Following on from the recent set of posts about setting security permissions on shares I thought it about time I looked at the file system security permissions. PowerShell supplies 2 cmdlets, in the core engine, Get-Acl and Set-Acl for workign with permissions. These two cmdlets are part of the Microsoft.PowerShell.Security module.
Many Powershell users shy away from these 2 cmdlets – they do have a reputation for being hard to use. This series of articles is meant to make these very useful cmdlets more accessible and easier to use.
Get-Acl is the obvious starting point – you need to know what ACLs exist on a given object.
£> Get-Acl -Path c:\test | Format-Table -a
Directory: C:\
Path Owner Access
—- —– ——
test RSSURFACEPRO2\Richard BUILTIN\Administrators Allow FullControl…
The Format-Table is only used to condense the width of the output.
The default display shown above isn’t that helpful so lets try a list display.
£> Get-Acl -Path c:\test | Format-List
Path : Microsoft.PowerShell.Core\FileSystem::C:\test
Owner : RSSURFACEPRO2\Richard
Group : RSSURFACEPRO2\Richard
Access : BUILTIN\Administrators Allow FullControl
NT AUTHORITY\SYSTEM Allow FullControl
BUILTIN\Users Allow ReadAndExecute, Synchronize
NT AUTHORITY\Authenticated Users Allow Modify, Synchronize
NT AUTHORITY\Authenticated Users Allow -536805376
Audit :
Sddl : O:S-1-5-21-2502823385-1436278615-3517788930-1001G:S-1-5-21-2502823385-1436278615-3517788930-1001D:AI(A;OICIID;
FA;;;BA)(A;OICIID;FA;;;SY)(A;OICIID;0x1200a9;;;BU)(A;ID;0x1301bf;;;AU)(A;OICIIOID;SDGXGWGR;;;AU)
That starts to look a bit more useful. The Access and Sddl properties hold what you need.
If you dive straight into retreiving the Access property:
£> Get-Acl -Path c:\test | select -ExpandProperty Access
FileSystemRights : FullControl
AccessControlType : Allow
IdentityReference : BUILTIN\Administrators
IsInherited : True
InheritanceFlags : ContainerInherit, ObjectInherit
PropagationFlags : None
etc
You will see an entry similar to the above for each security setting on the object. What would be simpler to work with is the way the Access property is presented when using Format-List. If you examine the complete object produced by Get-Acl:
£> Get-Acl | Format-List *
PSPath : Microsoft.PowerShell.Core\FileSystem::C:\MyData\SkyDrive\Data\scripts
PSParentPath :
Microsoft.PowerShell.Core\FileSystem::C:\MyData\SkyDrive\Data
PSChildName : scripts
PSDrive : C
PSProvider : Microsoft.PowerShell.Core\FileSystem
CentralAccessPolicyId :
CentralAccessPolicyName :
AccessToString : BUILTIN\Administrators Allow FullControl
NT AUTHORITY\SYSTEM Allow FullControl
BUILTIN\Users Allow ReadAndExecute, Synchronize
NT AUTHORITY\Authenticated Users Allow Modify, Synchronize
NT AUTHORITY\Authenticated Users Allow -536805376
AuditToString :
Path : Microsoft.PowerShell.Core\FileSystem::C:\MyData\SkyDrive\Data\scripts
Owner : RSSURFACEPRO2\Richard
Group : RSSURFACEPRO2\Richard
Access : {System.Security.AccessControl.FileSystemAccessRule,
System.Security.AccessControl.FileSystemAccessRule,
System.Security.AccessControl.FileSystemAccessRule,
System.Security.AccessControl.FileSystemAccessRule…}
Sddl : O:S-1-5-21-2502823385-1436278615-3517788930-1001G:S-1-5-21-2502823385-1436278615-3517788930-1
001D:AI(A;OICIID;FA;;;BA)(A;OICIID;FA;;;SY)(A;OICIID;0x1200a9;;;BU)(A;ID;0x1301bf;;;AU)(A;OIC
IIOID;SDGXGWGR;;;AU)
AccessRightType : System.Security.AccessControl.FileSystemRights
AccessRuleType : System.Security.AccessControl.FileSystemAccessRule
AuditRuleType : System.Security.AccessControl.FileSystemAuditRule
AreAccessRulesProtected : False
AreAuditRulesProtected : False
AreAccessRulesCanonical : True
AreAuditRulesCanonical : True
What you need to display is the AccessToString property:
£> Get-Acl | select -ExpandProperty AccessToString
BUILTIN\Administrators Allow FullControl
NT AUTHORITY\SYSTEM Allow FullControl
BUILTIN\Users Allow ReadAndExecute, Synchronize
NT AUTHORITY\Authenticated Users Allow Modify, Synchronize
NT AUTHORITY\Authenticated Users Allow -536805376
Which gives a very nice summary of the permissions.
If you want to stick with working with objects then use something like this to duplicate the display
Get-Acl |
select -ExpandProperty Access |
select IdentityReference, AccessControlType,FileSystemRights