks.Open($ExcelFile) 
 
Chris
</div>

<div>
I am attaching the output 
<a href="https://filedb.experts-exchange.com/incoming/2009/03_w12/117362/result.txt" target="_blank" class="file-inline" title="results (6 KB)"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M67.508 468.467c-58.005-58.013-58.016-151.92 0-209.943l225.011-225.04c44.643-44.645 117.279-44.645 161.92 0 44.743 44.749 44.753 117.186 0 161.944l-189.465 189.49c-31.41 31.413-82.518 31.412-113.926.001-31.479-31.482-31.49-82.453 0-113.944L311.51 110.491c4.687-4.687 12.286-4.687 16.972 0l16.967 16.971c4.685 4.686 4.685 12.283 0 16.969L184.983 304.917c-12.724 12.724-12.73 33.328 0 46.058 12.696 12.697 33.356 12.699 46.054-.001l189.465-189.489c25.987-25.989 25.994-68.06.001-94.056-25.931-25.934-68.119-25.932-94.049 0l-225.01 225.039c-39.249 39.252-39.258 102.795-.001 142.057 39.285 39.29 102.885 39.287 142.162-.028A739446.174 739446.174 0 0 1 439.497 238.49c4.686-4.687 12.282-4.684 16.969.004l16.967 16.971c4.685 4.686 4.689 12.279.004 16.965a755654.128 755654.128 0 0 0-195.881 195.996c-58.034 58.092-152.004 58.093-210.048.041z"/></svg>result.txt</a>
</div>

result.txt

<div>
 
That's a lot better than mine, mine doesn't even like starting Excel. It's... frustrating... 
 
Chris
</div>

<div>
 
Right.. here we go again. 
 
This is the complete script. It works on mine, although it leaves an Excel process running despite my attempts to tell it to quit. 
 
The biggest change here is that we're directly editing the security rather than just creating a batch file. We might benefit from dropping the original SDDL string to a file in case we need to revert. I might have nightmares if that has to write back to Excel though ;) 
 
Chris 

<pre><code class="code-100 nolinks" id="code-276563">Function ReadPath($WorkSheet, $RowNum) {
 Trap [EXCEPTION] {
 # Ignoring the Exception
 Continue
 }
 $Path = &quot;&quot;; $Path = $WorkSheet.Cells.Item($RowNum, 1).FormulaLocal
 Return $Path
}
 
$ExcelFile = &quot;C:\Temp\Book1.xlsx&quot;
 
$Excel = New-Object -COM Excel.Application
$Culture = [System.Globalization.CultureInfo]'en-US'
 
$WorkBook = $Excel.Workbooks.PSBase.GetType().InvokeMember( `
 'Open', [Reflection.BindingFlags]::InvokeMethod, $Null, `
 $Excel.Workbooks, $ExcelFile, $Culture)
 
$WorkSheet = $WorkBook.WorkSheets.Item(1)
 
$RowNum = 0
$BlankPath = 0
While ($BlankPath -lt 2) {
 $Path = ReadPath $WorkSheet $RowNum
 
 If ($Path -eq &quot;&quot;) {
 
 $BlankPath++
 
 } else {
 
 $BlankPath = 0
 
 $User = $WorkSheet.Cells.Item($RowNum, 2).FormulaLocal
 
 # Get the Rights and make it into an AccessMask
 $Rights = ($WorkSheet.Cells.Item($RowNum, 6).FormulaLocal).ToUpper()
 
 $AccessMask = @()
 If ($Rights.Contains(&quot;R&quot;)) { $AccessMask += &quot;ReadAndExecute&quot; }
 If ($Rights.Contains(&quot;C&quot;)) { $AccessMask += &quot;Modify&quot; }
 If ($Rights.Contains(&quot;F&quot;)) { $AccessMask += &quot;FullControl&quot; }
 If ($Rights.Contains(&quot;P&quot;)) { $AccessMask += &quot;ChangePermissions&quot; }
 If ($Rights.Contains(&quot;O&quot;)) { $AccessMask += &quot;TakeOwnership&quot; }
 If ($Rights.Contains(&quot;X&quot;)) { $AccessMask += &quot;ExecuteFile&quot; }
 If ($Rights.Contains(&quot;E&quot;)) { $AccessMask += &quot;Read&quot; }
 If ($Rights.Contains(&quot;W&quot;)) { $AccessMask += &quot;Write&quot; }
 If ($Rights.Contains(&quot;D&quot;)) { $AccessMask += &quot;Delete&quot; }
 
 # Figure out if Inheritance is to be enabled for this Entry
 $Inheritance = ($WorkSheet.Cells.Item($RowNum, 8).FormulaLocal).ToLower()
 
 Switch ($Inheritance) {
 &quot;yes&quot; { $Inheritance = @(&quot;ObjectInherit&quot;, &quot;ContainerInherit&quot;) }
 &quot;no&quot; { $Inheritance = $Null }
 }
 
 # Not doing anything with Propagation...
 $Propagation = @(&quot;None&quot;)
 
 # Type (Allow, Deny, or Audit)
 $Type = &quot;Allow&quot;
 
 $Action = ($WorkSheet.Cells.Item($RowNum, 5).FormulaLocal).ToLower()
 Switch ($Action.ToLower()) {
 &quot;add&quot; {
 # Create the new access rule
 $Rule = New-Object System.Security.AccessControl.FileSystemAccessRule( `
 $User, $AccessMask, $Inheritance, $Propagation, $Type)
 
 $ACL = Get-ACL $Path
 $ACL.AddAccessRule($Rule)
 
 Write-Host &quot;Adding Access to $Path for $User&quot;
 Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot;
 
 Set-ACL $Path -aclObject $ACL
 }
 &quot;modify&quot; {
 $ACL = Get-ACL $Path
 
 # Get the existing Access Rule
 $Rule = $ACL.Access | ?{ $_.IdentityReference -match $User -And $_.IsInherited -eq $False }
 # Remove it from the ACL
 $ACL.RemoveAccessRuleSpecific($Rule)
 
 # Generate the new Rule and add it
 $Rule = New-Object System.Security.AccessControl.FileSystemAccessRule( `
 $User, $AccessMask, $Inheritance, $Propagation, $Type)
 $ACL.AddAccessRule($Rule)
 
 Write-Host &quot;Changing Access to $Path for $User&quot;
 Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot;
 
 Set-ACL $Path -aclObject $ACL
 
 }
 &quot;remove&quot; {
 
 # Get the existing Access Rule
 $Rule = $ACL.Access | ?{ $_.IdentityReference -match $User -And $_.IsInherited -eq $False }
 # Remove it from the ACL
 $ACL.RemoveAccessRuleSpecific($Rule)
 
 Write-Host &quot;Remove Access to $Path for $User&quot;
 Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot;
 
 Set-ACL $Path -aclObject $ACL
 }
 }
 }
 $RowNum++
}
 
[Void]$Excel.Workbooks.PSBase.GetType().InvokeMember( `
 'Close', [Reflection.BindingFlags]::InvokeMethod, $Null, `
 $Excel.Workbooks, $Null, $Culture)
$Excel.Quit()
</code></pre>
</div>

<div>
What do I put into the inheritance box for this? 

</div>

<div>
 
Yes or No :) Although we can change that to something else if you want? 
 
Chris
</div>

<div>
no i am ok with that. 
will this create teh bat file for me to view before? or will it just change the permissions 

</div>

<div>
 
Changes the permissions immediately, the unfortunate side-effect of moving away from xcacls.exe. 
 
There is a way to do it that moves back to the &quot;just create a file&quot; approach, but it may not be all that useful as we would have to use an SDDL string (or end up repeating this task with a new format) which isn't exactly easy to verify by sight. 
 
If you want to see an SDDL string, run this in PowerShell: 
 
(Get-ACL -Path &quot;C:\&quot;).SDDL 
 
Chris
</div>

<div>
 
&gt;&gt;&nbsp;} 
&gt;&gt;&nbsp; 
Exception calling &quot;RemoveAccessRuleSpecific&quot; with &quot;1&quot; argument(s): &quot;Value cannot be null. 
Parameter name: rule&quot; 
At line:47 char:38 
+ &nbsp; &nbsp; &nbsp; &nbsp; $ACL.RemoveAccessRuleSpecific( &lt;&lt;&lt;&lt;&nbsp;$Rule) 
New-Object : Cannot convert argument &quot;2&quot;, with value: &quot;&quot;, for &quot;.ctor&quot; to type &quot;System.Security.AccessControl.Inheritanc 
eFlags&quot;: &quot;Cannot convert null to type &quot;System.Security.AccessControl.InheritanceFlags&quot; due to invalid enumeration value 
s. Specify one of the following enumeration values and try again. The possible enumeration values are &quot;None, ContainerI 
nherit, ObjectInherit&quot;.&quot; 
At line:49 char:27 
+ &nbsp; &nbsp; &nbsp; &nbsp; $Rule = New-Object &nbsp;&lt;&lt;&lt;&lt; System.Security.AccessControl.FileSystemAccessRule( ` 
Exception calling &quot;AddAccessRule&quot; with &quot;1&quot; argument(s): &quot;Value cannot be null. 
Parameter name: rule&quot; 
At line:51 char:27 
+ &nbsp; &nbsp; &nbsp; &nbsp; $ACL.AddAccessRule( &lt;&lt;&lt;&lt;&nbsp;$Rule) 
Changing Access to C:\ for Everyone 
New Security: 

</div>

<div>
 
Okay, so... 
 
The first was caused by it failing to find a valid rule to remove. The second error caused the third. Which was the result of a failure to figure out the status of Inheritance. 
 
So... lets see if we can have it be a bit more careful there. 
 
I've changed it so it will only attempt to modify / remove if it finds the original rule to remove (or change). It'll tell us about it if it does bump into that situation. 
 
And I've changed the default value for Inheritance to &quot;yes&quot;, so if it doesn't find what it expects for that in the spread sheet it will use that default. 
 
Chris 

<pre><code class="code-100 nolinks" id="code-278905">Function ReadPath($WorkSheet, $RowNum) {
 Trap [EXCEPTION] {
 # Ignoring the Exception
 Continue
 }
 $Path = &quot;&quot;; $Path = $WorkSheet.Cells.Item($RowNum, 1).FormulaLocal
 Return $Path
}
 
$ExcelFile = &quot;C:\Temp\Book1.xlsx&quot;
 
$Excel = New-Object -COM Excel.Application
$Culture = [System.Globalization.CultureInfo]'en-US'
 
$WorkBook = $Excel.Workbooks.PSBase.GetType().InvokeMember( `
 'Open', [Reflection.BindingFlags]::InvokeMethod, $Null, `
 $Excel.Workbooks, $ExcelFile, $Culture)
 
$WorkSheet = $WorkBook.WorkSheets.Item(1)
 
$RowNum = 0
$BlankPath = 0
While ($BlankPath -lt 2) {
 $Path = ReadPath $WorkSheet $RowNum
 
 If ($Path -eq &quot;&quot;) {
 
 $BlankPath++
 
 } else {
 
 $BlankPath = 0
 
 $User = $WorkSheet.Cells.Item($RowNum, 2).FormulaLocal
 
 # Get the Rights and make it into an AccessMask
 $Rights = ($WorkSheet.Cells.Item($RowNum, 6).FormulaLocal).ToUpper()
 
 $AccessMask = @()
 If ($Rights.Contains(&quot;R&quot;)) { $AccessMask += &quot;ReadAndExecute&quot; }
 If ($Rights.Contains(&quot;C&quot;)) { $AccessMask += &quot;Modify&quot; }
 If ($Rights.Contains(&quot;F&quot;)) { $AccessMask += &quot;FullControl&quot; }
 If ($Rights.Contains(&quot;P&quot;)) { $AccessMask += &quot;ChangePermissions&quot; }
 If ($Rights.Contains(&quot;O&quot;)) { $AccessMask += &quot;TakeOwnership&quot; }
 If ($Rights.Contains(&quot;X&quot;)) { $AccessMask += &quot;ExecuteFile&quot; }
 If ($Rights.Contains(&quot;E&quot;)) { $AccessMask += &quot;Read&quot; }
 If ($Rights.Contains(&quot;W&quot;)) { $AccessMask += &quot;Write&quot; }
 If ($Rights.Contains(&quot;D&quot;)) { $AccessMask += &quot;Delete&quot; }
 
 # Figure out if Inheritance is to be enabled for this Entry
 $Inheritance = ($WorkSheet.Cells.Item($RowNum, 8).FormulaLocal).ToLower()
 
 Switch ($Inheritance) {
 &quot;no&quot; { $Inheritance = $Null }
 default { $Inheritance = @(&quot;ObjectInherit&quot;, &quot;ContainerInherit&quot;) }
 }
 
 # Not doing anything with Propagation...
 $Propagation = @(&quot;None&quot;)
 
 # Type (Allow, Deny, or Audit)
 $Type = &quot;Allow&quot;
 
 $Action = ($WorkSheet.Cells.Item($RowNum, 5).FormulaLocal).ToLower()
 Switch ($Action.ToLower()) {
 &quot;add&quot; {
 # Create the new access rule
 $Rule = New-Object System.Security.AccessControl.FileSystemAccessRule( `
 $User, $AccessMask, $Inheritance, $Propagation, $Type)
 
 $ACL = Get-ACL $Path
 $ACL.AddAccessRule($Rule)
 
 Write-Host &quot;Adding Access to $Path for $User&quot;
 Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot;
 
 Set-ACL $Path -aclObject $ACL
 }
 &quot;modify&quot; {
 $ACL = Get-ACL $Path
 
 # Get the existing Access Rule
 $Rule = $ACL.Access | ?{ $_.IdentityReference -match $User -And $_.IsInherited -eq $False }
 If ($Rule) {
 # Remove it from the ACL
 $ACL.RemoveAccessRuleSpecific($Rule)
 
 # Generate the new Rule and add it
 $Rule = New-Object System.Security.AccessControl.FileSystemAccessRule( `
 $User, $AccessMask, $Inheritance, $Propagation, $Type)
 $ACL.AddAccessRule($Rule)
 
 Write-Host &quot;Changing Access to $Path for $User&quot;
 Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot;
 
 Set-ACL $Path -aclObject $ACL
 } else {
 Write-Host &quot;Failed to $Action Access to $Path for $User&quot;
 Write-Host &quot;Failed to find existing rule to modify&quot;
 }
 
 }
 &quot;remove&quot; {
 
 # Get the existing Access Rule
 $Rule = $ACL.Access | ?{ $_.IdentityReference -match $User -And $_.IsInherited -eq $False }
 If ($Rule) {
 # Remove it from the ACL
 $ACL.RemoveAccessRuleSpecific($Rule)
 
 Write-Host &quot;Remove Access to $Path for $User&quot;
 Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot;
 
 Set-ACL $Path -aclObject $ACL
 } else {
 Write-Host &quot;Failed to $Action Access to $Path for $User&quot;
 Write-Host &quot;Failed to find existing rule to remove&quot;
 }
 
 }
 }
 }
 $RowNum++
}
 
[Void]$Excel.Workbooks.PSBase.GetType().InvokeMember( `
 'Close', [Reflection.BindingFlags]::InvokeMethod, $Null, `
 $Excel.Workbooks, $Null, $Culture)
$Excel.Quit()
</code></pre>
</div>

<div>
not adding in a user 
&nbsp; 
&gt;&gt;&nbsp; &nbsp;$RowNum++ 
&gt;&gt;&nbsp;} 
&gt;&gt; 
New-Object : Cannot convert argument &quot;2&quot;, with value: &quot;&quot;, for &quot;.ctor&quot; to type &quot;System.Security.AccessControl.Inheritanc 
eFlags&quot;: &quot;Cannot convert null to type &quot;System.Security.AccessControl.InheritanceFlags&quot; due to invalid enumeration value 
s. Specify one of the following enumeration values and try again. The possible enumeration values are &quot;None, ContainerI 
nherit, ObjectInherit&quot;.&quot; 
At line:34 char:27 
+ &nbsp; &nbsp; &nbsp; &nbsp; $Rule = New-Object &nbsp;&lt;&lt;&lt;&lt; System.Security.AccessControl.FileSystemAccessRule( ` 
Exception calling &quot;AddAccessRule&quot; with &quot;1&quot; argument(s): &quot;Value cannot be null. 
Parameter name: rule&quot; 
At line:37 char:27 
+ &nbsp; &nbsp; &nbsp; &nbsp; $ACL.AddAccessRule( &lt;&lt;&lt;&lt;&nbsp;$Rule) 

</div>

<div>
When I try to change from rx to F 
&nbsp; 
&gt;&gt; 
The '-match' operator failed: parsing &quot;workstation\Users &nbsp; &nbsp; &nbsp; &nbsp; &quot;&nbsp;- Unrecognized escape sequence \U.. 
At line:45 char:61 
+ &nbsp; &nbsp; &nbsp; &nbsp; $Rule = $ACL.Access | ?{ $_.IdentityReference -match &nbsp;&lt;&lt;&lt;&lt; $User -And $_.IsInherited -eq $False } 
The '-match' operator failed: parsing &quot;workstation\Users &nbsp; &nbsp; &nbsp; &nbsp; &quot;&nbsp;- Unrecognized escape sequence \U.. 
At line:45 char:61 
+ &nbsp; &nbsp; &nbsp; &nbsp; $Rule = $ACL.Access | ?{ $_.IdentityReference -match &nbsp;&lt;&lt;&lt;&lt; $User -And $_.IsInherited -eq $False } 
The '-match' operator failed: parsing &quot;workstation\Users &nbsp; &nbsp; &nbsp; &nbsp; &quot;&nbsp;- Unrecognized escape sequence \U.. 
At line:45 char:61 
+ &nbsp; &nbsp; &nbsp; &nbsp; $Rule = $ACL.Access | ?{ $_.IdentityReference -match &nbsp;&lt;&lt;&lt;&lt; $User -And $_.IsInherited -eq $False } 
The '-match' operator failed: parsing &quot;workstation\Users &nbsp; &nbsp; &nbsp; &nbsp; &quot;&nbsp;- Unrecognized escape sequence \U.. 
At line:45 char:61 
+ &nbsp; &nbsp; &nbsp; &nbsp; $Rule = $ACL.Access | ?{ $_.IdentityReference -match &nbsp;&lt;&lt;&lt;&lt; $User -And $_.IsInherited -eq $False } 
The '-match' operator failed: parsing &quot;workstation\Users &nbsp; &nbsp; &nbsp; &nbsp; &quot;&nbsp;- Unrecognized escape sequence \U.. 
At line:45 char:61 
+ &nbsp; &nbsp; &nbsp; &nbsp; $Rule = $ACL.Access | ?{ $_.IdentityReference -match &nbsp;&lt;&lt;&lt;&lt; $User -And $_.IsInherited -eq $False } 
The '-match' operator failed: parsing &quot;workstation\Users &nbsp; &nbsp; &nbsp; &nbsp; &quot;&nbsp;- Unrecognized escape sequence \U.. 
At line:45 char:61 
+ &nbsp; &nbsp; &nbsp; &nbsp; $Rule = $ACL.Access | ?{ $_.IdentityReference -match &nbsp;&lt;&lt;&lt;&lt; $User -And $_.IsInherited -eq $False } 
The '-match' operator failed: parsing &quot;workstation\Users &nbsp; &nbsp; &nbsp; &nbsp; &quot;&nbsp;- Unrecognized escape sequence \U.. 
At line:45 char:61 
+ &nbsp; &nbsp; &nbsp; &nbsp; $Rule = $ACL.Access | ?{ $_.IdentityReference -match &nbsp;&lt;&lt;&lt;&lt; $User -And $_.IsInherited -eq $False } 
The '-match' operator failed: parsing &quot;workstation\Users &nbsp; &nbsp; &nbsp; &nbsp; &quot;&nbsp;- Unrecognized escape sequence \U.. 
At line:45 char:61 
+ &nbsp; &nbsp; &nbsp; &nbsp; $Rule = $ACL.Access | ?{ $_.IdentityReference -match &nbsp;&lt;&lt;&lt;&lt; $User -And $_.IsInherited -eq $False } 
The '-match' operator failed: parsing &quot;workstation\Users &nbsp; &nbsp; &nbsp; &nbsp; &quot;&nbsp;- Unrecognized escape sequence \U.. 
At line:45 char:61 
+ &nbsp; &nbsp; &nbsp; &nbsp; $Rule = $ACL.Access | ?{ $_.IdentityReference -match &nbsp;&lt;&lt;&lt;&lt; $User -And $_.IsInherited -eq $False } 
The '-match' operator failed: parsing &quot;workstation\Users &nbsp; &nbsp; &nbsp; &nbsp; &quot;&nbsp;- Unrecognized escape sequence \U.. 
At line:45 char:61 
+ &nbsp; &nbsp; &nbsp; &nbsp; $Rule = $ACL.Access | ?{ $_.IdentityReference -match &nbsp;&lt;&lt;&lt;&lt; $User -And $_.IsInherited -eq $False } 
Failed to modify Access to \\workstation\c$\2007office\ for workstation\Users 
Failed to find existing rule to modify 
PS C:\&gt; [Void]$Excel.Workbooks.PSBase.GetType().InvokeMember( ` 
&gt;&gt;&nbsp; 'Close', [Reflection.BindingFlags]::InvokeMethod, $Null, ` 
&gt;&gt;&nbsp; $Excel.Workbooks, $Null, $Culture) 
&gt;&gt;&nbsp;$Excel.Quit() 

</div>

<div>
 
Another fix for the Inheritance option and a fix for the escape sequence message. 
 
I think we might run into problems with &quot;workstation\users&quot;. The security principal name is BUILTIN\Users rather than workstation\. And it's difficult to figure out which right to replace when there's more than one for the same security principal in the list. 
 
Chris 

<pre><code class="code-100 nolinks" id="code-279696">Function ReadPath($WorkSheet, $RowNum) {
 Trap [EXCEPTION] {
 # Ignoring the Exception
 Continue
 }
 $Path = &quot;&quot;; $Path = $WorkSheet.Cells.Item($RowNum, 1).FormulaLocal
 Return $Path
}
 
$ExcelFile = &quot;C:\Temp\Book1.xlsx&quot;
 
$Excel = New-Object -COM Excel.Application
$Culture = [System.Globalization.CultureInfo]'en-US'
 
$WorkBook = $Excel.Workbooks.PSBase.GetType().InvokeMember( `
 'Open', [Reflection.BindingFlags]::InvokeMethod, $Null, `
 $Excel.Workbooks, $ExcelFile, $Culture)
 
$WorkSheet = $WorkBook.WorkSheets.Item(1)
 
$RowNum = 0
$BlankPath = 0
While ($BlankPath -lt 2) {
 $Path = ReadPath $WorkSheet $RowNum
 
 If ($Path -eq &quot;&quot;) {
 
 $BlankPath++
 
 } else {
 
 $BlankPath = 0
 
 $User = $WorkSheet.Cells.Item($RowNum, 2).FormulaLocal
 
 # Get the Rights and make it into an AccessMask
 $Rights = ($WorkSheet.Cells.Item($RowNum, 6).FormulaLocal).ToUpper()
 
 $AccessMask = @()
 If ($Rights.Contains(&quot;R&quot;)) { $AccessMask += &quot;ReadAndExecute&quot; }
 If ($Rights.Contains(&quot;C&quot;)) { $AccessMask += &quot;Modify&quot; }
 If ($Rights.Contains(&quot;F&quot;)) { $AccessMask += &quot;FullControl&quot; }
 If ($Rights.Contains(&quot;P&quot;)) { $AccessMask += &quot;ChangePermissions&quot; }
 If ($Rights.Contains(&quot;O&quot;)) { $AccessMask += &quot;TakeOwnership&quot; }
 If ($Rights.Contains(&quot;X&quot;)) { $AccessMask += &quot;ExecuteFile&quot; }
 If ($Rights.Contains(&quot;E&quot;)) { $AccessMask += &quot;Read&quot; }
 If ($Rights.Contains(&quot;W&quot;)) { $AccessMask += &quot;Write&quot; }
 If ($Rights.Contains(&quot;D&quot;)) { $AccessMask += &quot;Delete&quot; }
 
 # Figure out if Inheritance is to be enabled for this Entry
 $Inheritance = ($WorkSheet.Cells.Item($RowNum, 8).FormulaLocal).ToLower()
 
 Switch ($Inheritance) {
 &quot;no&quot; { $Inheritance = @(&quot;None&quot;) }
 default { $Inheritance = @(&quot;ObjectInherit&quot;, &quot;ContainerInherit&quot;) }
 }
 
 # Not doing anything with Propagation...
 $Propagation = @(&quot;None&quot;)
 
 # Type (Allow, Deny, or Audit)
 $Type = &quot;Allow&quot;
 
 $Action = ($WorkSheet.Cells.Item($RowNum, 5).FormulaLocal).ToLower()
 Switch ($Action.ToLower()) {
 &quot;add&quot; {
 # Create the new access rule
 $Rule = New-Object System.Security.AccessControl.FileSystemAccessRule( `
 $User, $AccessMask, $Inheritance, $Propagation, $Type)
 
