$Account = new-object system.security.principal.ntaccount("SyncProcess")
try
{
    $sid = $Account.translate([system.security.principal.securityidentifier])
}
catch
{
echo "Not a valid user"
}
if ($sid -ne $null)
{
    $acl = get-owner "c:\MyFolder"
    $acl.setowner($account)
    set-acl -aclobject $acl "c:\MyFolder"
}

and how you restore ownership back to original? SetOwner() wouldn't work..

• Marked as answer by Mervyn ZhangModerator Monday, November 30, 2009 9:02 AM

You need to ask in PSCX home page.
http://www.codeplex.com/PowerShellCX

unfrtunately you cannot change file/folder permissions using Set-ACL if you are not an owner of this file/folder. You need use icacls.exe utili

I find myself agreeing with Mike here.

I'm trying to use Powershell for as many functions as possible, but not being able to set permissions using a function called 'Set-Acl' makes no sense to me.

I'd disagree, just because they didnt wrap every possible situation in to a spiffy little cmdlet doesnt mean its a lame restriction... it might be lame that they didnt think of that, but, the cool part is there is ALWAYS a way around it with powershell.... I have never worked with a scripting language so powerful that I could do ANYTHING I wanted... sure, not all of its as simple as running a built in cmdlet... but that would be a LOT of work, and we wouldnt have powershell yet... so I'll take it as is and look to the community to build small functions that simplify the things the powershell team wasnt able to wrap in to their cmdlet set.

come complain to me when you find something that just cant be done :)

• Proposed as answer by Qbic808 Friday, December 16, 2011 11:47 AM
• Unproposed as answer by Qbic808 Friday, December 16, 2011 11:47 AM

I found this article worked around the issue of having to change ownership in order to set ACL's.

May be of use:

http://www.bilalaslam.com/2010/12/14/powershell-workaround-for-the-security-identifier-is-not-allowed-to-be-the-owner-of-this-object-with-set-acl/

• Proposed as answer by Jake Schmidt Friday, February 22, 2013 5:58 PM

There is a way to do this without using the PSCX extensions.  Lee Holmes has a great script that will accomplish the same goal.  Although its a bit lengthy as compared to the "Set-Privilege" command, I prefer it since I can't have the pscx extension on all the desired destinations.

http://www.leeholmes.com/blog/2010/09/24/adjusting-token-privileges-in-powershell/

The link from Qbic808 doesn't go anywhere useful anymore. The new hotness answer is from here.

E.g. You have a file that has the ACL you want ("source.txt") and you want to set those permissions on a bunch of other files ("*.csv"). Just run this (elevated PowerShell, of course):

(Get-Item source.txt).GetAccessControl('Access') | Set-Acl *.csv

It won't try to change the ownership of the file.

Old thread I know however this problem has been troubling me for some time and comes up now and again. I was determined to solve it and I  now believe I have done so. This workaround uses .NET static methods of the underlying [System.IO.File] and [System.IO.Directory] classes respectively.

Function Set-FilePathPermission()
{
 	[CmdletBinding(PositionalBinding=$false)]
    Param(
	    [Parameter(Mandatory=$True)][string][ValidateNotNullOrEmpty()][ValidateScript({Test-Path $_})] $Path, 
	    [Parameter(Mandatory=$True)][string][ValidateNotNullOrEmpty()] $Identity,
	    [Parameter(Mandatory=$True)][System.Security.AccessControl.FileSystemRights] $Permission,
		[Parameter(Mandatory=$false)][string][ValidateSet("Allow","Deny")] $Action = "Allow",
		[Switch] $DisablePropagation
    )

    #Show all permissions that can be assigned [Enum]::GetNames([System.Security.AccessControl.FileSystemRights])

    Write-Host "Setting ""$Action"" ""$Permission"" permissions for identity ""$Identity"" to ""$Path""" -ForegroundColor Cyan

    $item = Get-Item -Path $Path
    	
	#If the path that we are setting permission to is a folder then consider inheriatance and propagation
	if ($item -is [System.IO.DirectoryInfo])
	{
		$inherit = [System.Security.AccessControl.InheritanceFlags] "ContainerInherit, ObjectInherit"
    	if ($DisablePropagation)
		{
			$propagation = [System.Security.AccessControl.PropagationFlags] "NoPropagateInherit"
		}
		else
		{
			$propagation = [System.Security.AccessControl.PropagationFlags] "None"
		}
		$acl = [System.IO.Directory]::GetAccessControl($Path)
		$permissionRule = $Identity, $Permission, $inherit, $propagation, $Action
        $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permissionRule
        $acl.AddAccessRule($accessRule)
        [System.IO.Directory]::SetAccessControl($Path,$acl)
	}
	elseif ($item -is [System.IO.FileInfo])
	{
		$acl = [System.IO.File]::GetAccessControl($Path)
        $permissionRule = $Identity, $Permission, $Action
        $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permissionRule
        $acl.AddAccessRule($accessRule)
        [System.IO.File]::SetAccessControl($Path, $acl)
	}
    else
    {
        Throw "Unknown file type for path ""$Path"""
    }
}

• Proposed as answer by reidca Wednesday, March 19, 2014 8:17 AM

This function "Set-FilePathPermission" is fantastic!  However, if inheritance is broken in a sub folder then this function stops and won't go any further.  Is there anything that can be added to enable inheritance and continue adding in permissions?  I'm relatively new to Powershell and have tried searching around trying to find this answer myself but all the examples I've come across assumes that proper permission is already in place in order to enable inheritance.

I'm using this particular function for my users profiles stored on a file server.  I want to make sure BUILTIN\Administrators is part of every folder and file object.

Thank you! 

This topic has been closed for years (6 years).  Please open a new topic with your new issue.