![\"\"](\"/images/content/5b6/a494c51ee4793468b4584/460_-552-)
Adjusting permissions on thousands of folders and files can be time consuming -- unless you use PowerShell to automate it.
\nChanging permissions on a single folder is a cinch with the GUI. Simply right-click a folder, go to Security and you're golden.
\r\nThe problem arises when you've got thousands of folders to change. Let's say you have a company file server that houses all employees' home folders. Each employee needs to have Modify access to their own folder and administrators need to have Full Control over all folders. You have the server built and all the folders created, but you now must face the challenge of ensuring the NTFS permissions are set correctly on each folder. How would you go about this?
\r\nI hope you didn't just say you'd wear out your mouse making this happen because we're not using our mouse here, sorry. We're automating this whole process using PowerShell.
\r\nTo change access control lists (ACLs) for a folder or a file requires three phases:
\r\nBefore an ACL can be changed you first must get the existing one. There are two ways to do this with PowerShell; you can use the Get-Acl cmdlet or the GetAccessControl() method. We highly recommend using the GetAccessContro() method. Get-Acl is handy but due to some limitations it's not quite as smart as GetAccessControl() is.
\r\nBefore we can start changing permissions for all home folders we should test this out on a single folder.
\r\nGreat! It looks like we now have the code to find the ACL on a single folder. Let's now expand this to find ACLs for all home folders. By simply using Get-ChildItem and the Directory parameter to exclude files instead of Get-Item, we're now able to find ACLs on all of the home folders. We're getting closer!
\r\nThe next step is modifying the ACL on each folder. Remember that we want to ensure the only user that has access to each home folder is the owner of the folder. How would we know the owner of the folder? Luckily, the owner of the folder is also the folder name itself.
\r\nWe'll need to grab that folder name and use that to create another entry in the ACL. Unfortunately, the script will have to get a little more complicated.
\r\n\n\r\n
$HomeFolders = Get-ChildItem C:Homefolders -Directory
foreach ($HomeFolder in $HomeFolders) {
$Path = $HomeFolder.FullName
$Acl = (Get-Item $Path).GetAccessControl('Access')
$Username = $HomeFolder.Name
$Ar = New-Object System.Security.AccessControl.FileSystemAccessRule($Username, 'Modify', 'ContainerInherit,ObjectInherit', 'None', 'Allow')
$Acl.SetAccessRule($Ar)
Set-Acl -path $Path -AclObject $Acl
}
\n
Pay attention to the following line in this script because this one is a little hard to comprehend.
\r\n$Ar = New-Object
System.Security.AccessControl.FileSystemAccessRule($Username, 'Modify', 'ContainerInherit,ObjectInherit', 'None', 'Allow')
Access control entries (ACEs) are the individual rights inside of an ACL. An ACE can also be called a FileSystemAccessRule. This is a .NET object that has five parameters;
\r\nThe remaining lines are taking the $Ar FileSystemAccessRule object, adding it to the ACL and finally we're committing the ACL back to the disk.
\r\nBy using GetAccessControl() and Set-Acl you can do any number of other actions on ACLs, such as adding new ones, like we did here, removing old ones, or just modifying existing ACLs. For more information on managing file system permissions with PowerShell, there's a great article on the TechNet blog: How to Handle NTFS Folder Permissions, Security Descriptors and ACLs in PowerShell.
\n","docType":"article","guid":"articles_d961c7aaafb69e368f57bdcbab450eca","lastModified":"2018-09-05T11:00:00.000Z","published":"2018-09-05T11:00:00.000Z","structuredData":null,"subtitle":"Adjusting permissions on thousands of folders can be time consuming without PowerShell.","template":"v1","title":"How to Manage File System ACLs with PowerShell","type":"article","author":{"avatar":null,"bio":"Adam Bertram is a 20-year veteran of IT and experienced online business professional. He's an entrepreneur, IT influencer, Microsoft MVP, blogger, trainer and content marketing writer for multiple technology companies. Adam is also the founder of the popular IT career development platform TechSnips. Catch up on Adam's articles at adamtheautomator.com, connect on LinkedIn, or follow him on Twitter at @adbertram or the TechSnips Twitter account at @techsnips_io.","name":"Adam Bertram","image":null,"slug":null,"social":{"facebook":"","linkedin":"https://www.linkedin.com/in/adambertram/","twitter":"https://twitter.com/adbertram","website":"https://www.adamtheautomator.com/"},"status":"enabled","title":null,"type":"Contributing Writer","user":{"imagePath":"https://staging.business.com/images/undefined","profile":{"company":"eGain Communications","jobTitle":"Product Management Analyst","website":""}}},"breadcrumbs":null,"channels":{"primary":{"name":"Technology","slug":"technology"},"sub":{"name":"Technology Solutions","slug":"technology-solutions"}},"meta":{"robots":"index, follow","description":"Adjusting permissions on thousands of folders and files can be time consuming -- unless you use PowerShell to automate it.","title":"Managing File System ACLs With PowerShell - business.com"},"parsedContent":{"toc":[{"id":"changing-acls-for-folders-and-files","title":"Changing ACLs For Folders And Files"}],"json":[{"component":"p","children":["Adjusting permissions on thousands of folders and files can be time consuming -- unless you use PowerShell to automate it."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter full"},"children":["A big time drain for any IT professional that manages file servers is managing permissions on files and folders. Users have individual home folders, departments have department folders, projects have folders and so on. For some reason your company doesn't think it's a good idea for everyone to have access to all of the files in these folders. We tend to agree."]}]},{"component":"p","children":["Changing permissions on a single folder is a cinch with the GUI. Simply right-click a folder, go to Security and you're golden."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter small"},"children":[{"component":"source","props":{"srcSet":"/images/content/5b6/a494c51ee4793468b4584/460_-552- 460w, /images/content/5b6/a494c51ee4793468b4584/255_-306- 255w, /images/content/5b6/a494c51ee4793468b4584/127_-152- 127w","sizes":"(min-width: 870px) 255px, (min-width: 400px) 100vw, 100%"}},{"component":"img","props":{"src":"/images/content/5b6/a494c51ee4793468b4584/374-449-","alt":"","width":"374","height":"449","data-content-img-id":"5b6a494c51ee4793468b4584"}}]}]},{"component":"p","children":["The problem arises when you've got thousands of folders to change. Let's say you have a company file server that houses all employees' home folders. Each employee needs to have ",{"component":"strong","children":["Modify"]}," access to their own folder and administrators need to have ",{"component":"strong","children":["Full Control"]}," over all folders. You have the server built and all the folders created, but you now must face the challenge of ensuring the NTFS permissions are set correctly on each folder. How would you go about this?"]},{"component":"p","children":["I hope you didn't just say you'd wear out your mouse making this happen because we're not using our mouse here, sorry. We're automating this whole process using PowerShell."]},{"component":"h2","props":{"id":"changing-acls-for-folders-and-files"},"children":["Changing ACLs For Folders And Files"]},{"component":"p","children":["To change access control lists (ACLs) for a folder or a file requires three phases:"]},{"component":"ol","children":[{"component":"li","children":["Getting the current ACL."]},{"component":"li","children":["Modifying the ACL."]},{"component":"li","children":["Setting the new ACL."]}]},{"component":"p","children":["Before an ACL can be changed you first must get the existing one. There are two ways to do this with PowerShell; you can use the ",{"component":"strong","children":["Get-Acl "]},"cmdlet or the ",{"component":"strong","children":["GetAccessControl()"]}," method. We highly recommend using the GetAccessContro() method. Get-Acl is handy but ",{"component":"a","props":{"href":"http://stackoverflow.com/questions/6622124/why-does-set-acl-on-the-drive-root-try-to-set-ownership-of-the-object","target":"_blank"},"children":["due to some limitations"]}," it's not quite as smart as GetAccessControl() is."]},{"component":"p","children":["Before we can start changing permissions for all home folders we should test this out on a single folder. "]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter full"},"children":[{"component":"source","props":{"srcSet":"/images/content/5b6/a498651ee47d8748b4571/1200_-1028- 1200w, /images/content/5b6/a498651ee47d8748b4571/668_-572- 668w, /images/content/5b6/a498651ee47d8748b4571/320_-274- 320w","sizes":"668px, 100%"}},{"component":"img","props":{"src":"/images/content/5b6/a498651ee47d8748b4571/708-607-","alt":"","width":"708","height":"607","data-content-img-id":"5b6a498651ee47d8748b4571"}}]}]},{"component":"p","children":["Great! It looks like we now have the code to find the ACL on a single folder. Let's now expand this to find ACLs for ",{"component":"em","children":["all "]},"home folders. By simply using ",{"component":"strong","children":["Get-ChildItem"]}," and the ",{"component":"strong","children":["Directory"]}," parameter to exclude files instead of ",{"component":"strong","children":["Get-Item"]},", we're now able to find ACLs on all of the home folders. We're getting closer!"]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter full"},"children":[{"component":"source","props":{"srcSet":"/images/content/5b6/a49aa1039eb155f8b45e0/1200_-627- 1200w, /images/content/5b6/a49aa1039eb155f8b45e0/668_-349- 668w, /images/content/5b6/a49aa1039eb155f8b45e0/320_-167- 320w","sizes":"668px, 100%"}},{"component":"img","props":{"src":"/images/content/5b6/a49aa1039eb155f8b45e0/862-451-","alt":"","width":"862","height":"451","data-content-img-id":"5b6a49aa1039eb155f8b45e0"}}]}]},{"component":"p","children":["The next step is modifying the ACL on each folder. Remember that we want to ensure the only user that has access to each home folder is the owner of the folder. How would we know the owner of the folder? Luckily, the owner of the folder is also the folder name itself. "]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter small"},"children":[{"component":"source","props":{"srcSet":"/images/content/5b6/a49d351ee47a1488b4582/460_-247- 460w, /images/content/5b6/a49d351ee47a1488b4582/255_-137- 255w, /images/content/5b6/a49d351ee47a1488b4582/127_-68- 127w","sizes":"(min-width: 870px) 255px, (min-width: 400px) 100vw, 100%"}},{"component":"img","props":{"src":"/images/content/5b6/a49d351ee47a1488b4582/295-159-","alt":"","width":"295","height":"159","data-content-img-id":"5b6a49d351ee47a1488b4582"}}]}]},{"component":"p","children":["We'll need to grab that folder name and use that to create another entry in the ACL. Unfortunately, the script will have to get a little more complicated."]},{"component":"blockquote","children":[{"component":"br"},"$HomeFolders = Get-ChildItem C:Homefolders -Directory",{"component":"br"},"foreach ($HomeFolder in $HomeFolders) {",{"component":"br"}," $Path = $HomeFolder.FullName",{"component":"br"}," $Acl = (Get-Item $Path).GetAccessControl('Access')",{"component":"br"}," $Username = $HomeFolder.Name",{"component":"br"}," $Ar = New-Object System.Security.AccessControl.FileSystemAccessRule($Username, 'Modify', 'ContainerInherit,ObjectInherit', 'None', 'Allow')",{"component":"br"}," $Acl.SetAccessRule($Ar)",{"component":"br"}," Set-Acl -path $Path -AclObject $Acl",{"component":"br"},"}",{"component":"br"},{"component":"br"}]},{"component":"p","children":["Pay attention to the following line in this script because this one is a little hard to comprehend."]},{"component":"p","children":["$Ar = New-Object",{"component":"br"}," System.Security.AccessControl.FileSystemAccessRule($Username, 'Modify', 'ContainerInherit,ObjectInherit', 'None', 'Allow')"]},{"component":"p","children":["Access control entries (ACEs) are the individual rights inside of an ACL. An ACE can also be called a F",{"component":"strong","children":["ileSystemAccessRule"]},". This is a .NET object that has five parameters;"]},{"component":"ul","children":[{"component":"li","children":["The security identifier (",{"component":"strong","children":["$Username"]},");"]},{"component":"li","children":["The right (",{"component":"strong","children":["Modify"]},");"]},{"component":"li","children":["Inheritance settings (",{"component":"strong","children":["ContainerInherit,ObjectInherit"]},") which means to force all folders and files underneath the folder to inherit the permission we’re setting here;"]},{"component":"li","children":["Propagation settings (",{"component":"strong","children":["None"]},") which is to not interfere with the inheritance settings;"]},{"component":"li","children":["Type (",{"component":"strong","children":["Allow"]},")."]}]},{"component":"p","children":["The remaining lines are taking the ",{"component":"strong","children":["$Ar FileSystemAccessRule"]}," object, adding it to the ACL and finally we're committing the ACL back to the disk."]},{"component":"p","children":["By using ",{"component":"strong","children":["GetAccessControl()"]}," and ",{"component":"strong","children":["Set-Acl"]}," you can do any number of other actions on ACLs, such as adding new ones, like we did here, removing old ones, or just modifying existing ACLs. For more information on managing file system permissions with PowerShell, there's a great article on the TechNet blog: ",{"component":"a","props":{"href":"http://blogs.technet.com/b/josebda/archive/2010/11/12/how-to-handle-ntfs-folder-permissions-security-descriptors-and-acls-in-powershell.aspx"},"children":["How to Handle NTFS Folder Permissions, Security Descriptors and ACLs in PowerShell"]},"."]}]},"resource":null,"sponsorship":null,"thumbnail":{"path":"https://staging.business.com/images/content/5cf/9f88e7b437486498b4568/1500-0-","caption":"kikujungboy/Shutterstock","isBlurred":false},"bestPicks":null},"related":{"relatedArticles":[{"title":"PowerShell: Everything You Need to Know","canonical":"https://www.business.com/articles/powershell-everything-you-need-to-know/","slug":"powershell-everything-you-need-to-know","thumbnail":"https://www.business.com/images/content/5b8/998581039eb8f738b457b/1500-0-","dek":"What you need to know to unlock Microsoft PowerShell's full capabilities.","lastModified":"2018-09-05T17:00:00Z","published":"2018-09-05T17:00:00Z","sponsored":false},{"title":"Essential PowerShell Cmdlets For Auditing And Maintaining Storage","canonical":"https://www.business.com/articles/powershell-for-storage/","slug":"powershell-for-storage","thumbnail":"https://www.business.com/images/content/5d0/18e065a215ea2498b4588/1500-0-","dek":"PowerShell v5 offers some new features for managing storage.","lastModified":"2018-09-04T11:00:00Z","published":"2018-09-04T11:00:00Z","sponsored":false},{"title":"Essential PowerShell Cmdlets For Managing Active Directory","canonical":"https://www.business.com/articles/powershell-active-directory-cmdlets/","slug":"powershell-active-directory-cmdlets","thumbnail":"https://www.business.com/images/content/5cf/90cab7b4374ab068b456f/1500-0-","dek":"Administering Active Directory is one of the most critical roles in any Windows network.","lastModified":"2018-09-04T08:00:00Z","published":"2018-09-04T08:00:00Z","sponsored":false},{"title":"How and When to Create and Use PowerShell Modules","canonical":"https://www.business.com/articles/powershell-modules/","slug":"powershell-modules","thumbnail":"https://www.business.com/images/content/5cf/a71415a215e501f8b457a/1500-0-","dek":"Step-by-step instructions on creating and using modules.","lastModified":"2018-09-05T08:00:00Z","published":"2018-09-05T08:00:00Z","sponsored":false},{"title":"Using Lean Strategies to Achieve Team Synergy and Efficiency","canonical":"https://www.business.com/articles/lean-strategies-team-efficiency/","slug":"lean-strategies-team-efficiency","thumbnail":"https://www.business.com/images/content/5be/480e49c658a51108b458c/1500-0-","dek":"Learn more about lean manufacturing strategies and how to implement them in your business.","lastModified":"2018-11-08T08:00:00Z","published":"2018-11-08T08:00:00Z","sponsored":false},{"title":"Your Guide to Creating a Small Business Marketing Plan","canonical":"https://www.business.com/articles/sample-marketing-plan-outline-and-template/","slug":"sample-marketing-plan-outline-and-template","thumbnail":"https://www.business.com/images/content/5f3/3e1765a215eb62d8b4567/1500-0-","dek":"Follow these templates and guidelines to get started on creating your business's marketing plan.","lastModified":"2020-08-12T12:28:00Z","published":"2018-03-02T13:00:00Z","sponsored":false},{"title":"From COVID-19 to Hurricane Season: Disaster Preparedness for Small