 $ACL = Get-ACL $Path
 $ACL.AddAccessRule($Rule)
 
 Write-Host &quot;Adding Access to $Path for $User&quot;
 Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot;
 
 Set-ACL $Path -aclObject $ACL
 }
 &quot;modify&quot; {
 $ACL = Get-ACL $Path
 
 # Get the existing Access Rule
 $Rule = $ACL.Access | `
 ?{ $_.IdentityReference -match ($User -Replace &quot;\\&quot;, &quot;\\&quot;) `
 -And $_.IsInherited -eq $False }
 If ($Rule) {
 # Remove it from the ACL
 $ACL.RemoveAccessRuleSpecific($Rule)
 
 # Generate the new Rule and add it
 $Rule = New-Object System.Security.AccessControl.FileSystemAccessRule( `
 $User, $AccessMask, $Inheritance, $Propagation, $Type)
 $ACL.AddAccessRule($Rule)
 
 Write-Host &quot;Changing Access to $Path for $User&quot;
 Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot;
 
 Set-ACL $Path -aclObject $ACL
 } else {
 Write-Host &quot;Failed to $Action Access to $Path for $User&quot;
 Write-Host &quot;Failed to find existing rule to modify&quot;
 }
 
 }
 &quot;remove&quot; {
 
 # Get the existing Access Rule
 $Rule = $ACL.Access | `
 ?{ $_.IdentityReference -match ($User -Replace &quot;\\&quot;, &quot;\\&quot;) `
 -And $_.IsInherited -eq $False }
 If ($Rule) {
 # Remove it from the ACL
 $ACL.RemoveAccessRuleSpecific($Rule)
 
 Write-Host &quot;Remove Access to $Path for $User&quot;
 Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot;
 
 Set-ACL $Path -aclObject $ACL
 } else {
 Write-Host &quot;Failed to $Action Access to $Path for $User&quot;
 Write-Host &quot;Failed to find existing rule to remove&quot;
 }
 
 }
 }
 }
 $RowNum++
}
 
[Void]$Excel.Workbooks.PSBase.GetType().InvokeMember( `
 'Close', [Reflection.BindingFlags]::InvokeMethod, $Null, `
 $Excel.Workbooks, $Null, $Culture)
$Excel.Quit()
</code></pre>
</div>

<div>
Failed to modify Access to <a href="http://file://\\workstattionc$\2007office\" rel="ugc nofollow">\\workstattionc$\2007office\</a> for workstation\Users 
Failed to find existing rule to modify
</div>

<div>
 
Yeah, I thought that would happen. It's because Users is &quot;BUILTIN\Users&quot; rather than &quot;workstation\Users&quot;. Can you replace it on the spreadsheet and see if it works with that? 
 
Chris
</div>

<div>
Still no go 
&nbsp; 
&gt;&gt;&nbsp; &nbsp;$Path = ReadPath $WorkSheet $RowNum 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp;If ($Path -eq &quot;&quot;) { 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;$BlankPath++ 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp;} else { 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;$BlankPath = 0 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;$User = $WorkSheet.Cells.Item($RowNum, 2).FormulaLocal 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;# Get the Rights and make it into an AccessMask 
&gt;&gt;&nbsp; &nbsp; &nbsp;$Rights = ($WorkSheet.Cells.Item($RowNum, 6).FormulaLocal).ToUpper() 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;$AccessMask = @() 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;R&quot;)) { $AccessMask += &quot;ReadAndExecute&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;C&quot;)) { $AccessMask += &quot;Modify&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;F&quot;)) { $AccessMask += &quot;FullControl&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;P&quot;)) { $AccessMask += &quot;ChangePermissions&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;O&quot;)) { $AccessMask += &quot;TakeOwnership&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;X&quot;)) { $AccessMask += &quot;ExecuteFile&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;E&quot;)) { $AccessMask += &quot;Read&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;W&quot;)) { $AccessMask += &quot;Write&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;D&quot;)) { $AccessMask += &quot;Delete&quot; } 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;# Figure out if Inheritance is to be enabled for this Entry 
&gt;&gt;&nbsp; &nbsp; &nbsp;$Inheritance = ($WorkSheet.Cells.Item($RowNum, 8).FormulaLocal).ToLower() 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;Switch ($Inheritance) { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;&quot;no&quot; &nbsp;{ $Inheritance = @(&quot;None&quot;) } 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;default { $Inheritance = @(&quot;ObjectInherit&quot;, &quot;ContainerInherit&quot;) } 
&gt;&gt;&nbsp; &nbsp; &nbsp;} 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;# Not doing anything with Propagation... 
&gt;&gt;&nbsp; &nbsp; &nbsp;$Propagation = @(&quot;None&quot;) 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;# Type (Allow, Deny, or Audit) 
&gt;&gt;&nbsp; &nbsp; &nbsp;$Type = &quot;Allow&quot; 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;$Action = ($WorkSheet.Cells.Item($RowNum, 5).FormulaLocal).ToLower() 
&gt;&gt;&nbsp; &nbsp; &nbsp;Switch ($Action.ToLower()) { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;&quot;add&quot; { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# Create the new access rule 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$Rule = New-Object System.Security.AccessControl.FileSystemAccessRule( ` 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$User, $AccessMask, $Inheritance, $Propagation, $Type) 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$ACL = Get-ACL $Path 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$ACL.AddAccessRule($Rule) 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;Adding Access to $Path for $User&quot; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot; 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Set-ACL $Path -aclObject $ACL 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;} 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;&quot;modify&quot; { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$ACL = Get-ACL $Path 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# Get the existing Access Rule 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$Rule = $ACL.Access | ` 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;?{ $_.IdentityReference -match ($User -Replace &quot;\\&quot;, &quot;\\&quot;) ` 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;-And $_.IsInherited -eq $False } 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;If ($Rule) { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# Remove it from the ACL 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$ACL.RemoveAccessRuleSpecific($Rule) 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# Generate the new Rule and add it 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$Rule = New-Object System.Security.AccessControl.FileSystemAccessRule( ` 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$User, $AccessMask, $Inheritance, $Propagation, $Type) 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$ACL.AddAccessRule($Rule) 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;Changing Access to $Path for $User&quot; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot; 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Set-ACL $Path -aclObject $ACL 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;} else { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;Failed to $Action Access to $Path for $User&quot; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;Failed to find existing rule to modify&quot; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;} 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;} 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;&quot;remove&quot; { 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# Get the existing Access Rule 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$Rule = $ACL.Access | ` 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;?{ $_.IdentityReference -match ($User -Replace &quot;\\&quot;, &quot;\\&quot;) ` 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;-And $_.IsInherited -eq $False } 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;If ($Rule) { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# Remove it from the ACL 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$ACL.RemoveAccessRuleSpecific($Rule) 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;Remove Access to $Path for $User&quot; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot; 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Set-ACL $Path -aclObject $ACL 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;} else { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;Failed to $Action Access to $Path for $User&quot; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;Failed to find existing rule to remove&quot; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;} 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;} 
&gt;&gt;&nbsp; &nbsp; &nbsp;} 
&gt;&gt;&nbsp; &nbsp;} 
&gt;&gt;&nbsp; &nbsp;$RowNum++ 
&gt;&gt;&nbsp;} 
&gt;&gt; 
Failed to modify Access to \\workstation\c$\2007office\ for Builtin\Users 
Failed to find existing rule to modify 
PS C:\&gt; [Void]$Excel.Workbooks.PSBase.GetType().InvokeMember( ` 
&gt;&gt;&nbsp; 'Close', [Reflection.BindingFlags]::InvokeMethod, $Null, ` 
&gt;&gt;&nbsp; $Excel.Workbooks, $Null, $Culture) 
&gt;&gt;&nbsp;$Excel.Quit() 

</div>

<div>
Chis 
you were helping me on another thread for local admin listing 
any chance you can take a look at that thread again...have some related question 
&nbsp;<a href="https://www.experts-exchange.com/questions/23969323/scan-script-servers-to-list-all-users-in-local-group-Active-Directory.html" rel="ugc">https://www.experts-exchange.com/questions/23969323/scan-script-servers-to-list-all-users-in-local-group-Active-Directory.html</a> 

</div>

<div>
 
For the path in question, can you run: 
 
$ACL = Get-ACL &quot;\\workstation\c$\2007office\&quot; 
 
Then: 
 
$User = &quot;Builtin\Users&quot; 
$ACL.Access | ?{ $_.IdentityReference -match ($User -Replace &quot;\\&quot;, &quot;\\&quot;) ` 
&nbsp; -And $_.IsInherited -eq $False } 
 
If that doesn't return anything, run: 
 
$ACL.Access | ?{ $_.IdentityReference -match ($User -Replace &quot;\\&quot;, &quot;\\&quot;) } 
 
Could you let me know which, if either, returns a match? 
 
Chris
</div>

<div>
Chris, 
How do I do this? first run the whole script then just add this in? 
&nbsp; 
BTW thanks for coming back :) 

</div>

<div>
 
Nope, just as separate commands in PowerShell, they'll run without the rest of the script :) 
 
Chris
</div>

<div>
The second one returns: 
 
 
FileSystemRights &nbsp;: ReadAndExecute, Synchronize 
AccessControlType : Allow 
IdentityReference : BUILTIN\Users 
IsInherited &nbsp; &nbsp; &nbsp; : True 
InheritanceFlags &nbsp;: None 
PropagationFlags &nbsp;: None 
FileSystemRights &nbsp;: -1610612736 
AccessControlType : Allow 
IdentityReference : BUILTIN\Users 
IsInherited &nbsp; &nbsp; &nbsp; : True 
InheritanceFlags &nbsp;: ContainerInherit, ObjectInherit 
PropagationFlags &nbsp;: InheritOnly 
FileSystemRights &nbsp;: AppendData 
AccessControlType : Allow 
IdentityReference : BUILTIN\Users 
IsInherited &nbsp; &nbsp; &nbsp; : True 
InheritanceFlags &nbsp;: ContainerInherit 
PropagationFlags &nbsp;: None 
FileSystemRights &nbsp;: CreateFiles 
AccessControlType : Allow 
IdentityReference : BUILTIN\Users 
IsInherited &nbsp; &nbsp; &nbsp; : True 
InheritanceFlags &nbsp;: ContainerInherit 
PropagationFlags &nbsp;: None 
&nbsp; 

</div>

<div>
 
Then that explains why we couldn't change it. All are inherited from the parent and cannot be modified on the current object. 
 
Dealing with things like that would involve blocking inheritance on the current folder, copying the ACL from the parent then modifying it. Which is rather more involved than we've done so far. 
 
Do you really want to block inheritance at that point and apply a new ACL? 
 
Chris
</div>

<div>
I really would like to 

</div>

<div>
 
Hmm okay, was that what you were expecting with the inheritance field we made? Just wonder if I'd misunderstood what you wanted by that one. 
 
Chris
</div>

<div>
 
Okay, well I can change the behaviour so it protects the ACL in each case, copying security from the parent. 
 
Pretty busy today unfortunately (generating lots of statistics for my mail server and migrating file servers) so it probably won't be until next week. I hope that's okay. 
 
Chris
</div>

<div>
Thats great 
u are the best 

</div>

<div>
 
Right, disabling inheritance from parent. 
 
Do you want that to happen for all of the changes we're making? Or only modify and remove? 
 
Chris
</div>

<div>
Chris, 
Did you have an oppertunity to look into this? 

</div>

<div>
 
I'll finish it off, I just hadn't had time to fully debug the code for it yet. 
 
Chris
</div>

<div>
Thanks 
&nbsp; 
&nbsp; 

</div>

<div>
Chris 
&nbsp; 
any chance you have had time to take a look at this 

</div>

<div>
 
Sorry for the delay with this. 
 
This update disables Inheritance on the folder it deals with and copies the existing ACL. Then it goes and makes the changes as before. 
 
Hopefully it works a bit better... 
 
