marrj
asked on
PowerShell: Grant NTFS Permissions to Folders
I have a folder structure in a domain environment that contains child folders bearing the names of the Active Directory user accounts that i need to have full control to their respective folder. How would i script this permission change in PowerShell?
By the way, I believe that you know that you can also use CMD commands, even from Power Shell in order to achieve the same goal. Using ICACLS for example, allows you to specify the desired permissions easily.
For example, if you want to assign Full access permission for John.Smith in all the sub-folders inside C:\Public, you just need to run:
ICACLS C:\Public\* /Grant john.smith:F
For example, if you want to assign Full access permission for John.Smith in all the sub-folders inside C:\Public, you just need to run:
ICACLS C:\Public\* /Grant john.smith:F
If the folders match the usernames, you can use the following.
$path = "C:\Share"
$folders = Get-ChildItem -Path $path
foreach ($folder in $folders)
{
try {
$user = $folder.BaseName
$acl = Get-Acl $folder.FullName
$ar = New-Object System.Security.AccessControl.FileSystemAccessRule($user,"FullControl","Allow")
$acl.SetAccessRule($ar)
Set-Acl $($folder.FullName) $acl
} catch {
Write-Host $folder.FullName did not have a matching user.
}
}
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
In order to use power shell ACL modification commands and avoid specifying many lines of code, it is better that you use a variable containing the reference permissions that you need. For example, let's say that you have the file 'C:\Public\ACLTemplate.txt
$DesiredPermissions = Get-ACL C:\Public\ACLTemplate.txt
Finally, in order to apply all of these NTFS settings to all existing folders in C:\Public. (i.e. C:\Public\Folder1, C:\Public\Folder2, C:\Public\Folder3, ... , C:\Public\FolderN
You can execute:
Set-ACL -Path C:\Public\* -AclObject $DesiredPermissions
Or if you want, you can make the whole process with just one line, and no need of a variable just using:
Get-ACL C:\Public\ACLTemplate.txt | Set-ACL -Path C:\Public\*