Removing all ACL on folder with powershell

Question

I'm pretty new to powershell scripting (nearly 1 month since I started learning powershell.)

I'm currently working on a script with powershell 2.0 to clean folder NTFS ACL. I want to delete every acl except the administrator one.

My problem is that I can't find a way to delete every acl that are not administrator, without knowing them.

So I came here to sought for powershell pro.

Senhor

Answer 1

This code remove acl :

$acl = Get-Acl \\remote_server\share_folder\HAL.9000
$acl.Access | %{$acl.RemoveAccessRule($_)}

This code add administrator acl :

#BUILTIN administrator

$acl = Get-Acl \\remote_server\share_folder\HAL.9000
$permission  = "BUILTIN\Administrators","FullControl", "ContainerInherit,ObjectInherit","None","Allow"
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission
$acl.SetAccessRule($accessRule)
Set-Acl \\remote_server\share_folder\HAL.9000 $acl

#Domain controller administrator

$acl = Get-Acl \\remote_server\share_folder\HAL.9000
$permission  = "DOMAINCONTROLLER\Administrators","FullControl", "ContainerInherit,ObjectInherit","None","Allow"
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission
$acl.SetAccessRule($accessRule)
Set-Acl \\remote_server\share_folder\HAL.9000 $acl

Hope this will help someone :)

Senhor

Don't you have to disable inheritance before you are able to remove the inherited rules? – Bignonia

Well you certainly have to disable inheritance, but using inheritance is a bad move for sharing server, you'll screw up everything with this, so I always disable them when I create a new server, this way it's not a problem. As far as my script work, the inheritance wasn't a problem, the script remove the acl and create a new one that is clean. Will try to find a way to disable inheritance if a problem arise. – Senhor

Hi, it doenst work anymore. I get following error: Exception calling "SetAccessRule" with "1" argument(s): "Some or all identity references could not be translated." At line:27 char:1 + $acl.SetAccessRule($accessRule) + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [], MethodInvocationException + FullyQualifiedErrorId : IdentityNotMappedException – Strudel

Answer 2

For convenience I've copy/pasted all this stuff together in a function. If it can be of use to anyone, here it is:

Function Remove-ACL {    
    [CmdletBinding(SupportsShouldProcess=$True)]
    Param(
        [parameter(Mandatory=$true,ValueFromPipeline=$true,Position=0)]
        [ValidateNotNullOrEmpty()]
        [ValidateScript({Test-Path $_ -PathType Container})]
        [String[]]$Folder,
        [Switch]$Recurse
    )

    Process {

        foreach ($f in $Folder) {

            if ($Recurse) {$Folders = $(Get-ChildItem $f -Recurse -Directory).FullName} else {$Folders = $f}

            if ($Folders -ne $null) {

                $Folders | ForEach-Object {

                    # Remove inheritance
                    $acl = Get-Acl $_
                    $acl.SetAccessRuleProtection($true,$true)
                    Set-Acl $_ $acl

                    # Remove ACL
                    $acl = Get-Acl $_
                    $acl.Access | %{$acl.RemoveAccessRule($_)} | Out-Null

                    # Add local admin
                    $permission  = "BUILTIN\Administrators","FullControl", "ContainerInherit,ObjectInherit","None","Allow"
                    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission
                    $acl.SetAccessRule($rule)

                    Set-Acl $_ $acl

                    Write-Verbose "Remove-HCacl: Inheritance disabled and permissions removed from $_"
                }
            }
            else {
                Write-Verbose "Remove-HCacl: No subfolders found for $f"
            }
        }
    }
}

Usage:

# For only one folder:
Remove-ACL 'C:\Folder' -Verbose

# For all subfolders:
Remove-ACL 'C:\Folder' -Recurse -Verbose

# Pipe stuff
'C:\Folder 1', 'C:\Folder 2' | Remove-ACL -Verbose

Mesdames

Answer 3

This code remove acl : $acl = Get-Acl \remote_server\share_folder\HAL.9000 $acl.Access | %{$acl.RemoveAccessRule($_)}

it does not work until you do

Set-Acl \\remote_server\share_folder\HAL.9000 $acl

Anthracite

Answer 4

Why not create a new list. For example:

$identity = New-Object System.Security.Principal.NTAccount('NT AUTHORITY\SYSTEM')
$acl = New-Object System.Security.AccessControl.DirectorySecurity
$acl.SetOwner($identity)
$acl.SetGroup($identity)
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule('NT AUTHORITY\SYSTEM', ’FullControl’, ’ContainerInherit, ObjectInherit’, ’None’,’Allow’)
$acl.AddAccessRule($rule)
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule('BUILTIN\Administrators', ’FullControl’, ’ContainerInherit, ObjectInherit’, ’None’, ’Allow’)
$acl.AddAccessRule($rule)
Set-Acl -LiteralPath "C:\MyFolder" -AclObject $acl
Get-Acl -LiteralPath "C:\MyFolder" | Format-List

Loudmouthed