ICACLS and PowerShell permissions

482 views
Skip to first unread message

Glen Johnson

unread,
Jun 8, 2022, 11:08:03 AM6/8/22
to 'Jim Kennedy' via ntsysadmin

Any suggestion on this appreciated and sorry in advance for the long post.

We have a windows server 2019 file share that contains sub folders for each instructor to place course records.

I have created instructions for the assistant to use when creating new folders for each semester and instructor, but they haven’t been following them correctly.

So the structure is D:\Shares\Public\Course Records\Division\Semester\Instructor

My instructions say to remove inheritance from the instructor folder, converting permissions… and then adding the individual instructor account to the folder.

 

So now I’m trying to clean up at least the inheritance part using either icalcs or PowerShell, I get permissions denied on both.

I’ve tried logging on to the actual server as domain admin and local server admin.

And run both cmd and PowerShell as administrator.

 

For icacls ran

Icacls “D:\Shares\Public\Course Records\Division\Instructor” /inheritance:d

 

I run icacls with just the folder name and it returns this.

 

After fixing a folder using file manager, icacls returns this.

 

For PowerShell I ran.

$Folder = “D:\Shares\Public\Course Records\Division\Semester\Instructor”

$SourceACL = get-acl -Path $Folder

$SourceACL.SetAccessRuleProtection ($True, $True)

Set-ACL -Path $Folder -AclObject $SourceACL    This is where I get the error.

 

Using file manager I have no problem disabling inheritance and then removing “Domain Users” from the access list.

 

 

 

Tony Burrows

unread,
Jun 8, 2022, 3:09:40 PM6/8/22
to ntsys...@googlegroups.com

--
You received this message because you are subscribed to the Google Groups "ntsysadmin" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ntsysadmin+...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/ntsysadmin/5C68F5FA-A0B3-44E2-9360-A85FFD8C1691%40hxcore.ol.

Orlebeck, Geoffrey

unread,
Jun 8, 2022, 5:52:34 PM6/8/22
to ntsys...@googlegroups.com

Normally I try to stick with the standard cmdlets, but for NTFS ACLs I prefer to use the NTFSSecurity module. To remove inherited permissions you could do this (note: if you remove the “-RemoveInheritedAccessRules” parameter then it converts inherited permissions to explicitly defined permissions on the directory while still disabling inheritance):

 

$Folder = "D:\Shares\Public\Course Records\Division\Semester\Instructor"

Disable-NTFSAccessInheritance $Folder -RemoveInheritedAccessRules

 

As an aside, adding permissions is also much more user friendly (IMO) compared to Get/Set-ACL commands:

Add-NTFSAccess $Folder -Account 'CORP\user1' -AccessRights Modify -AppliesTo ThisFolderSubfoldersAndFiles

 

 

From: ntsys...@googlegroups.com <ntsys...@googlegroups.com> On Behalf Of Tony Burrows
Sent: Wednesday, June 8, 2022 12:09 PM
To: ntsys...@googlegroups.com
Subject: Re: [ntsysadmin] ICACLS and PowerShell permissions

 

You don't often get email from tiger...@gmail.com. Learn why this is important

ATTENTION: This email came from an external sender. If you don't recognize the source and it has unexpected or suspicious links or attachments, click the "Report Email" button (above) or send to: cyberalert @ chomp.org.
Confidentiality Notice: This is a transmission from Montage Health. This message and any attached documents may be confidential and contain information protected by state and federal medical privacy statutes. They are intended only for the use of the addressee. If you are not the intended recipient, any disclosure, copying, or distribution of this information is strictly prohibited. If you received this transmission in error, please accept our apologies and notify the sender. Thank you.

Kurt Buff

unread,
Jun 8, 2022, 6:28:11 PM6/8/22
to ntsys...@googlegroups.com
It's a sin to remove inheritance, either in a file structure or in AD, and you've just run into a problem which highlights that.

For directories, use the advanced security settings such as "Traverse Directory/execute file" and :"List folder/read data" along with other granular permissions, plus limitations such as "This folder only"/"This folder, subfolders. and files", etc.are much better.

I haven't implemented access-based enumeration, but that would probably help as well.

Kurt

--

Glen Johnson

unread,
Jun 9, 2022, 8:41:46 AM6/9/22
to ntsys...@googlegroups.com

Kurt.

Thanks for the info, I think.

So I can’t use Deny on domain users as the dean, assistant and instructor are also in domain users so all of them would lose access to the instructor folder.

 

So then I tested, re-enabling inheritance on one instructor folder, added domain user while unchecking “read & execute0” and read, set for this folder subfolders and files.

That appears to work, but after the setting is added, it doesn’t show up anywhere in the gui that domain users has been denied access.

Is that expected?  I know I could run the effective access and view it.

Also this way is much more complicated to setup, especially for the Dean’s assistant.

Maybe I need to re-think this whole setup.

And last, why is it bad to remove inheritance?  I did a quick search and nothing obvious popped up.

 

From: Kurt Buff
Sent: Wednesday, June 8, 2022 6:28 PM
To: ntsys...@googlegroups.com
Subject: Re: [ntsysadmin] ICACLS and PowerShell permissions

 

It's a sin to remove inheritance, either in a file structure or in AD, and you've just run into a problem which highlights that.

Michael B. Smith

unread,
Jun 9, 2022, 9:03:48 AM6/9/22
to ntsys...@googlegroups.com

It’s possible – although unlikely – for a malicious user to lock out administrators if inheritance is removed.

