broken file permissions

spiceuser-pxb8e · 2021-04-14T06:15:16.000Z

Hello everyone,

I am facing an issue where there is a need to remove a BULK of old files and folders.

The problem is, in the entire folder structure there are several permission inheritances broken down the line, not only on folders but also on files. To make it more complex, I’m also not the owner of these files and folders so it’s nearly impossible to delete them.

I do get the folder permissions right, but because the inheritance is also broken on FILE level, I don’t seem to get it working.

Here is the code I have written which seems to work on the folders, but not on the files.

I use a drive mapping, because the folders go quite deep and exceed the 260 characters max file path length.

My apologies for the cryptic script, I’m fairly new to powershell and this forum.

#Declare folder and path location to delete

    $folders = Import-Csv -Path C:\temp\remove_folders_test.csv
    $path = *servername*

#Declare ACL variables

    $rights = 'FullControl'
    $inheritance = 'ContainerInherit, ObjectInherit'
    $identity = 'domainname\username'
    $propagation = 'None'
    $type = 'Allow'

    $owner = new-object System.Security.Principal.NTAccount("domain\username")

    $Permissions = New-Object System.Security.AccessControl.FileSystemAccessRule($identity,$rights,$inheritance,$propagation,$type)

#Enable permission inheritance on folder, subfolders & files

$folders | foreach {
   
    $fullpath = $path + "\" + $_.Foldername

 

            $acl = Get-Acl -Path $fullpath
            $acl.SetOwner($owner)
            $acl.AddAccessRule($Permissions)
            $acl.SetAccessRuleProtection($false, $true)

    Net Use /d K:
    Net use K: $fullpath
    write-host $fullpath

    $subfolder = Get-ChildItem -LiteralPath "K:" -Recurse -Force | Set-Acl -AclObject $acl | icacls.exe $subfolder /t /reset

    Remove-Item -LiteralPath $fullpath -Recurse -Force

}

Any help would be very much apreciated!

Neally · 2021-04-14T13:35:04.000Z

If you post code, please use the ‘Insert Code’ button. Please and thank you!

PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum! Programming & Development

Hi, and welcome to the PowerShell forum! Don’t apologize for being a “noob” or “newbie” or “n00b.” There’s just no need – nobody will think you’re stupid, and the forums are all about asking questions. Just ask! Use a descriptive subject. Don’t say “Need help” or “PowerShell Help”, actually summarize what the problem is. It helps the rest of us keep track of which problem is which. Don’t post massive scripts. We’re all volunteers and we don’t have time to read all that, nor will we copy…

Neally · 2021-04-14T13:36:18.000Z

I’d personally use takeown.exe and ICACL to do this.

gary-m-g · 2021-04-14T16:03:02.000Z

Neally beat me to it.
takeown followed by icacls

spiceuser-pxb8e · 2021-04-21T06:19:29.000Z

Thank you for your answers, unfortunately, this doesn’t seem to work.

-folder 1 (gets my acl properties

folder 2 (broken inheritance, gets my acl properties)
textfile 1 (broken inheritance, does not receive my acl properties)

It seems that all folders receive the correct permissions, but all the files on those folders, which all have broken inheritance, don’t.

The part that I am missing is, how do I get all files to receive these specific permissions as well.

Any feedback is greatly apreciated!

Neally · 2021-04-21T06:25:42.000Z

spiceuser-pxb8e:

Thank you for your answers, unfortunately, this doesn’t seem to work.

-folder 1 (gets my acl properties

folder 2 (broken inheritance, gets my acl properties)

textfile 1 (broken inheritance, does not receive my acl properties)

It seems that all folders receive the correct permissions, but all the files on those folders, which all have broken inheritance, don’t.

The part that I am missing is, how do I get all files to receive these specific permissions as well.

Any feedback is greatly apreciated!

What is not working? Did you try ICACLS and takeown? are you just talking about the script you posted?

If you are dead set on using ‘set-acl’

Use SetAccessRuleProtection() to disable inheritance and remove inherited ACEs

Use RemoveAccessRule() to remove existing (non-inherited) ACEs

Use AddAccessRule() to add new ACEs

Neally · 2021-04-21T06:34:34.000Z

with icacls you’d do soemthing like so to rest the permissions, and then you re-apply the new ones you want set.

icacls "C:\parentfolder" /reset /t /c