Is there a way to create ACL's from scratch in powershell, as opposed to copying existing ones and modifying them?

Question

I know that I can copy existing ACLs using get-acl and then modify them using set-acl, but is there a way I can create a new, blank acl and then add in what I need? For example:

$foo = new-acl
#push some access rules into $foo
set-acl C:\myFolder $foo

Answer 1

Set-ACL will do what you need. You just need to tap into the .NET framework a little.

Have a look here http://technet.microsoft.com/en-us/library/ff730951.aspx

You basically use some .NET calls to create an ACL permissions object, attach a resource (like a user) that you are talking about, then apply it to the file or object in question.

Here's the syntax of what you'll be finding (in that article)

$colRights = [System.Security.AccessControl.FileSystemRights]"Read, Write" 

$InheritanceFlag = [System.Security.AccessControl.InheritanceFlags]::None 
$PropagationFlag = [System.Security.AccessControl.PropagationFlags]::None 

$objType =[System.Security.AccessControl.AccessControlType]::Allow 

$objUser = New-Object System.Security.Principal.NTAccount("wingroup\kenmyer") 

$objACE = New-Object System.Security.AccessControl.FileSystemAccessRule `
($objUser, $colRights, $InheritanceFlag, $PropagationFlag, $objType) 

$objACL = Get-ACL "C:\Scripts\Test.ps1" 
$objACL.AddAccessRule($objACE) 

Set-ACL "C:\Scripts\Test.ps1" $objACL

Answer 2

You need to use the .NET object:

$emptyACL = New-Object System.Security.AccessControl.DirectorySecurity

Note, I found this by using the Get-Member function to find the TypeName:

$ACL = Get-ACL C:\some_directory
$ACL | Get-Member
   TypeName: System.Security.AccessControl.DirectorySecurity
  Name                            MemberType     Definition
  ----                            ----------     ----------
  .........................................................

Answer 3

Matt's got the proper code there to do ACL's from scratch. I found it to be easier to create a blank file with the appropriate ACL's (minus the appropriate inherited permissions) and then use get-acl and set-acl.

Answer 4

so, in Matt's example, he is still COPYing the ACL of the script first, then modifying it and applying it to the new object. Is there any way to create an ACL(not an ACE!) from scratch, without using get-ACL first?