Glen Johnson

unread,
Jun 9, 2022, 11:06:32 AM6/9/22
to ntsys...@googlegroups.com

If that is the most serious side effect of disabling inheritance, I consider that very unlikely to happen here, so I’ll continue to use it as it works to provide the functionality we need.

And I did get all the folders fixed, using the GUI.

Thanks.

Glen.

Glen Johnson

unread,
Jun 9, 2022, 1:21:48 PM6/9/22
to ntsys...@googlegroups.com

Thanks for the advice.  I’ll try that if/when it is needed in the future.

Another PS question if anyone know.

I need a script the will copy files from source to destination, only if the source file last write time is newer that the last time the script was run.

So basically, set a script to run on a schedule and copy any new files since previous script run-time.

Here is what and it almost works.  Looks like the date or time must be larger than some unknown value.

I have 2 files in the In folder, one dated yesterday and one dated today.

The script always copies the one dated today, and does successfully update the last write time of the log file, but another run of the script and the same files is copied again even thoug the laswritedate is no older than the log file.

 

$SourcePath = "C:\In"

$DestPath = "C:\Out\"

$LogFile = "C:\PS-Scripts\Run-Date-Time.txt"

 

# Get last date-time script was run from $LogFile

$LastRun = get-item  $LogFile

 

# Get files at $Source-Path newer than $LastRun and copy to $DestPath

$FilesToCopy = Get-ChildItem -Path $SourcePath | where-object {$_.LastWriteTime -gt $LastRun.LastAccessTime.DateTime }

ForEach ($FileToCopy in $FilesToCopy)

{

Copy-Item ($SourcePath + "\" + $FileToCopy) ($DestPath + "\" + $FileToCopy)

# Echo files being copied for debugging

$FilesToCopy

}

 

# Update LastWriteDate to current date and time of Logfile.

$Lastrun.LastWriteTime = (Get-Date)

 

 

From: Tony Burrows
Sent: Wednesday, June 8, 2022 3:09 PM
To: ntsys...@googlegroups.com
Subject: Re: [ntsysadmin] ICACLS and PowerShell permissions

 

Orlebeck, Geoffrey

unread,
Jun 9, 2022, 1:25:43 PM6/9/22
to ntsys...@googlegroups.com

Robocopy has a switch to exclude older files. I think it’s /XD, but you can check “robocopy /?”

 

From: ntsys...@googlegroups.com <ntsys...@googlegroups.com> On Behalf Of Glen Johnson
Sent: Thursday, June 9, 2022 10:22 AM
To: ntsys...@googlegroups.com

Subject: RE: [ntsysadmin] ICACLS and PowerShell permissions

 

ATTENTION: This email came from an external sender. If you don't recognize the source and it has unexpected or suspicious links or attachments, click the "Report Email" button (above) or send to: cyberalert @ chomp.org.

Thanks for the advice.  I’ll try that if/when it is needed in the future.

Glen Johnson

unread,
Jun 9, 2022, 2:03:50 PM6/9/22
to ntsys...@googlegroups.com

Don’t look like that will work, or at least I can’t see from the docs, how to pass a date time parm to robocopy to only copy files newer than the most recent runtime.

After the files are copied, a process on the dest will pickup the files, process them and delete them.

So the dest only exists for a short time.  And unfortunately I don’t have write access to the source location or I could simply move them.

Another process on the source server removes the files after a certain age, I think 7 days.

Kurt Buff

unread,
Jun 9, 2022, 2:56:22 PM6/9/22
to ntsys...@googlegroups.com
Using Deny Aces is problematic as well, in part because they can be hard to troubleshoot if something goes wrong.

I'ts been a long time since I had to configure permissions on directory structures - if I have time this weekend I'll try to gather my thoughts.

But the basic approach was to remove User and Domain Users from the permissions at the root of the (non-OS) drive, and set up a share on a directory at the root of the drive giving everyone Full Control on the share. Then I'd use NTFS permissions on the directory in the manner I noted.

Kurt

Orlebeck, Geoffrey

unread,
Jun 9, 2022, 5:40:01 PM6/9/22
to ntsys...@googlegroups.com

In that case, I think it might be some of your code logic. What about something like this?

 

$SourcePath = "C:\In"

$DestPath = "C:\Out\"

$LogFile = "C:\PS-Scripts\Run-Date-Time.txt"

 

# Get last date-time script was run from $LogFile

[DateTime]$LastRun = (get-item  $LogFile).LastWriteTime

 

# Get files at $Source-Path newer than $LastRun and copy to $DestPath

$FilesToCopy = Get-ChildItem -Path $SourcePath | where-object { $_.LastWriteTime -gt $LastRun }

ForEach ($FileToCopy in $FilesToCopy) {

    Copy-Item $FileToCopy.FullName $DestPath -Force

    # Echo files being copied for debugging

    $FilesToCopy.Name # Or Fullname or whatever property you want

}

 

# Update LastWriteDate to current date and time of Logfile.

$Lastrun.LastWriteTime = (Get-Date)

 

Robert ECEO Townley

unread,
Jun 9, 2022, 5:59:52 PM6/9/22
to ntsys...@googlegroups.com

To view this discussion on the web visit https://groups.google.com/d/msgid/ntsysadmin/CADy1Ce6OrTniYOdOWhk9TAXjFung9Z4LirwVzG12e6RpYHsJvQ%40mail.gmail.com.
Reply all
Reply to author
Forward
0 new messages