Chris 

<pre><code class="code-100 nolinks" id="code-312293">Function ReadPath($WorkSheet, $RowNum) {
 Trap [EXCEPTION] {
 # Ignoring the Exception
 Continue
 }
 $Path = &quot;&quot;; $Path = $WorkSheet.Cells.Item($RowNum, 1).FormulaLocal
 Return $Path
}
 
$ExcelFile = &quot;C:\Temp\Book1.xlsx&quot;
 
$Excel = New-Object -COM Excel.Application
$Culture = [System.Globalization.CultureInfo]'en-US'
 
$WorkBook = $Excel.Workbooks.PSBase.GetType().InvokeMember( `
 'Open', [Reflection.BindingFlags]::InvokeMethod, $Null, `
 $Excel.Workbooks, $ExcelFile, $Culture)
 
$WorkSheet = $WorkBook.WorkSheets.Item(1)
 
$RowNum = 0
$BlankPath = 0
While ($BlankPath -lt 2) {
 $Path = ReadPath $WorkSheet $RowNum
 
 If ($Path -eq &quot;&quot;) {
 
 $BlankPath++
 
 } else {
 
 $BlankPath = 0
 
 $User = $WorkSheet.Cells.Item($RowNum, 2).FormulaLocal
 
 # Get the Rights and make it into an AccessMask
 $Rights = ($WorkSheet.Cells.Item($RowNum, 6).FormulaLocal).ToUpper()
 
 $AccessMask = @()
 If ($Rights.Contains(&quot;R&quot;)) { $AccessMask += &quot;ReadAndExecute&quot; }
 If ($Rights.Contains(&quot;C&quot;)) { $AccessMask += &quot;Modify&quot; }
 If ($Rights.Contains(&quot;F&quot;)) { $AccessMask += &quot;FullControl&quot; }
 If ($Rights.Contains(&quot;P&quot;)) { $AccessMask += &quot;ChangePermissions&quot; }
 If ($Rights.Contains(&quot;O&quot;)) { $AccessMask += &quot;TakeOwnership&quot; }
 If ($Rights.Contains(&quot;X&quot;)) { $AccessMask += &quot;ExecuteFile&quot; }
 If ($Rights.Contains(&quot;E&quot;)) { $AccessMask += &quot;Read&quot; }
 If ($Rights.Contains(&quot;W&quot;)) { $AccessMask += &quot;Write&quot; }
 If ($Rights.Contains(&quot;D&quot;)) { $AccessMask += &quot;Delete&quot; }
 
 # Figure out if Inheritance is to be enabled for this Entry
 $Inheritance = ($WorkSheet.Cells.Item($RowNum, 8).FormulaLocal).ToLower()
 
 Switch ($Inheritance) {
 &quot;no&quot; { $Inheritance = @(&quot;None&quot;) }
 default { $Inheritance = @(&quot;ObjectInherit&quot;, &quot;ContainerInherit&quot;) }
 }
 
 # Not doing anything with Propagation...
 $Propagation = @(&quot;None&quot;)
 
 # Type (Allow, Deny, or Audit)
 $Type = &quot;Allow&quot;
 
 $Action = ($WorkSheet.Cells.Item($RowNum, 5).FormulaLocal).ToLower()
 If ($Action) { 
 # Disable Inheritance for this ACL
 $ACL = Get-ACL $Path
 $ACL.SetAccessRuleProtection($True, $True)
 Set-ACL $Path -aclObject $ACL
 
 $ACL = Get-ACL $Path
 }
 
 Switch ($Action.ToLower()) {
 &quot;add&quot; {
 # Create the new access rule
 $Rule = New-Object System.Security.AccessControl.FileSystemAccessRule( `
 $User, $AccessMask, $Inheritance, $Propagation, $Type)
 
 $ACL.AddAccessRule($Rule)
 
 Write-Host &quot;Adding Access to $Path for $User&quot;
 Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot;
 
 Set-ACL $Path -aclObject $ACL
 }
 &quot;modify&quot; {
 
 # Get the existing Access Rule
 $Rule = $ACL.Access | `
 ?{ $_.IdentityReference -match ($User -Replace &quot;\\&quot;, &quot;\\&quot;) `
 -And $_.IsInherited -eq $False }
 If ($Rule) {
 
 # Remove it from the ACL
 If ($Rule.Count &gt; 1) {
 $Rule | %{ $ACL.RemoveAccessRuleSpecific($_) }
 } else
 $ACL.RemoveAccessRuleSpecific($Rule)
 }
 
 # Generate the new Rule and add it
 $Rule = New-Object System.Security.AccessControl.FileSystemAccessRule( `
 $User, $AccessMask, $Inheritance, $Propagation, $Type)
 $ACL.AddAccessRule($Rule)
 
 Write-Host &quot;Changing Access to $Path for $User&quot;
 Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot;
 
 Set-ACL $Path -aclObject $ACL
 } else {
 Write-Host &quot;Failed to $Action Access to $Path for $User&quot;
 Write-Host &quot;Failed to find existing rule to modify&quot;
 }
 
 }
 &quot;remove&quot; {
 
 # Get the existing Access Rule
 $Rule = $ACL.Access | `
 ?{ $_.IdentityReference -match ($User -Replace &quot;\\&quot;, &quot;\\&quot;) `
 -And $_.IsInherited -eq $False }
 If ($Rule) {
 
 # Remove it from the ACL
 If ($Rule.Count &gt; 1) {
 $Rule | %{ $ACL.RemoveAccessRuleSpecific($_) }
 } else
 $ACL.RemoveAccessRuleSpecific($Rule)
 }
 
 Write-Host &quot;Remove Access to $Path for $User&quot;
 Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot;
 
 Set-ACL $Path -aclObject $ACL
 } else {
 Write-Host &quot;Failed to $Action Access to $Path for $User&quot;
 Write-Host &quot;Failed to find existing rule to remove&quot;
 }
 
 }
 }
 }
 $RowNum++
}
 
[Void]$Excel.Workbooks.PSBase.GetType().InvokeMember( `
 'Close', [Reflection.BindingFlags]::InvokeMethod, $Null, `
 $Excel.Workbooks, $Null, $Culture)
$Excel.Quit()
</code></pre>
</div>

<div>
getting errors 
&nbsp; 
 
Windows PowerShell 
Copyright (C) 2006 Microsoft Corporation. All rights reserved. 
PS F:\&gt; c: 
PS C:\&gt; Function ReadPath($WorkSheet, $RowNum) { 
&gt;&gt;&nbsp; &nbsp;Trap [EXCEPTION] { 
&gt;&gt;&nbsp; &nbsp; &nbsp;# Ignoring the Exception 
&gt;&gt;&nbsp; &nbsp; &nbsp;Continue 
&gt;&gt;&nbsp; &nbsp;} 
&gt;&gt;&nbsp; &nbsp;$Path = &quot;&quot;; $Path = $WorkSheet.Cells.Item($RowNum, 1).FormulaLocal 
&gt;&gt;&nbsp; &nbsp;Return $Path 
&gt;&gt;&nbsp;} 
&gt;&gt; 
PS C:\&gt; $ExcelFile = &quot;C:\test.xls&quot; 
PS C:\&gt; 
PS C:\&gt; $Excel = New-Object -COM Excel.Application 
PS C:\&gt; $Culture = [System.Globalization.CultureInfo]'en-US' 
PS C:\&gt; 
PS C:\&gt; $WorkBook = $Excel.Workbooks.PSBase.GetType().InvokeMember( ` 
&gt;&gt;&nbsp; &nbsp;'Open', [Reflection.BindingFlags]::InvokeMethod, $Null, ` 
&gt;&gt;&nbsp; &nbsp;$Excel.Workbooks, $ExcelFile, $Culture) 
&gt;&gt; 
PS C:\&gt; $WorkSheet = $WorkBook.WorkSheets.Item(1) 
PS C:\&gt; 
PS C:\&gt; $RowNum = 0 
PS C:\&gt; $BlankPath = 0 
PS C:\&gt; While ($BlankPath -lt 2) { 
&gt;&gt;&nbsp; &nbsp;$Path = ReadPath $WorkSheet $RowNum 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp;If ($Path -eq &quot;&quot;) { 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;$BlankPath++ 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp;} else { 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;$BlankPath = 0 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;$User = $WorkSheet.Cells.Item($RowNum, 2).FormulaLocal 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;# Get the Rights and make it into an AccessMask 
&gt;&gt;&nbsp; &nbsp; &nbsp;$Rights = ($WorkSheet.Cells.Item($RowNum, 6).FormulaLocal).ToUpper() 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;$AccessMask = @() 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;R&quot;)) { $AccessMask += &quot;ReadAndExecute&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;C&quot;)) { $AccessMask += &quot;Modify&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;F&quot;)) { $AccessMask += &quot;FullControl&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;P&quot;)) { $AccessMask += &quot;ChangePermissions&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;O&quot;)) { $AccessMask += &quot;TakeOwnership&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;X&quot;)) { $AccessMask += &quot;ExecuteFile&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;E&quot;)) { $AccessMask += &quot;Read&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;W&quot;)) { $AccessMask += &quot;Write&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;D&quot;)) { $AccessMask += &quot;Delete&quot; } 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;# Figure out if Inheritance is to be enabled for this Entry 
&gt;&gt;&nbsp; &nbsp; &nbsp;$Inheritance = ($WorkSheet.Cells.Item($RowNum, 8).FormulaLocal).ToLower() 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;Switch ($Inheritance) { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;&quot;no&quot; &nbsp;{ $Inheritance = @(&quot;None&quot;) } 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;default { $Inheritance = @(&quot;ObjectInherit&quot;, &quot;ContainerInherit&quot;) } 
&gt;&gt;&nbsp; &nbsp; &nbsp;} 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;# Not doing anything with Propagation... 
&gt;&gt;&nbsp; &nbsp; &nbsp;$Propagation = @(&quot;None&quot;) 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;# Type (Allow, Deny, or Audit) 
&gt;&gt;&nbsp; &nbsp; &nbsp;$Type = &quot;Allow&quot; 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;$Action = ($WorkSheet.Cells.Item($RowNum, 5).FormulaLocal).ToLower() 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Action) { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;# Disable Inheritance for this ACL 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;$ACL = Get-ACL $Path 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;$ACL.SetAccessRuleProtection($True, $True) 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;Set-ACL $Path -aclObject $ACL 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;$ACL = Get-ACL $Path 
&gt;&gt;&nbsp; &nbsp; &nbsp;} 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;Switch ($Action.ToLower()) { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;&quot;add&quot; { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# Create the new access rule 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$Rule = New-Object System.Security.AccessControl.FileSystemAccessRule( ` 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$User, $AccessMask, $Inheritance, $Propagation, $Type) 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$ACL.AddAccessRule($Rule) 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;Adding Access to $Path for $User&quot; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot; 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Set-ACL $Path -aclObject $ACL 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;} 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;&quot;modify&quot; { 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# Get the existing Access Rule 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$Rule = $ACL.Access | ` 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;?{ $_.IdentityReference -match ($User -Replace &quot;\\&quot;, &quot;\\&quot;) ` 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;-And $_.IsInherited -eq $False } 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;If ($Rule) { 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# Remove it from the ACL 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;If ($Rule.Count &gt;&nbsp;1) { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$Rule | %{ $ACL.RemoveAccessRuleSpecific($_) } 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;} else 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$ACL.RemoveAccessRuleSpecific($Rule) 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;} 
&gt;&gt; 
Missing statement block after 'else' keyword. 
At line:58 char:13 
+ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $ &lt;&lt;&lt;&lt;&nbsp;ACL.RemoveAccessRuleSpecific($Rule) 
PS C:\&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # Generate the new Rule and add it 
PS C:\&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $Rule = New-Object System.Security.AccessControl.FileSystemAccessRule( ` 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$User, $AccessMask, $Inheritance, $Propagation, $Type) 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$ACL.AddAccessRule($Rule) 
&gt;&gt; 
New-Object : Cannot convert argument &quot;1&quot;, with value: &quot;&quot;, for &quot;.ctor&quot; to type &quot;System.Security.AccessControl.FileSystem 
Rights&quot;: &quot;Cannot convert null to type &quot;System.Security.AccessControl.FileSystemRights&quot; due to invalid enumeration value 
s. Specify one of the following enumeration values and try again. The possible enumeration values are &quot;ListDirectory, R 
eadData, WriteData, CreateFiles, CreateDirectories, AppendData, ReadExtendedAttributes, WriteExtendedAttributes, Traver 
se, ExecuteFile, DeleteSubdirectoriesAndFiles, ReadAttributes, WriteAttributes, Write, Delete, ReadPermissions, Read, R 
eadAndExecute, Modify, ChangePermissions, TakeOwnership, Synchronize, FullControl&quot;.&quot; 
At line:1 char:29 
+ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $Rule = New-Object &nbsp;&lt;&lt;&lt;&lt; System.Security.AccessControl.FileSystemAccessRule( ` 
You cannot call a method on a null-valued expression. 
At line:3 char:29 
+ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $ACL.AddAccessRule( &lt;&lt;&lt;&lt;&nbsp;$Rule) 
PS C:\&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Write-Host &quot;Changing Access to $Path for $User&quot; 
Changing Access to &nbsp;for 
PS C:\&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot; 
New Security: 
&nbsp; 
PS C:\&gt; 
PS C:\&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Set-ACL $Path -aclObject $ACL 
Set-Acl : Cannot bind argument to parameter 'AclObject' because it is null. 
At line:1 char:35 
+ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Set-ACL $Path -aclObject &nbsp;&lt;&lt;&lt;&lt; $ACL 
PS C:\&gt; &nbsp; &nbsp; &nbsp; &nbsp; } else { 
Unexpected token '}' in expression or statement. 
At line:1 char:10 
+ &nbsp; &nbsp; &nbsp; &nbsp; } &nbsp;&lt;&lt;&lt;&lt; else { 
PS C:\&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Write-Host &quot;Failed to $Action Access to $Path for $User&quot; 
Failed to &nbsp;Access to &nbsp;for 
PS C:\&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Write-Host &quot;Failed to find existing rule to modify&quot; 
Failed to find existing rule to modify 
PS C:\&gt; &nbsp; &nbsp; &nbsp; &nbsp; } 
Unexpected token '}' in expression or statement. 
At line:1 char:9 
+ &nbsp; &nbsp; &nbsp; &nbsp; } &lt;&lt;&lt;&lt; 
PS C:\&gt; 
PS C:\&gt; &nbsp; &nbsp; &nbsp; } 
Unexpected token '}' in expression or statement. 
At line:1 char:7 
+ &nbsp; &nbsp; &nbsp; } &lt;&lt;&lt;&lt; 
PS C:\&gt; &nbsp; &nbsp; &nbsp; &quot;remove&quot; { 
Unexpected token '{' in expression or statement. 
At line:1 char:16 
+ &nbsp; &nbsp; &nbsp; &quot;remove&quot; { &lt;&lt;&lt;&lt; 
PS C:\&gt; 
PS C:\&gt; &nbsp; &nbsp; &nbsp; &nbsp; # Get the existing Access Rule 
PS C:\&gt; &nbsp; &nbsp; &nbsp; &nbsp; $Rule = $ACL.Access | ` 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;?{ $_.IdentityReference -match ($User -Replace &quot;\\&quot;, &quot;\\&quot;) ` 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;-And $_.IsInherited -eq $False } 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;If ($Rule) { 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# Remove it from the ACL 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;If ($Rule.Count &gt;&nbsp;1) { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$Rule | %{ $ACL.RemoveAccessRuleSpecific($_) } 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;} else 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$ACL.RemoveAccessRuleSpecific($Rule) 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;} 
&gt;&gt; 
Missing statement block after 'else' keyword. 
At line:9 char:13 
+ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $ &lt;&lt;&lt;&lt;&nbsp;ACL.RemoveAccessRuleSpecific($Rule) 
PS C:\&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Write-Host &quot;Remove Access to $Path for $User&quot; 
Remove Access to &nbsp;for 
PS C:\&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot; 
New Security: 
&nbsp; 
PS C:\&gt; 
PS C:\&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Set-ACL $Path -aclObject $ACL 
Set-Acl : Cannot bind argument to parameter 'AclObject' because it is null. 
At line:1 char:35 
+ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Set-ACL $Path -aclObject &nbsp;&lt;&lt;&lt;&lt; $ACL 
PS C:\&gt; &nbsp; &nbsp; &nbsp; &nbsp; } else { 
Unexpected token '}' in expression or statement. 
At line:1 char:10 
+ &nbsp; &nbsp; &nbsp; &nbsp; } &nbsp;&lt;&lt;&lt;&lt; else { 
PS C:\&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Write-Host &quot;Failed to $Action Access to $Path for $User&quot; 
Failed to &nbsp;Access to &nbsp;for 
PS C:\&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Write-Host &quot;Failed to find existing rule to remove&quot; 
Failed to find existing rule to remove 
PS C:\&gt; &nbsp; &nbsp; &nbsp; &nbsp; } 
Unexpected token '}' in expression or statement. 
At line:1 char:9 
+ &nbsp; &nbsp; &nbsp; &nbsp; } &lt;&lt;&lt;&lt; 
PS C:\&gt; 
PS C:\&gt; &nbsp; &nbsp; &nbsp; } 
Unexpected token '}' in expression or statement. 
At line:1 char:7 
+ &nbsp; &nbsp; &nbsp; } &lt;&lt;&lt;&lt; 
PS C:\&gt; &nbsp; &nbsp; } 
Unexpected token '}' in expression or statement. 
At line:1 char:5 
+ &nbsp; &nbsp; } &lt;&lt;&lt;&lt; 
PS C:\&gt; &nbsp; } 
Unexpected token '}' in expression or statement. 
At line:1 char:3 
+ &nbsp; } &lt;&lt;&lt;&lt; 
PS C:\&gt; &nbsp; $RowNum++ 
PS C:\&gt; } 
Unexpected token '}' in expression or statement. 
At line:1 char:1 
+ } &lt;&lt;&lt;&lt; 
PS C:\&gt; 
PS C:\&gt; [Void]$Excel.Workbooks.PSBase.GetType().InvokeMember( ` 
&gt;&gt;&nbsp; 'Close', [Reflection.BindingFlags]::InvokeMethod, $Null, ` 
&gt;&gt;&nbsp; $Excel.Workbooks, $Null, $Culture) 
&gt;&gt;&nbsp;$Excel.Quit() 
&gt;&gt;&nbsp; 

