While working on a little backup script I try to change the ACL of a file using Set-Acl in Powershell 1 on Vista and always get the following error message:

Set-Acl : The security identifier is not allowed to be the owner of this object.

This error persists even if I go a minimal script:

$acl = Get-Acl $sourcepath$file
$acl |format-list
Set-Acl -path $sourcepath$file -AclObject $acl

Does anyone know the reason for this error? Obviously I'm not changing the ownership of the file...

BTW: What I ultimately want to achieve is to reduce all access rights to ReadAndExecute. Is there maybe an easier way of doing this in Powershell?

Thanks for your help! Ulrich



From the post comment:

You're obviously getting this error because you're trying to change the owner of the object. By default NTFS will only allow you to set the owner of an object to:

A: Yourself
B: Administrators-group

That's it.

However, if you're an administrator or backup operator you can set it to any user, BUT this privilige is disabled by default and must be enabled before you can do so. In case you're wondering - this is a concious security restriction.

There are no .NET or PowerShell specific ways of enabling this, but if we leave Microsoft-territory and visit the PowerShell Community Extensions project we find a way...

I havent used PSCX that much and it's not a Microsoft product so any questions on them should be directed to www.codeplex.com/PowerShellCX rather than here, but here goes:

Download and install PSCX from www.codeplex.com/PowerShellCX

Set up a wrapper class for TokenPriviliege using the following syntax:

$oTP = New-Object PSCX.Interop.TokenPriviliege

Now, grant it to the current process:

Set-Privilege $oTP

You should now be able to change the owner of the folder to any user you wish.

| improve this answer | |
  • ok. Do I get you right that Set-Acl will always try to write the owner property of the file; even if the current owner and the "new" owner are identical? Is there a way to circumvent this, such that Set-ACL doesn't touch the owner property? (I only want to delete write access to the file for backup reasons.) – Ulrich Mar 25 '10 at 11:03
  • The Set-Acl cmdlet changes the security descriptor of a specified resource, such as a file or a registry key, to match the values in a security descriptor that you supply. – Vivek Kumbhar Mar 25 '10 at 11:33

Interesting error, what file/path are you using? Is it a system path, have you run powershell as an administrator (UAC)?

Your sample script will update the owner of the file, as it is part of the $acl.

| improve this answer | |
  • It's a normal file on a local hard-drive, no system path. I did run powershell using "Run As Administrator.". As i said above, is there a way to only modify some ACEs without touching the owner property? – Ulrich Mar 25 '10 at 11:05
  • Another thing that seems weird is that this code snippet (Get-Acl->Set-Acl) can be found all over the net, mostly without any reference to PSCX. Does that mean that everybody only tried it using his own files? – Ulrich Mar 25 '10 at 11:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy