4

I'm trying to find all folders which do not inherit permissions.

This seems to work, sorta:

DIR "C:\temp" -directory -recurse | GET-ACL | select -ExpandProperty Access | ? -property IsInherited -eq $false

...but it leaves out the actual folder name.

How do I include folder names in the final output? It gets a little tricky for me because I need to filter on a property on an object (Access) within an object (whatever GET-ACL returns).

Any ideas?

1
  • you probably need to select the path property in your select statement. Then you need to loop each path to replace the spurious extra data that Get-ACL includes Microsoft.PowerShell.Core\FileSystem:: from each path. (you'll see) Aug 4, 2014 at 20:29

5 Answers 5

12

Scratch that, I'm an idiot.

DIR "C:\temp" -directory -recurse | GET-ACL | where {$_.Access.IsInherited -eq $false}
3

I think other answers don't really match your request: the commands suggested give you all non-inherited access rule, but also an inheriting folder may have such rules.

I was looking for a better way to achieve your same goal, but at the moment this is the only way I've found:

Get-ChildItem C:\temp -recurse | Select @{Name='Path';Expression={$_.FullName}},@{Name='InheritedCount';Expression={(Get-Acl $_.FullName | Select -ExpandProperty Access | Where { $_.IsInherited }).Count}} | Where { $_.InheritedCount -eq 0 } | Select Path

The concept is: if a folder has at least 1 inherited access rule, then inheritance is enabled, if it has 0 inherited rules, inheritance is disabled.

2

All answers still seem like a workaround to me. I found this solution to actually answer the question asked (folders only):

$folders = gci -recurse C:\My\Path\Here
foreach ($path in $folders)
{
  if ($path.PSIsContainer -eq $false)
  {
    continue
  }
  if ((get-acl $path.fullname).AreAccessRulesProtected -eq $true)
  {
    $path.fullname
  }
}

For the .AreAccessRulesProtected property of the returned get-acl object:

True = inheritance has been disabled

False = inheritance is still enabled

Source for .AreAccessRulesProtected property: https://petri.com/identify-folders-with-blocked-inheritance-using-powershell

I also confirmed with my own testing that this is the correct property for folder inheritance.

0
1

You can use Add-Member to add the path as a property on each ACE object:

dir c:\temp -Directory -Recurse | ForEach-Object {
    $Path = $_.FullName
    try {
        Get-Acl $Path | 
            select -ExpandProperty Access | 
            where { $_.IsInherited -eq $false } | 
            Add-Member -MemberType NoteProperty -Name Path -Value $Path -PassThru
    }
    catch {
        Write-Error $_
    }
}

I also wrapped Get-Acl in a try block because it throws terminating errors.

0

Luca's answer gave me false positives for folders with [ in their names. Not sure why.

Adapted Rohn's script to print how many acls are actually not inherited from the parent. If folder has some out of all - it means the inheritance is enabled but some permissions are added manually, if all out of all - it means the inheritance is disabled.

Write-Output "`nNoninheritable permissions:`n"
dir "E:\Projects" -Directory -Recurse | ForEach-Object {
    $Path = $_.FullName
    try {
        $TotalACLs = (Get-Acl $Path | select -ExpandProperty Access).Count
        $InheritedCount = (Get-Acl $Path | select -ExpandProperty Access | where { $_.IsInherited -eq $false } | Add-Member -MemberType NoteProperty -Name Path -Value $Path -PassThru | Select Path).Count
        if ($InheritedCount) {
            Write-Output $InheritedCount" out of "$TotalACLs" in "$Path
        }
    }
    catch {
        Write-Error $_
    }
}

The example result:

Noninheritable permissions:

2 out of 7 in E:\Projects\Active Project

2 out of 8 in E:\Projects\Active Projects\Claire\7. CHRISTMAS\

4 out of 4 in E:\Projects\Active Projects\Closed Projects\Andrea\IT\14.07 Kath - CIMS

2
  • Is there any workaround if im getting pathtoolong exceptions?
    – Johny Wave
    Oct 26, 2021 at 12:15
  • Can confirm that [ is problematic, PowerShell 7.2.5. Absolutely bamboozled why!
    – kkm
    Jul 1, 2022 at 19:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.