Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Could someone explain something to me? If I run the command (get-acl .\test.txt) | Select-Object owner, I get


which is what I was expecting. However, if I run the command (get-acl .\test.txt) | Select-Object Access, I get this:

{System.Security.AccessControl.FileSystemAccessRule,System.Security.AccessControl.FileSystemAccessRule, System.Security.AccessControl.FileSystemAccessRule}  

instead of the list of the users/groups who have permissions on that file and what those permissions are. So what am I doing wrong?

share|improve this question
I should probably give some background as to what I am trying to do. There is a certain file on multiple machines that may have different permissions from one machine to the next. I am trying to write a script that will list out the users with access to the file and remove ones that I don't want. – Alex Apr 14 '11 at 19:35
up vote 3 down vote accepted

The Access property contains an array. You can expand it without walking a loop:

Get-Acl .\test.txt | Select-Object -ExpandProperty Access
share|improve this answer

Those objects don't have a pretty string conversion when you're trying to print them, so they spit out their object type.

Try something along these lines:

(get-acl .\test.txt) | Select-Object Access | foreach-object { $_.identityreference }
share|improve this answer
Thanks! That output was blank but that pointed me in the right direction. The following gives me what I need: (Get-Acl .\test.txt).Getaccessrules($true, $true, [System.Security.Principal.NTAccount]) | Select-Object IdentityReference – Alex Apr 14 '11 at 19:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.