6

I'm pretty new to powershell scripting (nearly 1 month since I started learning powershell.)

I'm currently working on a script with powershell 2.0 to clean folder NTFS ACL. I want to delete every acl except the administrator one.

My problem is that I can't find a way to delete every acl that are not administrator, without knowing them.

So I came here to sought for powershell pro.

4 Answers 4

11

This code remove acl :

$acl = Get-Acl \\remote_server\share_folder\HAL.9000
$acl.Access | %{$acl.RemoveAccessRule($_)}

This code add administrator acl :

#BUILTIN administrator

$acl = Get-Acl \\remote_server\share_folder\HAL.9000
$permission  = "BUILTIN\Administrators","FullControl", "ContainerInherit,ObjectInherit","None","Allow"
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission
$acl.SetAccessRule($accessRule)
Set-Acl \\remote_server\share_folder\HAL.9000 $acl

#Domain controller administrator

$acl = Get-Acl \\remote_server\share_folder\HAL.9000
$permission  = "DOMAINCONTROLLER\Administrators","FullControl", "ContainerInherit,ObjectInherit","None","Allow"
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission
$acl.SetAccessRule($accessRule)
Set-Acl \\remote_server\share_folder\HAL.9000 $acl

Hope this will help someone :)

3
  • 1
    Don't you have to disable inheritance before you are able to remove the inherited rules? Nov 2, 2011 at 17:52
  • Well you certainly have to disable inheritance, but using inheritance is a bad move for sharing server, you'll screw up everything with this, so I always disable them when I create a new server, this way it's not a problem. As far as my script work, the inheritance wasn't a problem, the script remove the acl and create a new one that is clean. Will try to find a way to disable inheritance if a problem arise. Apr 2, 2012 at 19:17
  • Hi, it doenst work anymore. I get following error: Exception calling "SetAccessRule" with "1" argument(s): "Some or all identity references could not be translated." At line:27 char:1 + $acl.SetAccessRule($accessRule) + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [], MethodInvocationException + FullyQualifiedErrorId : IdentityNotMappedException
    – Luca
    Jun 2 at 7:54
7

For convenience I've copy/pasted all this stuff together in a function. If it can be of use to anyone, here it is:

Function Remove-ACL {    
    [CmdletBinding(SupportsShouldProcess=$True)]
    Param(
        [parameter(Mandatory=$true,ValueFromPipeline=$true,Position=0)]
        [ValidateNotNullOrEmpty()]
        [ValidateScript({Test-Path $_ -PathType Container})]
        [String[]]$Folder,
        [Switch]$Recurse
    )

    Process {

        foreach ($f in $Folder) {

            if ($Recurse) {$Folders = $(Get-ChildItem $f -Recurse -Directory).FullName} else {$Folders = $f}

            if ($Folders -ne $null) {

                $Folders | ForEach-Object {

                    # Remove inheritance
                    $acl = Get-Acl $_
                    $acl.SetAccessRuleProtection($true,$true)
                    Set-Acl $_ $acl

                    # Remove ACL
                    $acl = Get-Acl $_
                    $acl.Access | %{$acl.RemoveAccessRule($_)} | Out-Null

                    # Add local admin
                    $permission  = "BUILTIN\Administrators","FullControl", "ContainerInherit,ObjectInherit","None","Allow"
                    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission
                    $acl.SetAccessRule($rule)

                    Set-Acl $_ $acl

                    Write-Verbose "Remove-HCacl: Inheritance disabled and permissions removed from $_"
                }
            }
            else {
                Write-Verbose "Remove-HCacl: No subfolders found for $f"
            }
        }
    }
}

Usage:

# For only one folder:
Remove-ACL 'C:\Folder' -Verbose

# For all subfolders:
Remove-ACL 'C:\Folder' -Recurse -Verbose

# Pipe stuff
'C:\Folder 1', 'C:\Folder 2' | Remove-ACL -Verbose
2

This code remove acl : $acl = Get-Acl \remote_server\share_folder\HAL.9000 $acl.Access | %{$acl.RemoveAccessRule($_)}

it does not work until you do

Set-Acl \\remote_server\share_folder\HAL.9000 $acl
1

Why not create a new list. For example:

$identity = New-Object System.Security.Principal.NTAccount('NT AUTHORITY\SYSTEM')
$acl = New-Object System.Security.AccessControl.DirectorySecurity
$acl.SetOwner($identity)
$acl.SetGroup($identity)
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule('NT AUTHORITY\SYSTEM', ’FullControl’, ’ContainerInherit, ObjectInherit’, ’None’,’Allow’)
$acl.AddAccessRule($rule)
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule('BUILTIN\Administrators', ’FullControl’, ’ContainerInherit, ObjectInherit’, ’None’, ’Allow’)
$acl.AddAccessRule($rule)
Set-Acl -LiteralPath "C:\MyFolder" -AclObject $acl
Get-Acl -LiteralPath "C:\MyFolder" | Format-List

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.