</div>

<div>
 
Oops... sorry... 
 
Chris 

<pre><code class="code-100 nolinks" id="code-312404">Function ReadPath($WorkSheet, $RowNum) {
 Trap [EXCEPTION] {
 # Ignoring the Exception
 Continue
 }
 $Path = &quot;&quot;; $Path = $WorkSheet.Cells.Item($RowNum, 1).FormulaLocal
 Return $Path
}
 
$ExcelFile = &quot;C:\Temp\Book1.xlsx&quot;
 
$Excel = New-Object -COM Excel.Application
$Culture = [System.Globalization.CultureInfo]'en-US'
 
$WorkBook = $Excel.Workbooks.PSBase.GetType().InvokeMember( `
 'Open', [Reflection.BindingFlags]::InvokeMethod, $Null, `
 $Excel.Workbooks, $ExcelFile, $Culture)
 
$WorkSheet = $WorkBook.WorkSheets.Item(1)
 
$RowNum = 0
$BlankPath = 0
While ($BlankPath -lt 2) {
 $Path = ReadPath $WorkSheet $RowNum
 
 If ($Path -eq &quot;&quot;) {
 
 $BlankPath++
 
 } else {
 
 $BlankPath = 0
 
 $User = $WorkSheet.Cells.Item($RowNum, 2).FormulaLocal
 
 # Get the Rights and make it into an AccessMask
 $Rights = ($WorkSheet.Cells.Item($RowNum, 6).FormulaLocal).ToUpper()
 
 $AccessMask = @()
 If ($Rights.Contains(&quot;R&quot;)) { $AccessMask += &quot;ReadAndExecute&quot; }
 If ($Rights.Contains(&quot;C&quot;)) { $AccessMask += &quot;Modify&quot; }
 If ($Rights.Contains(&quot;F&quot;)) { $AccessMask += &quot;FullControl&quot; }
 If ($Rights.Contains(&quot;P&quot;)) { $AccessMask += &quot;ChangePermissions&quot; }
 If ($Rights.Contains(&quot;O&quot;)) { $AccessMask += &quot;TakeOwnership&quot; }
 If ($Rights.Contains(&quot;X&quot;)) { $AccessMask += &quot;ExecuteFile&quot; }
 If ($Rights.Contains(&quot;E&quot;)) { $AccessMask += &quot;Read&quot; }
 If ($Rights.Contains(&quot;W&quot;)) { $AccessMask += &quot;Write&quot; }
 If ($Rights.Contains(&quot;D&quot;)) { $AccessMask += &quot;Delete&quot; }
 
 # Figure out if Inheritance is to be enabled for this Entry
 $Inheritance = ($WorkSheet.Cells.Item($RowNum, 8).FormulaLocal).ToLower()
 
 Switch ($Inheritance) {
 &quot;no&quot; { $Inheritance = @(&quot;None&quot;) }
 default { $Inheritance = @(&quot;ObjectInherit&quot;, &quot;ContainerInherit&quot;) }
 }
 
 # Not doing anything with Propagation...
 $Propagation = @(&quot;None&quot;)
 
 # Type (Allow, Deny, or Audit)
 $Type = &quot;Allow&quot;
 
 $Action = ($WorkSheet.Cells.Item($RowNum, 5).FormulaLocal).ToLower()
 If ($Action) { 
 # Disable Inheritance for this ACL
 $ACL = Get-ACL $Path
 $ACL.SetAccessRuleProtection($True, $True)
 Set-ACL $Path -aclObject $ACL
 
 $ACL = Get-ACL $Path
 }
 
 Switch ($Action.ToLower()) {
 &quot;add&quot; {
 # Create the new access rule
 $Rule = New-Object System.Security.AccessControl.FileSystemAccessRule( `
 $User, $AccessMask, $Inheritance, $Propagation, $Type)
 
 $ACL.AddAccessRule($Rule)
 
 Write-Host &quot;Adding Access to $Path for $User&quot;
 Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot;
 
 Set-ACL $Path -aclObject $ACL
 }
 &quot;modify&quot; {
 
 # Get the existing Access Rule
 $Rule = $ACL.Access | `
 ?{ $_.IdentityReference -match ($User -Replace &quot;\\&quot;, &quot;\\&quot;) `
 -And $_.IsInherited -eq $False }
 If ($Rule) {
 
 # Remove it from the ACL
 If ($Rule.Count &gt; 1) {
 $Rule | %{ $ACL.RemoveAccessRuleSpecific($_) }
 } else {
 $ACL.RemoveAccessRuleSpecific($Rule)
 }
 
 # Generate the new Rule and add it
 $Rule = New-Object System.Security.AccessControl.FileSystemAccessRule( `
 $User, $AccessMask, $Inheritance, $Propagation, $Type)
 $ACL.AddAccessRule($Rule)
 
 Write-Host &quot;Changing Access to $Path for $User&quot;
 Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot;
 
 Set-ACL $Path -aclObject $ACL
 } else {
 Write-Host &quot;Failed to $Action Access to $Path for $User&quot;
 Write-Host &quot;Failed to find existing rule to modify&quot;
 }
 }
 &quot;remove&quot; {
 
 # Get the existing Access Rule
 $Rule = $ACL.Access | `
 ?{ $_.IdentityReference -match ($User -Replace &quot;\\&quot;, &quot;\\&quot;) `
 -And $_.IsInherited -eq $False }
 If ($Rule) {
 
 # Remove it from the ACL
 If ($Rule.Count &gt; 1) {
 $Rule | %{ $ACL.RemoveAccessRuleSpecific($_) }
 } else {
 $ACL.RemoveAccessRuleSpecific($Rule)
 }
 
 Write-Host &quot;Remove Access to $Path for $User&quot;
 Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot;
 
 Set-ACL $Path -aclObject $ACL
 } else {
 Write-Host &quot;Failed to $Action Access to $Path for $User&quot;
 Write-Host &quot;Failed to find existing rule to remove&quot;
 }
 
 }
 }
 }
 $RowNum++
}
 
[Void]$Excel.Workbooks.PSBase.GetType().InvokeMember( `
 'Close', [Reflection.BindingFlags]::InvokeMethod, $Null, `
 $Excel.Workbooks, $Null, $Culture)
$Excel.Quit()
</code></pre>
</div>

