2

I ran get-acl -path "D:\path\to\file" | fl:

Path   : Microsoft.PowerShell.Core\FileSystem::D:\path\to\file
Owner  : SERVER\user
Group  : G:S-1-5-21-467825353-2970891935-3496973838-513

I want to modify the Group value.

I'm able to find a lot of articles about modifying the owner, but not so much about the Group.

Improve this question

1 Answer 1

Reset to default
3

I'm not sure that modifying the group value will do what you think it will.

The Group value displayed in the output of get-acl refers to the security group of the owner (in your case the security group of Server\user).

Also, bear in mind that Get-ACL does only that - it gets ACL records. It does not set ACL records.

If you are trying to grant a specific domain security group access to a file or folder you want to use these commands:

$newacl = New-Object System.Security.AccessControl.FileSystemAccessRule ("domain\username","ACCESSLEVEL","ACTION")
$object = Get-ACL "\\server\pathtofolder"
$object.SetAccessRule($newacl)
Set-ACL -Path "\\server\pathtofolder" -AclObject $newacl

If you want to copy the NTFS permissions on a folder on Server A to a folder on Server B this should do what you want.

$newacl = New-Object System.Security.AccessControl.FileSystemAccessRule ("domain\username","ACCESSLEVEL","ACTION")
$server1object = Get-ACL "\\server1\pathtofolder"
$server2object = $server1object
$server2object.SetAccessRule($newacl)
Set-ACL -Path "\\server2\pathtofolder" -AclObject $newacl

If you would prefer using a PowerShell script, you can use the code above to make your own.

ACCESSLEVEL would be replaced with the appropriate permission level (e.g. FullControl or Read).

ACTION would be replaced with Allow or Deny.

Now, I have answered your question, but I realize you may prefer a pre-made PowerShell script.

There are also pre-made PowerShell scripts to manage NTFS permissions.

You can find some at "Hey, Scripting! Blog" (https://blogs.technet.microsoft.com/heyscriptingguy/2014/11/22/weekend-scripter-use-powershell-to-get-add-and-remove-ntfs-permissions/) and CodePlex (https://ntfssecurity.codeplex.com/).

Improve this answer
5
  • 1
    The only reason is that I'm trying to replicate the ACL from one server to another (TEST vs PROD). I'm essentially using Get-Acl to compare and using the UI to mirror. They're all local user accounts/groups (in one case, we should have used a Domain/Service account, too late now). I also have a background in Linux, where it's a one liner. This is the purpose of my question.
    – TechFanDan
    Feb 4, 2016 at 23:07
  • I am going to update my answer to specifically do what you are asking. That is really cool too. I did not think about replicating security permissions for a specific directory on one server to a specific directory on another server. :)
    – user5870571
    Feb 4, 2016 at 23:25
  • What happens to SIDs in such an operation? Does it matter?
    – TechFanDan
    Feb 5, 2016 at 0:19
  • What do you mean what happens to SIDs? SIDs are the unique identifiers for the accounts. If both servers are on the same domain, copying the permissions from server A to server B still references the same domain security group (i.e. SID).
    – user5870571
    Feb 5, 2016 at 0:20
  • If this answers your question, please feel free to mark the answer as correct.
    – user5870571
    Feb 5, 2016 at 1:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .