PowerShell | Script to Update Access Control List (ACL)
Windows Access Control Lists (ACLs) are an essential feature for managing permissions and security in the Windows operating system. They provide a detailed mechanism for defining who can access or modify objects, such as files, folders, and registry keys, and what actions they are allowed to perform on these objects. Here’s a detailed overview of Windows ACLs:
​
Components of Windows ACLs
-
Objects:
-
Files and Folders: Common objects that have ACLs.
-
Registry Keys: Specific keys within the Windows Registry.
-
Other Objects: Includes printers, network shares, and more.
-
-
Security Descriptors:
-
Each object that can have permissions assigned to it has a security descriptor.
-
The security descriptor contains the ACL.
-
-
ACL Types:
-
DACL (Discretionary Access Control List): Specifies the permissions for users and groups. A DACL controls access to an object. If no DACL is present, the system grants full access to everyone.
-
SACL (System Access Control List): Used for auditing purposes. It specifies which actions by users or groups should be logged.
-
-
Access Control Entries (ACEs):
-
An ACL is made up of multiple ACEs.
-
Each ACE defines a user's or group's access rights to an object.
-
ACEs can be allow or deny entries.
-
-
Appends the ACL to NTFS Permissions on a folder.
-
Leaves inheritance in place.
PowerShell Script Set ACL in NTFS
<#
.SYNOPSIS
PowerShell Script to Add User to NTFS ACL
.DESCRIPTION
Required - Set Identiy
Required - Set MyDir (Folder Path)
Creates an ACE and Assigns to Folder
Assigns Full Control
Keeps Inheritance
.Author
Scott Head
ScriptsbyScott.com
#>
# //// Create the Access Control Entry \\\\
#Assign User or Group
$identity = 'MyLocalForest\Shead'
#assign Directory to Change Permissions on
$MyDir = "C:\Temp"
#Set the Rights the Account will have
$rights = 'FullControl'
#Set to allow inheritance still
$inheritance = 'ContainerInherit, ObjectInherit'
#Will Propagate to subfolder as long as inheritance isn't broken
$propagation = 'None'
#Set and Allow vs Disallow
$type = 'Allow'
#builds the Access Control Entry
$ACE = New-Object System.Security.AccessControl.FileSystemAccessRule($identity,$rights,$inheritance,$propagation, $type)
#Pulls in the Current Access Control List
$Acl = Get-Acl -Path $MyDir
#Command to Insert access control entry into current access control list
$Acl.AddAccessRule($ACE)
#Sets the Access Control List onto the Dir
Set-Acl -Path $MyDir -AclObject $Acl