<div>
PS C:\&gt; While ($BlankPath -lt 2) { 
&gt;&gt;&nbsp; &nbsp;$Path = ReadPath $WorkSheet $RowNum 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp;If ($Path -eq &quot;&quot;) { 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;$BlankPath++ 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp;} else { 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;$BlankPath = 0 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;$User = $WorkSheet.Cells.Item($RowNum, 2).FormulaLocal 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;# Get the Rights and make it into an AccessMask 
&gt;&gt;&nbsp; &nbsp; &nbsp;$Rights = ($WorkSheet.Cells.Item($RowNum, 6).FormulaLocal).ToUpper() 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;$AccessMask = @() 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;R&quot;)) { $AccessMask += &quot;ReadAndExecute&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;C&quot;)) { $AccessMask += &quot;Modify&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;F&quot;)) { $AccessMask += &quot;FullControl&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;P&quot;)) { $AccessMask += &quot;ChangePermissions&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;O&quot;)) { $AccessMask += &quot;TakeOwnership&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;X&quot;)) { $AccessMask += &quot;ExecuteFile&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;E&quot;)) { $AccessMask += &quot;Read&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;W&quot;)) { $AccessMask += &quot;Write&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;D&quot;)) { $AccessMask += &quot;Delete&quot; } 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;# Figure out if Inheritance is to be enabled for this Entry 
&gt;&gt;&nbsp; &nbsp; &nbsp;$Inheritance = ($WorkSheet.Cells.Item($RowNum, 8).FormulaLocal).ToLower() 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;Switch ($Inheritance) { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;&quot;no&quot; &nbsp;{ $Inheritance = @(&quot;None&quot;) } 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;default { $Inheritance = @(&quot;ObjectInherit&quot;, &quot;ContainerInherit&quot;) } 
&gt;&gt;&nbsp; &nbsp; &nbsp;} 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;# Not doing anything with Propagation... 
&gt;&gt;&nbsp; &nbsp; &nbsp;$Propagation = @(&quot;None&quot;) 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;# Type (Allow, Deny, or Audit) 
&gt;&gt;&nbsp; &nbsp; &nbsp;$Type = &quot;Allow&quot; 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;$Action = ($WorkSheet.Cells.Item($RowNum, 5).FormulaLocal).ToLower() 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Action) { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;# Disable Inheritance for this ACL 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;$ACL = Get-ACL $Path 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;$ACL.SetAccessRuleProtection($True, $True) 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;Set-ACL $Path -aclObject $ACL 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;$ACL = Get-ACL $Path 
&gt;&gt;&nbsp; &nbsp; &nbsp;} 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;Switch ($Action.ToLower()) { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;&quot;add&quot; { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# Create the new access rule 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$Rule = New-Object System.Security.AccessControl.FileSystemAccessRule( ` 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$User, $AccessMask, $Inheritance, $Propagation, $Type) 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$ACL.AddAccessRule($Rule) 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;Adding Access to $Path for $User&quot; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot; 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Set-ACL $Path -aclObject $ACL 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;} 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;&quot;modify&quot; { 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# Get the existing Access Rule 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$Rule = $ACL.Access | ` 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;?{ $_.IdentityReference -match ($User -Replace &quot;\\&quot;, &quot;\\&quot;) ` 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;-And $_.IsInherited -eq $False } 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;If ($Rule) { 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# Remove it from the ACL 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;If ($Rule.Count &gt;&nbsp;1) { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$Rule | %{ $ACL.RemoveAccessRuleSpecific($_) } 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;} else { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$ACL.RemoveAccessRuleSpecific($Rule) 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;} 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# Generate the new Rule and add it 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$Rule = New-Object System.Security.AccessControl.FileSystemAccessRule( ` 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$User, $AccessMask, $Inheritance, $Propagation, $Type) 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$ACL.AddAccessRule($Rule) 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;Changing Access to $Path for $User&quot; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot; 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Set-ACL $Path -aclObject $ACL 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;} else { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;Failed to $Action Access to $Path for $User&quot; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;Failed to find existing rule to modify&quot; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;} 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;} 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;&quot;remove&quot; { 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# Get the existing Access Rule 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$Rule = $ACL.Access | ` 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;?{ $_.IdentityReference -match ($User -Replace &quot;\\&quot;, &quot;\\&quot;) ` 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;-And $_.IsInherited -eq $False } 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;If ($Rule) { 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# Remove it from the ACL 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;If ($Rule.Count &gt;&nbsp;1) { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$Rule | %{ $ACL.RemoveAccessRuleSpecific($_) } 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;} else { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$ACL.RemoveAccessRuleSpecific($Rule) 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;} 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;Remove Access to $Path for $User&quot; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot; 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Set-ACL $Path -aclObject $ACL 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;} else { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;Failed to $Action Access to $Path for $User&quot; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;Failed to find existing rule to remove&quot; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;} 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;} 
&gt;&gt;&nbsp; &nbsp; &nbsp;} 
&gt;&gt;&nbsp; &nbsp;} 
&gt;&gt;&nbsp; &nbsp;$RowNum++ 
&gt;&gt;&nbsp;} 
&gt;&gt; 
Get-Acl : Cannot find path 'Path (exception dirs' because it does not exist. 
At line:33 char:21 
+ &nbsp; &nbsp; &nbsp; $ACL = Get-ACL &nbsp;&lt;&lt;&lt;&lt; $Path 
You cannot call a method on a null-valued expression. 
At line:34 char:35 
+ &nbsp; &nbsp; &nbsp; $ACL.SetAccessRuleProtection( &lt;&lt;&lt;&lt;&nbsp;$True, $True) 
Set-Acl : Cannot bind argument to parameter 'AclObject' because it is null. 
At line:35 char:31 
+ &nbsp; &nbsp; &nbsp; Set-ACL $Path -aclObject &nbsp;&lt;&lt;&lt;&lt; $ACL 
Get-Acl : Cannot find path 'Path (exception dirs' because it does not exist. 
At line:36 char:21 
+ &nbsp; &nbsp; &nbsp; $ACL = Get-ACL &nbsp;&lt;&lt;&lt;&lt; $Path 
Failed to modify Access to <a href="http://file://\\workstation\c$\2007office\" rel="ugc nofollow">\\workstation\c$\2007office\</a> for workstation\Users 
Failed to find existing rule to modify 
PS C:\&gt; [Void]$Excel.Workbooks.PSBase.GetType().InvokeMember( ` 
&gt;&gt;&nbsp; 'Close', [Reflection.BindingFlags]::InvokeMethod, $Null, ` 
&gt;&gt;&nbsp; $Excel.Workbooks, $Null, $Culture) 
&gt;&gt;&nbsp;$Excel.Quit()
</div>

<div>
 
Out of interest, did it manage to disable inheritance for this: 
 
\\workstation\c$\2007office\ 
 
Chris
</div>

<div>
 
Well that's something ;) 
 
Okay, that users group then. It tries to look for a BUILTIN group by the same name it it fails to find a computer specific one. Should catch it this time. 
 
Chris 

<pre><code class="code-100 nolinks" id="code-312538">Function ReadPath($WorkSheet, $RowNum) {
 Trap [EXCEPTION] {
 # Ignoring the Exception
 Continue
 }
 $Path = &quot;&quot;; $Path = $WorkSheet.Cells.Item($RowNum, 1).FormulaLocal
 Return $Path
}
 
Function GetMatchingRules($ACL, $SecurityPrincipal) {
 $Rules = $ACL.Access | `
 ?{ $_.IdentityReference -match ($SecurityPrincipal -Replace &quot;\\&quot;, &quot;\\&quot;) `
 -And $_.IsInherited -eq $False }
 If (!$Rules) {
 $Temp = $SecurityPrincipal.Split(&quot;\&quot;)
 $SecurityPrincipal = &quot;BUILTIN\$($Temp[$Temp.Count - 1])&quot;
 
 $Rules = $ACL.Access | `
 ?{ $_.IdentityReference -eq $SecurityPrincipal -And $_.IsInherited -eq $False }
 }
 Return $Rules
}
 
$ExcelFile = &quot;C:\Temp\Book1.xlsx&quot;
 
$Excel = New-Object -COM Excel.Application
$Culture = [System.Globalization.CultureInfo]'en-US'
 
$WorkBook = $Excel.Workbooks.PSBase.GetType().InvokeMember( `
 'Open', [Reflection.BindingFlags]::InvokeMethod, $Null, `
 $Excel.Workbooks, $ExcelFile, $Culture)
 
$WorkSheet = $WorkBook.WorkSheets.Item(1)
 
$RowNum = 0
$BlankPath = 0
While ($BlankPath -lt 2) {
 $Path = ReadPath $WorkSheet $RowNum
 
 If ($Path -eq &quot;&quot;) {
 $BlankPath++
 } else {
 $BlankPath = 0
 
 $User = $WorkSheet.Cells.Item($RowNum, 2).FormulaLocal
 
 # Get the Rights and make it into an AccessMask
 $Rights = ($WorkSheet.Cells.Item($RowNum, 6).FormulaLocal).ToUpper()
 
 $AccessMask = @()
 If ($Rights.Contains(&quot;R&quot;)) { $AccessMask += &quot;ReadAndExecute&quot; }
 If ($Rights.Contains(&quot;C&quot;)) { $AccessMask += &quot;Modify&quot; }
 If ($Rights.Contains(&quot;F&quot;)) { $AccessMask += &quot;FullControl&quot; }
 If ($Rights.Contains(&quot;P&quot;)) { $AccessMask += &quot;ChangePermissions&quot; }
 If ($Rights.Contains(&quot;O&quot;)) { $AccessMask += &quot;TakeOwnership&quot; }
 If ($Rights.Contains(&quot;X&quot;)) { $AccessMask += &quot;ExecuteFile&quot; }
 If ($Rights.Contains(&quot;E&quot;)) { $AccessMask += &quot;Read&quot; }
 If ($Rights.Contains(&quot;W&quot;)) { $AccessMask += &quot;Write&quot; }
 If ($Rights.Contains(&quot;D&quot;)) { $AccessMask += &quot;Delete&quot; }
 
 # Figure out if Inheritance is to be enabled for this Entry
 $Inheritance = ($WorkSheet.Cells.Item($RowNum, 8).FormulaLocal).ToLower()
 
 Switch ($Inheritance) {
 &quot;no&quot; { $Inheritance = @(&quot;None&quot;) }
 default { $Inheritance = @(&quot;ObjectInherit&quot;, &quot;ContainerInherit&quot;) }
 }
 
 # Not doing anything with Propagation...
 $Propagation = @(&quot;None&quot;)
 
 # Type (Allow, Deny, or Audit)
 $Type = &quot;Allow&quot;
 
 $Action = ($WorkSheet.Cells.Item($RowNum, 5).FormulaLocal).ToLower()
 If ($Action) { 
 # Disable Inheritance for this ACL
 $ACL = Get-ACL $Path
 $ACL.SetAccessRuleProtection($True, $True)
 Set-ACL $Path -aclObject $ACL
 
 $ACL = Get-ACL $Path
 }
 
 Switch ($Action.ToLower()) {
 &quot;add&quot; {
 # Create the new access rule
 $Rule = New-Object System.Security.AccessControl.FileSystemAccessRule( `
 $User, $AccessMask, $Inheritance, $Propagation, $Type)
 
 $ACL.AddAccessRule($Rule)
 
 Write-Host &quot;Adding Access to $Path for $User&quot;
 Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot;
 
 Set-ACL $Path -aclObject $ACL
 }
 &quot;modify&quot; {
 
 $Rules = GetMatchingRules $ACL $User
 
 If ($Rules) {
 # Remove it from the ACL
 If ($Rules.Count &gt; 1) {
 $Rules | %{ $ACL.RemoveAccessRuleSpecific($_) }
 } else {
 $ACL.RemoveAccessRuleSpecific($Rules)
 }
 
 # Generate the new Rule and add it
 $Rule = New-Object System.Security.AccessControl.FileSystemAccessRule( `
 $User, $AccessMask, $Inheritance, $Propagation, $Type)
 $ACL.AddAccessRule($Rule)
 
 Write-Host &quot;Changing Access to $Path for $User&quot;
 Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot;
 
 Set-ACL $Path -aclObject $ACL
 } else {
 Write-Host &quot;Failed to $Action Access to $Path for $User&quot;
 Write-Host &quot;Failed to find existing rule to modify&quot;
 }
 }
 &quot;remove&quot; {
 
 $Rules = GetMatchingRules $ACL $User
 
 If ($Rules) {
 # Remove it from the ACL
 If ($Rules.Count &gt; 1) {
 $Rules | %{ $ACL.RemoveAccessRuleSpecific($_) }
 } else {
 $ACL.RemoveAccessRuleSpecific($Rules)
 }
 
 Write-Host &quot;Remove Access to $Path for $User&quot;
 Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot;
 
 Set-ACL $Path -aclObject $ACL
 } else {
 Write-Host &quot;Failed to $Action Access to $Path for $User&quot;
 Write-Host &quot;Failed to find existing rule to remove&quot;
 }
 
 }
 }
 }
 $RowNum++
}
 
[Void]$Excel.Workbooks.PSBase.GetType().InvokeMember( `
 'Close', [Reflection.BindingFlags]::InvokeMethod, $Null, `
 $Excel.Workbooks, $Null, $Culture)
$Excel.Quit()
</code></pre>
</div>

