Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I know that I can copy existing ACLs using get-acl and then modify them using set-acl, but is there a way I can create a new, blank acl and then add in what I need? For example:

$foo = new-acl
#push some access rules into $foo
set-acl C:\myFolder $foo
share|improve this question

2 Answers 2

You need to use the .NET object:

$emptyACL = New-Object System.Security.AccessControl.DirectorySecurity

Note, I found this by using the Get-Member function to find the TypeName:

$ACL = Get-ACL C:\some_directory
$ACL | Get-Member
   TypeName: System.Security.AccessControl.DirectorySecurity
  Name                            MemberType     Definition
  ----                            ----------     ----------
share|improve this answer

Set-ACL will do what you need. You just need to tap into the .NET framework a little.

Have a look here http://technet.microsoft.com/en-us/library/ff730951.aspx

You basically use some .NET calls to create an ACL permissions object, attach a resource (like a user) that you are talking about, then apply it to the file or object in question.

Here's the syntax of what you'll be finding (in that article)

$colRights = [System.Security.AccessControl.FileSystemRights]"Read, Write" 

$InheritanceFlag = [System.Security.AccessControl.InheritanceFlags]::None 
$PropagationFlag = [System.Security.AccessControl.PropagationFlags]::None 

$objType =[System.Security.AccessControl.AccessControlType]::Allow 

$objUser = New-Object System.Security.Principal.NTAccount("wingroup\kenmyer") 

$objACE = New-Object System.Security.AccessControl.FileSystemAccessRule `
($objUser, $colRights, $InheritanceFlag, $PropagationFlag, $objType) 

$objACL = Get-ACL "C:\Scripts\Test.ps1" 

Set-ACL "C:\Scripts\Test.ps1" $objACL
share|improve this answer
This will add to the ACL and not create one from scratch. –  Alain O'Dea May 11 '12 at 13:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.