Business","canonical":"https://www.business.com/articles/business-disaster-prep/","slug":"business-disaster-prep","thumbnail":"https://www.business.com/images/content/5e7/a495e5a215eb11d8b4569/1500-0-","dek":"Natural disasters – whether a hurricane, tornado or outbreak like COVID-19 – can have a disastrous effect on small businesses, but they don't have to. Here's how to weather a disaster successfully.","lastModified":"2020-03-25T15:19:00Z","published":"2018-09-26T07:00:00Z","sponsored":false},{"title":"How to Make Money in Retirement: A Guide to Turning a Hobby into a Side Business","canonical":"https://www.business.com/articles/how-make-money-retirement-hobby/","slug":"how-make-money-retirement-hobby","thumbnail":"https://www.business.com/images/content/5ba/902e01039eb26648b4572/1500-0-","dek":"Many retirees turn side interests into income. Learn how to make money in retirement.","lastModified":"2018-09-24T15:03:00Z","published":"2018-09-24T15:03:00Z","sponsored":false},{"title":"How to Hire for Your Business","canonical":"https://www.business.com/articles/how-to-staff-business/","slug":"how-to-staff-business","thumbnail":"https://www.business.com/images/content/5ea/9c8bb9c658aee018b456c/1500-0-","dek":"Sterling Staffing Solutions CEO Stephen Carter shares his tips on staffing your business.","lastModified":"2020-07-31T15:00:00Z","published":"2018-08-16T12:00:00Z","sponsored":false},{"title":"How To Sync Folders With PowerShell","canonical":"https://www.business.com/articles/powershell-sync-folders/","slug":"powershell-sync-folders","thumbnail":"https://www.business.com/images/content/5cf/f157d9c658a99338b4568/1500-0-","dek":"There is software that will sync files and folders for you, and PowerShell can help.","lastModified":"2018-09-06T09:00:00Z","published":"2018-09-06T09:00:00Z","sponsored":false},{"title":"How To Manage User Profiles With PowerShell","canonical":"https://www.business.com/articles/powershell-manage-user-profiles/","slug":"powershell-manage-user-profiles","thumbnail":"https://www.business.com/images/content/5cf/ffdf07b4374ac348b4576/1500-0-","dek":"Managing Windows user profiles can be time consuming and tedious. Here are some tips.","lastModified":"2018-09-06T07:00:00Z","published":"2018-09-06T07:00:00Z","sponsored":false},{"title":"Delegate or Die – The Only Way to Grow Your Business","canonical":"https://www.business.com/articles/delegate-or-die/","slug":"delegate-or-die","thumbnail":"https://www.business.com/images/content/5b5/a95791039ebb1398b456e/1500-0-","dek":"Learn how to effectively delegate tasks to qualified employees.","lastModified":"2018-07-27T07:00:00Z","published":"2018-07-27T07:00:00Z","sponsored":false}],"relatedReviews":[{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5df908cc5a215e8c4a8b4568/conferencecall_Antonio_Diaz_Getty.jpg","canonical":"https://staging.business.com/categories/best-conference-call-services/","title":"The Best Conference Call Services of 2021","dek":"Which conference call service is right for your business in 2021? We review the top-rated services.","slug":"best-conference-call-services","lastModified":"2021-03-17T18:17:00Z"},{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5df3d8695a215e58428b4570/POS_GETTY_DERO2084.jpg","canonical":"https://staging.business.com/categories/best-pos-systems/","title":"The Best POS Systems of 2021","dek":"Before you choose a POS system, check out our reviews of the best picks for 2021. ","slug":"best-pos-systems","lastModified":"2021-03-17T17:33:00Z"},{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5e00d4787b43745d6a8b456e/Laptop_undrey_getty.jpg","canonical":"https://staging.business.com/categories/employee-monitoring-software/","title":"The Best Employee Monitoring Software of 2021","dek":"We've narrowed down the best employee monitoring software for businesses. Check out our best picks and reviews.","slug":"employee-monitoring-software","lastModified":"2021-03-05T15:40:00Z"}],"relatedSponsoredArticles":null}},"pageContext":{"displayModified":"2018-09-05T11:00:00.000Z","template":"v1","title":"How to Manage File System ACLs with PowerShell","meta":{"robots":"index, follow"},"docType":"articles","slug":"powershell-manage-file-system-acl","canonical":"https://staging.business.com/articles/powershell-manage-file-system-acl/","skipTOC":false}},"staticQueryHashes":[]}![\"\"](\"/images/content/5b6/a498651ee47d8748b4571/1200_-1028-)
![\"\"](\"/images/content/5b6/a49aa1039eb155f8b45e0/1200_-627-)
![\"\"](\"/images/content/5b6/a49d351ee47a1488b4582/460_-247-)