<div>
 
PS C:\&gt; Function ReadPath($WorkSheet, $RowNum) { 
&gt;&gt;&nbsp; &nbsp;Trap [EXCEPTION] { 
&gt;&gt;&nbsp; &nbsp; &nbsp;# Ignoring the Exception 
&gt;&gt;&nbsp; &nbsp; &nbsp;Continue 
&gt;&gt;&nbsp; &nbsp;} 
&gt;&gt;&nbsp; &nbsp;$Path = &quot;&quot;; $Path = $WorkSheet.Cells.Item($RowNum, 1).FormulaLocal 
&gt;&gt;&nbsp; &nbsp;Return $Path 
&gt;&gt;&nbsp;} 
&gt;&gt; 
PS C:\&gt; Function GetMatchingRules($ACL, $SecurityPrincipal) { 
&gt;&gt;&nbsp; &nbsp;$Rules = $ACL.Access | ` 
&gt;&gt;&nbsp; &nbsp; &nbsp;?{ $_.IdentityReference -match ($SecurityPrincipal -Replace &quot;\\&quot;, &quot;\\&quot;) ` 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;-And $_.IsInherited -eq $False } 
&gt;&gt;&nbsp; &nbsp;If (!$Rules) { 
&gt;&gt;&nbsp; &nbsp; &nbsp;$Temp = $SecurityPrincipal.Split(&quot;\&quot;) 
&gt;&gt;&nbsp; &nbsp; &nbsp;$SecurityPrincipal = &quot;BUILTIN\$($Temp[$Temp.Count - 1])&quot; 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;$Rules = $ACL.Access | ` 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;?{ $_.IdentityReference -eq $SecurityPrincipal -And $_.IsInherited -eq $False } 
&gt;&gt;&nbsp; &nbsp;} 
&gt;&gt;&nbsp; &nbsp;Return $Rules 
&gt;&gt;&nbsp;} 
&gt;&gt; 
PS C:\&gt; $ExcelFile = &quot;C:\test1.xls&quot; 
PS C:\&gt; 
PS C:\&gt; $Excel = New-Object -COM Excel.Application 
PS C:\&gt; $Culture = [System.Globalization.CultureInfo]'en-US' 
PS C:\&gt; 
PS C:\&gt; $WorkBook = $Excel.Workbooks.PSBase.GetType().InvokeMember( ` 
&gt;&gt;&nbsp; &nbsp;'Open', [Reflection.BindingFlags]::InvokeMethod, $Null, ` 
&gt;&gt;&nbsp; &nbsp;$Excel.Workbooks, $ExcelFile, $Culture) 
&gt;&gt; 
PS C:\&gt; $WorkSheet = $WorkBook.WorkSheets.Item(1) 
PS C:\&gt; 
PS C:\&gt; $RowNum = 0 
PS C:\&gt; $BlankPath = 0 
PS C:\&gt; While ($BlankPath -lt 2) { 
&gt;&gt;&nbsp; &nbsp;$Path = ReadPath $WorkSheet $RowNum 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp;If ($Path -eq &quot;&quot;) { 
&gt;&gt;&nbsp; &nbsp; &nbsp;$BlankPath++ 
&gt;&gt;&nbsp; &nbsp;} else { 
&gt;&gt;&nbsp; &nbsp; &nbsp;$BlankPath = 0 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;$User = $WorkSheet.Cells.Item($RowNum, 2).FormulaLocal 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;# Get the Rights and make it into an AccessMask 
&gt;&gt;&nbsp; &nbsp; &nbsp;$Rights = ($WorkSheet.Cells.Item($RowNum, 6).FormulaLocal).ToUpper() 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;$AccessMask = @() 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;R&quot;)) { $AccessMask += &quot;ReadAndExecute&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;C&quot;)) { $AccessMask += &quot;Modify&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;F&quot;)) { $AccessMask += &quot;FullControl&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;P&quot;)) { $AccessMask += &quot;ChangePermissions&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;O&quot;)) { $AccessMask += &quot;TakeOwnership&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;X&quot;)) { $AccessMask += &quot;ExecuteFile&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;E&quot;)) { $AccessMask += &quot;Read&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;W&quot;)) { $AccessMask += &quot;Write&quot; } 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Rights.Contains(&quot;D&quot;)) { $AccessMask += &quot;Delete&quot; } 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;# Figure out if Inheritance is to be enabled for this Entry 
&gt;&gt;&nbsp; &nbsp; &nbsp;$Inheritance = ($WorkSheet.Cells.Item($RowNum, 8).FormulaLocal).ToLower() 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;Switch ($Inheritance) { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;&quot;no&quot; &nbsp;{ $Inheritance = @(&quot;None&quot;) } 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;default { $Inheritance = @(&quot;ObjectInherit&quot;, &quot;ContainerInherit&quot;) } 
&gt;&gt;&nbsp; &nbsp; &nbsp;} 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;# Not doing anything with Propagation... 
&gt;&gt;&nbsp; &nbsp; &nbsp;$Propagation = @(&quot;None&quot;) 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;# Type (Allow, Deny, or Audit) 
&gt;&gt;&nbsp; &nbsp; &nbsp;$Type = &quot;Allow&quot; 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;$Action = ($WorkSheet.Cells.Item($RowNum, 5).FormulaLocal).ToLower() 
&gt;&gt;&nbsp; &nbsp; &nbsp;If ($Action) { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;# Disable Inheritance for this ACL 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;$ACL = Get-ACL $Path 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;$ACL.SetAccessRuleProtection($True, $True) 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;Set-ACL $Path -aclObject $ACL 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;$ACL = Get-ACL $Path 
&gt;&gt;&nbsp; &nbsp; &nbsp;} 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp;Switch ($Action.ToLower()) { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;&quot;add&quot; { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# Create the new access rule 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$Rule = New-Object System.Security.AccessControl.FileSystemAccessRule( ` 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$User, $AccessMask, $Inheritance, $Propagation, $Type) 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$ACL.AddAccessRule($Rule) 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;Adding Access to $Path for $User&quot; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot; 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Set-ACL $Path -aclObject $ACL 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;} 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;&quot;modify&quot; { 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$Rules = GetMatchingRules $ACL $User 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;If ($Rules) { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# Remove it from the ACL 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;If ($Rules.Count &gt;&nbsp;1) { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$Rules | %{ $ACL.RemoveAccessRuleSpecific($_) } 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;} else { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$ACL.RemoveAccessRuleSpecific($Rules) 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;} 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# Generate the new Rule and add it 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$Rule = New-Object System.Security.AccessControl.FileSystemAccessRule( ` 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$User, $AccessMask, $Inheritance, $Propagation, $Type) 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$ACL.AddAccessRule($Rule) 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;Changing Access to $Path for $User&quot; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot; 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Set-ACL $Path -aclObject $ACL 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;} else { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;Failed to $Action Access to $Path for $User&quot; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;Failed to find existing rule to modify&quot; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;} 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;} 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;&quot;remove&quot; { 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$Rules = GetMatchingRules $ACL $User 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;If ($Rules) { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# Remove it from the ACL 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;If ($Rules.Count &gt;&nbsp;1) { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$Rules | %{ $ACL.RemoveAccessRuleSpecific($_) } 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;} else { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$ACL.RemoveAccessRuleSpecific($Rules) 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;} 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;Remove Access to $Path for $User&quot; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot; 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Set-ACL $Path -aclObject $ACL 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;} else { 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;Failed to $Action Access to $Path for $User&quot; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Write-Host &quot;Failed to find existing rule to remove&quot; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;} 
&gt;&gt; 
&gt;&gt;&nbsp; &nbsp; &nbsp; &nbsp;} 
&gt;&gt;&nbsp; &nbsp; &nbsp;} 
&gt;&gt;&nbsp; &nbsp;} 
&gt;&gt;&nbsp; &nbsp;$RowNum++ 
&gt;&gt;&nbsp;} 
&gt;&gt; 
Get-Acl : Cannot find path 'Path (exception dirs' because it does not exist. 
At line:33 char:21 
+ &nbsp; &nbsp; &nbsp; $ACL = Get-ACL &nbsp;&lt;&lt;&lt;&lt; $Path 
You cannot call a method on a null-valued expression. 
At line:34 char:35 
+ &nbsp; &nbsp; &nbsp; $ACL.SetAccessRuleProtection( &lt;&lt;&lt;&lt;&nbsp;$True, $True) 
Set-Acl : Cannot bind argument to parameter 'AclObject' because it is null. 
At line:35 char:31 
+ &nbsp; &nbsp; &nbsp; Set-ACL $Path -aclObject &nbsp;&lt;&lt;&lt;&lt; $ACL 
Get-Acl : Cannot find path 'Path (exception dirs' because it does not exist. 
At line:36 char:21 
+ &nbsp; &nbsp; &nbsp; $ACL = Get-ACL &nbsp;&lt;&lt;&lt;&lt; $Path 
Failed to modify Access to <a href="http://file://\\workstation\c$\2007office\" rel="ugc nofollow">\\workstation\c$\2007office\</a> for workstation\Users 
Failed to find existing rule to modify 
PS C:\&gt; [Void]$Excel.Workbooks.PSBase.GetType().InvokeMember( ` 
&gt;&gt;&nbsp; 'Close', [Reflection.BindingFlags]::InvokeMethod, $Null, ` 
&gt;&gt;&nbsp; $Excel.Workbooks, $Null, $Culture) 
&gt;&gt;&nbsp;$Excel.Quit() 
&nbsp; 
&nbsp; 
</div>

<div>
 
How irritating ;) 
 
What is the entry in the username it has in the spreadsheet for that particular entry? 
 
Chris
</div>

<div>
<a href="http://file://\\workstation\c$\2007office\" rel="ugc nofollow">\\workstation\c$\2007office\</a> &nbsp; workstation\Users &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;ax00000002 R X &nbsp; &nbsp; &nbsp; &nbsp; Modify F &nbsp;no 

</div>

<div>
Is that the correct syntax?
</div>

<div>
 
Yeah, it is. I'm wondering why it can't find the Users group. Can you run this and give me the output? 
 
(Get-ACL &quot;\\workstation\c$\2007office\&quot;).Access | Select-Object IdentityReference, IsInherited 
 
I'm expecting to see &quot;BUILTIN\Users&quot; and &quot;False&quot;, but either being different would potentially break the script there. 
 
Chris
</div>

<div>
IdentityReference &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; IsInherited 
----------------- &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ----------- 
CREATOR OWNER &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; False 
NT AUTHORITY\SYSTEM &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; False 
NT AUTHORITY\SYSTEM &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; False 
BUILTIN\Administrators &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;False 
BUILTIN\Administrators &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;False 
BUILTIN\Users &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; False 
BUILTIN\Users &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; False 
BUILTIN\Users &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; False 
BUILTIN\Users &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; False 
BUILTIN\Users &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; False 
LEUMINY\joe &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; False 
&nbsp; 
The changes to the acl was working before we got the inherit to work 

</div>

<div>
Is this the info needed 

</div>

<div>
 
Hmm I think I know why. I shouldn't have used $User, it's reserved, might have been causing the problem. 
 
