How to Handle NTFS Folder Permissions, Security Descriptors and ACLs in PowerShell
1. Overview
Some time ago, I was automating a few tasks with PowerShell and needed to set NTFS permissions on a folder. I was tempted to use the good old ICACLS.EXE command line, but I wanted to keep it all within PowerShell. While there are a number of different permissions you could want to set for a folder, my specific case called the following:
- Create a new folder
- Check the default permissions on the new folder
- Turn off inheritance on that folder, removing existing inherited permissions from the parent folder
- Grant “Full Control” permissions to Administrators, propagating via inheritance to files and subfolders
- Grant “Read” permissions to Users, propagating via inheritance to files and subfolders
- Review the permissions on the folder
2. The old ICACLS
In the old CMD.EXE world, you would use ICACLS.The commands would look like this:
- MD F:\Folder
- ICACLS F:\Folder
- ICACLS F:\Folder /INHERITANCE:R
- ICACLS F:\Folder /GRANT Administrators:(CI)(OI)F
- ICACLS F:\Folder /GRANT Users: (CI)(OI)R
- ICACLS F:\Folder
--> The rest is on Jose's Blog :