Chris 

<pre><code class="code-100 nolinks" id="code-316764">Function ReadPath($WorkSheet, $RowNum) {
 Trap [EXCEPTION] {
 # Ignoring the Exception
 Continue
 }
 $Path = &quot;&quot;; $Path = $WorkSheet.Cells.Item($RowNum, 1).FormulaLocal
 Return $Path
}
 
Function GetMatchingRules($ACL, $SecurityPrincipal) {
 $Rules = $ACL.Access | `
 ?{ $_.IdentityReference -match ($SecurityPrincipal -Replace &quot;\\&quot;, &quot;\\&quot;) `
 -And $_.IsInherited -eq $False }
 If (!$Rules) {
 $Temp = $SecurityPrincipal.Split(&quot;\&quot;)
 $SecurityPrincipal = &quot;BUILTIN\$($Temp[$Temp.Count - 1])&quot;
 
 $Rules = $ACL.Access | `
 ?{ $_.IdentityReference -eq $SecurityPrincipal -And $_.IsInherited -eq $False }
 }
 Return $Rules
}
 
$ExcelFile = &quot;C:\Temp\Book1.xlsx&quot;
 
$Excel = New-Object -COM Excel.Application
$Culture = [System.Globalization.CultureInfo]'en-US'
 
$WorkBook = $Excel.Workbooks.PSBase.GetType().InvokeMember( `
 'Open', [Reflection.BindingFlags]::InvokeMethod, $Null, `
 $Excel.Workbooks, $ExcelFile, $Culture)
 
$WorkSheet = $WorkBook.WorkSheets.Item(1)
 
$RowNum = 0
$BlankPath = 0
While ($BlankPath -lt 2) {
 $Path = ReadPath $WorkSheet $RowNum
 
 If ($Path -eq &quot;&quot;) {
 $BlankPath++
 } else {
 $BlankPath = 0
 
 $SecurityPrincipal = $WorkSheet.Cells.Item($RowNum, 2).FormulaLocal
 
 # Get the Rights and make it into an AccessMask
 $Rights = ($WorkSheet.Cells.Item($RowNum, 6).FormulaLocal).ToUpper()
 
 $AccessMask = @()
 If ($Rights.Contains(&quot;R&quot;)) { $AccessMask += &quot;ReadAndExecute&quot; }
 If ($Rights.Contains(&quot;C&quot;)) { $AccessMask += &quot;Modify&quot; }
 If ($Rights.Contains(&quot;F&quot;)) { $AccessMask += &quot;FullControl&quot; }
 If ($Rights.Contains(&quot;P&quot;)) { $AccessMask += &quot;ChangePermissions&quot; }
 If ($Rights.Contains(&quot;O&quot;)) { $AccessMask += &quot;TakeOwnership&quot; }
 If ($Rights.Contains(&quot;X&quot;)) { $AccessMask += &quot;ExecuteFile&quot; }
 If ($Rights.Contains(&quot;E&quot;)) { $AccessMask += &quot;Read&quot; }
 If ($Rights.Contains(&quot;W&quot;)) { $AccessMask += &quot;Write&quot; }
 If ($Rights.Contains(&quot;D&quot;)) { $AccessMask += &quot;Delete&quot; }
 
 # Figure out if Inheritance is to be enabled for this Entry
 $Inheritance = ($WorkSheet.Cells.Item($RowNum, 8).FormulaLocal).ToLower()
 
 Switch ($Inheritance) {
 &quot;no&quot; { $Inheritance = @(&quot;None&quot;) }
 default { $Inheritance = @(&quot;ObjectInherit&quot;, &quot;ContainerInherit&quot;) }
 }
 
 # Not doing anything with Propagation...
 $Propagation = @(&quot;None&quot;)
 
 # Type (Allow, Deny, or Audit)
 $Type = &quot;Allow&quot;
 
 $Action = ($WorkSheet.Cells.Item($RowNum, 5).FormulaLocal).ToLower()
 If ($Action) { 
 # Disable Inheritance for this ACL
 $ACL = Get-ACL $Path
 $ACL.SetAccessRuleProtection($True, $True)
 Set-ACL $Path -aclObject $ACL
 
 $ACL = Get-ACL $Path
 }
 
 Switch ($Action.ToLower()) {
 &quot;add&quot; {
 # Create the new access rule
 $Rule = New-Object System.Security.AccessControl.FileSystemAccessRule( `
 $SecurityPrincipal, $AccessMask, $Inheritance, $Propagation, $Type)
 
 $ACL.AddAccessRule($Rule)
 
 Write-Host &quot;Adding Access to $Path for $SecurityPrincipal&quot;
 Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot;
 
 Set-ACL $Path -aclObject $ACL
 }
 &quot;modify&quot; {
 
 $Rules = GetMatchingRules $ACL $SecurityPrincipal
 
 If ($Rules) {
 # Remove it from the ACL
 If ($Rules.Count &gt; 1) {
 $Rules | %{ $ACL.RemoveAccessRuleSpecific($_) }
 } else {
 $ACL.RemoveAccessRuleSpecific($Rules)
 }
 
 # Generate the new Rule and add it
 $Rule = New-Object System.Security.AccessControl.FileSystemAccessRule( `
 $SecurityPrincipal, $AccessMask, $Inheritance, $Propagation, $Type)
 $ACL.AddAccessRule($Rule)
 
 Write-Host &quot;Changing Access to $Path for $SecurityPrincipal&quot;
 Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot;
 
 Set-ACL $Path -aclObject $ACL
 } else {
 Write-Host &quot;Failed to $Action Access to $Path for $SecurityPrincipal&quot;
 Write-Host &quot;Failed to find existing rule to modify&quot;
 }
 }
 &quot;remove&quot; {
 
 $Rules = GetMatchingRules $ACL $SecurityPrincipal
 
 If ($Rules) {
 # Remove it from the ACL
 If ($Rules.Count &gt; 1) {
 $Rules | %{ $ACL.RemoveAccessRuleSpecific($_) }
 } else {
 $ACL.RemoveAccessRuleSpecific($Rules)
 }
 
 Write-Host &quot;Remove Access to $Path for $SecurityPrincipal&quot;
 Write-Host &quot;New Security:`n`n$($ACL.AccessToString)`n&quot;
 
 Set-ACL $Path -aclObject $ACL
 } else {
 Write-Host &quot;Failed to $Action Access to $Path for $SecurityPrincipal&quot;
 Write-Host &quot;Failed to find existing rule to remove&quot;
 }
 
 }
 }
 }
 $RowNum++
}
 
[Void]$Excel.Workbooks.PSBase.GetType().InvokeMember( `
 'Close', [Reflection.BindingFlags]::InvokeMethod, $Null, `
 $Excel.Workbooks, $Null, $Culture)
$Excel.Quit()
</code></pre>
</div>

<div>
 
&nbsp;This is the line in the xls spread sheet 
<a href="http://file://\\workstation\c$\2007office\" rel="ugc nofollow">\\workstation\c$\2007office\</a> workstation\Users &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;R X &nbsp; &nbsp; &nbsp; &nbsp;R X &nbsp; &nbsp; &nbsp; &nbsp; modify F &nbsp;yes 
&nbsp; 
&nbsp;____________________________________________________________________________________ 
&nbsp; 
&nbsp; 
&gt;&gt; 
Get-Acl : Cannot find path 'Path (exception dirs' because it does not exist. 
At line:33 char:21 
+ &nbsp; &nbsp; &nbsp; $ACL = Get-ACL &nbsp;&lt;&lt;&lt;&lt; $Path 
You cannot call a method on a null-valued expression. 
At line:34 char:35 
+ &nbsp; &nbsp; &nbsp; $ACL.SetAccessRuleProtection( &lt;&lt;&lt;&lt;&nbsp;$True, $True) 
Set-Acl : Cannot bind argument to parameter 'AclObject' because it is null. 
At line:35 char:31 
+ &nbsp; &nbsp; &nbsp; Set-ACL $Path -aclObject &nbsp;&lt;&lt;&lt;&lt; $ACL 
Get-Acl : Cannot find path 'Path (exception dirs' because it does not exist. 
At line:36 char:21 
+ &nbsp; &nbsp; &nbsp; $ACL = Get-ACL &nbsp;&lt;&lt;&lt;&lt; $Path 
Failed to modify Access to <a href="http://file://workstation/c$/2007office/" rel="ugc">\\workstation\c$\2007office\</a> for workstation\Users 
Failed to find existing rule to modify 
PS C:\Documents and Settings\joe&gt; [Void]$Excel.Workbooks.PSBase.GetType().InvokeMember( ` 
&gt;&gt;&nbsp; 'Close', [Reflection.BindingFlags]::InvokeMethod, $Null, ` 
&gt;&gt;&nbsp; $Excel.Workbooks, $Null, $Culture) 
&gt;&gt;&nbsp;$Excel.Quit() 
&gt;&gt;&nbsp; 

</div>

<div>
 
Where are we getting this from then? 
 
&quot;Path (exception dirs&quot; 
 
A header in the spreadsheet? 
 
Chris
</div>

<div>
I am attachinga copy of the spreadsheet 
<a href="https://filedb.experts-exchange.com/incoming/2009/05_w19/136589/test.xls" target="_blank" class="file-inline" title="spreadsheet (16 KB)"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M67.508 468.467c-58.005-58.013-58.016-151.92 0-209.943l225.011-225.04c44.643-44.645 117.279-44.645 161.92 0 44.743 44.749 44.753 117.186 0 161.944l-189.465 189.49c-31.41 31.413-82.518 31.412-113.926.001-31.479-31.482-31.49-82.453 0-113.944L311.51 110.491c4.687-4.687 12.286-4.687 16.972 0l16.967 16.971c4.685 4.686 4.685 12.283 0 16.969L184.983 304.917c-12.724 12.724-12.73 33.328 0 46.058 12.696 12.697 33.356 12.699 46.054-.001l189.465-189.489c25.987-25.989 25.994-68.06.001-94.056-25.931-25.934-68.119-25.932-94.049 0l-225.01 225.039c-39.249 39.252-39.258 102.795-.001 142.057 39.285 39.29 102.885 39.287 142.162-.028A739446.174 739446.174 0 0 1 439.497 238.49c4.686-4.687 12.282-4.684 16.969.004l16.967 16.971c4.685 4.686 4.689 12.279.004 16.965a755654.128 755654.128 0 0 0-195.881 195.996c-58.034 58.092-152.004 58.093-210.048.041z"/></svg>test.xls</a>
</div>

test.xls

<div>
<div class="content wysiwyg-content">
hi, 
I ran a dumpsec scan againt all our server with the output going to xls files (for each drive on all servers) 
After that scan, we reviewed all the permissions and where the changes we required and placed them in another column. 
I now need to make all the changes to there server. 
Is if possible to use the input from the XLS and script that automatically using xcacls? 
I am attaching a clip of the output of my dumpsec scan 
 
Please help 
<a href="https://filedb.experts-exchange.com/incoming/2009/03_w10/113933/output.xls" target="_blank" class="file-inline" title="output of dumpsec with change (15 KB)"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M67.508 468.467c-58.005-58.013-58.016-151.92 0-209.943l225.011-225.04c44.643-44.645 117.279-44.645 161.92 0 44.743 44.749 44.753 117.186 0 161.944l-189.465 189.49c-31.41 31.413-82.518 31.412-113.926.001-31.479-31.482-31.49-82.453 0-113.944L311.51 110.491c4.687-4.687 12.286-4.687 16.972 0l16.967 16.971c4.685 4.686 4.685 12.283 0 16.969L184.983 304.917c-12.724 12.724-12.73 33.328 0 46.058 12.696 12.697 33.356 12.699 46.054-.001l189.465-189.489c25.987-25.989 25.994-68.06.001-94.056-25.931-25.934-68.119-25.932-94.049 0l-225.01 225.039c-39.249 39.252-39.258 102.795-.001 142.057 39.285 39.29 102.885 39.287 142.162-.028A739446.174 739446.174 0 0 1 439.497 238.49c4.686-4.687 12.282-4.684 16.969.004l16.967 16.971c4.685 4.686 4.689 12.279.004 16.965a755654.128 755654.128 0 0 0-195.881 195.996c-58.034 58.092-152.004 58.093-210.048.041z"/></svg>output.xls</a>
</div>
</div>

output.xls

hi,
I ran a dumpsec scan againt all our server with the output going to xls files (for each drive on all servers)
After that scan, we reviewed all the permissions and where the changes we required and placed them in another column.
I now need to make all the changes to there server.
Is if possible to use the input from the XLS and script that automatically using xcacls?
I am attaching a clip of the output of my dumpsec scan

Please help

Script to iport dumpsec output/ recommended changes for  ntfs permission using xcalcs

VBScript (Visual Basic Scripting Edition) is an interpreted scripting language developed by Microsoft that is modeled on Visual Basic, but with some important differences. VBScript is commonly used for automating administrative and other tasks in Windows operating systems (by means of the Windows Script Host) and for server-side scripting in ASP web applications. It is also used for client-side scripting in Internet Explorer, specifically in intranet web applications.

VB Script

Windows Server 2003 was based on Windows XP and was released in four editions: Web, Standard, Enterprise and Datacenter. It also had derivative versions for clusters, storage and Microsoft’s Small Business Server. Important upgrades included integrating Internet Information Services (IIS), improvements to Active Directory (AD) and Group Policy (GP), and the migration to Automated System Recovery (ASR).

Windows Server 2003

Security is the protection of information systems from theft or damage to the hardware, the software, and the information on them, as well as from disruption or misdirection of the services they provide. The main goal of security is protecting assets, and an asset is anything of value and worthy of protection.  Information Security is a discipline of protecting information assets from threats through safeguards to achieve the objectives of confidentiality, integrity, and availability or CIA for short. On the other hand, disclosure, alteration, and disruption (DAD) compromise the security objectives.