Hi guys,<\/p>\n

Advertisement

i’ve been looking at this for the whole day not knowing what I’m doing wrong.<\/p>\n

Advertisement

I’ll start by saying the goal is to create a personal home folder for users.
\nI don’t want the folder to inherit right.<\/p>\n

The command works but permissions are weird.
\nThe ntfs are blank but once i open advanced permission i see them.
\nBut it doesnt work.<\/p>\n

Here’s the script:<\/p>\n

New-item \\\\server\\Users$\\jeaeli -type directory\n$acl = Get-Acl \\\\server\\Users$\\jeaeli\n$acl | Format-List\n$acl.GetAccessRules($true, $true, [System.Security.Principal.NTAccount])\n$acl.SetAccessRuleProtection($true, $false)\n$acl1 = New-Object System.Security.AccessControl.FileSystemAccessRule \"domain\\jeaeli\",\"Modify\", \"ContainerInherit, ObjectInherit\", \"InheritOnly\", \"Allow\"\n$acl2 = New-Object System.Security.AccessControl.FileSystemAccessRule \"domain\\ITBEXC\",\"FullControl\", \"ContainerInherit, ObjectInherit\", \"InheritOnly\", \"Allow\"\n$acl3 = New-Object System.Security.AccessControl.FileSystemAccessRule \"domain admins\",\"FullControl\", \"ContainerInherit, ObjectInherit\", \"InheritOnly\", \"Allow\"\n$acl.addAccessRule($acl1)\n$acl.addAccessRule($acl2)\n$acl.addAccessRule($acl3)\nSet-Acl \\\\server\\Users$\\jeaeli $acl\n<\/code><\/pre>\n
I also don’t want module to add.
\nAny help is appreciated<\/p>","upvoteCount":5,"answerCount":13,"datePublished":"2016-08-22T17:37:57.000Z","author":{"@type":"Person","name":"j-seb","url":"https://community.spiceworks.com/u/j-seb"},"acceptedAnswer":{"@type":"Answer","text":"
\n
\n
<\/div>\n\"\" Martin9700:<\/div>\n
\n
Well, I’m not seeing an apples to apples comparison here, so I can’t really say what the problem is. In the picture you have the basic page highlighted on Domain Admins, but the permissions you show are for your user (you). The permissions for that seemed OK to me, so I’m not sure what the problem is.<\/p>\n<\/blockquote>\n<\/aside>\n
The problem he seems to be having is that under the basic permissions only the special permissions line has a checkbox on it.
\"Capture.PNG\"
<\/use><\/svg>Capture.PNG<\/span>800×321 77.8 KB<\/span><\/use><\/svg><\/div><\/a><\/div><\/p>\n
As for the ‘problem’ itself, this seems to be caused by the InheritOnly flag. If you look at the advanced permission for each ACE they don’t actually have any permissions on the folder itself - they only apply to the child objects.
\"Untitled.png\"
<\/use><\/svg>Untitled.png<\/span>767×520 14.7 KB<\/span><\/use><\/svg><\/div><\/a><\/div><\/p>\n
This isn’t necessarily a problem - the ACL is exactly what you’re telling it to be. So long as the permissions are how you want them there’s no need to make a change. If you want the accounts to have permissions on the folder itself then you’ll have to use one of the other propagation flags.<\/p>\n
\n  
\n\n      learn.microsoft.com<\/a>\n  <\/header>\n\n  
\n    
<\/div>\n\n
PropagationFlags Enum (System.Security.AccessControl)<\/a><\/h3>\n\n  
Specifies how Access Control Entries (ACEs) are propagated to child objects.  These flags are significant only if inheritance flags are present.<\/p>\n\n\n  <\/article>\n\n  
\n    \n    \n  <\/div>\n\n  
<\/div>\n<\/aside>\n","upvoteCount":0,"datePublished":"2016-08-23T10:19:56.000Z","url":"https://community.spiceworks.com/t/powershell-ntfs-right/520048/12","author":{"@type":"Person","name":"gungnir","url":"https://community.spiceworks.com/u/gungnir"}},"suggestedAnswer":[{"@type":"Answer","text":"
Hi guys,<\/p>\n
i’ve been looking at this for the whole day not knowing what I’m doing wrong.<\/p>\n
I’ll start by saying the goal is to create a personal home folder for users.
\nI don’t want the folder to inherit right.<\/p>\n
The command works but permissions are weird.
\nThe ntfs are blank but once i open advanced permission i see them.
\nBut it doesnt work.<\/p>\n
Here’s the script:<\/p>\n
New-item \\\\server\\Users$\\jeaeli -type directory\n$acl = Get-Acl \\\\server\\Users$\\jeaeli\n$acl | Format-List\n$acl.GetAccessRules($true, $true, [System.Security.Principal.NTAccount])\n$acl.SetAccessRuleProtection($true, $false)\n$acl1 = New-Object System.Security.AccessControl.FileSystemAccessRule \"domain\\jeaeli\",\"Modify\", \"ContainerInherit, ObjectInherit\", \"InheritOnly\", \"Allow\"\n$acl2 = New-Object System.Security.AccessControl.FileSystemAccessRule \"domain\\ITBEXC\",\"FullControl\", \"ContainerInherit, ObjectInherit\", \"InheritOnly\", \"Allow\"\n$acl3 = New-Object System.Security.AccessControl.FileSystemAccessRule \"domain admins\",\"FullControl\", \"ContainerInherit, ObjectInherit\", \"InheritOnly\", \"Allow\"\n$acl.addAccessRule($acl1)\n$acl.addAccessRule($acl2)\n$acl.addAccessRule($acl3)\nSet-Acl \\\\server\\Users$\\jeaeli $acl\n<\/code><\/pre>\n
I also don’t want module to add.
\nAny help is appreciated<\/p>","upvoteCount":5,"datePublished":"2016-08-22T17:37:57.000Z","url":"https://community.spiceworks.com/t/powershell-ntfs-right/520048/1","author":{"@type":"Person","name":"j-seb","url":"https://community.spiceworks.com/u/j-seb"}},{"@type":"Answer","text":"
Hello, when you post code, please use the ‘insert code’ button. Please and thank you!<\/p>\n
\"codebutton.png\"<\/p>","upvoteCount":3,"datePublished":"2016-08-22T17:39:59.000Z","url":"https://community.spiceworks.com/t/powershell-ntfs-right/520048/2","author":{"@type":"Person","name":"Neally","url":"https://community.spiceworks.com/u/Neally"}},{"@type":"Answer","text":"
This is what I’ve used in the past:<\/p>\n
$NTDomain = \"yourdomain\"\n$HomePath = \"\\\\server\\users\"\n$UserName = \"youruser\"\n\n#Create Home Drive\nWrite-Host \"Creating Home Drive...\"\n#Create the folder\nNew-Item -Name $UserName -ItemType Directory -Path $HomePath | Out-Null\n#Set the drive on the user account\nSet-ADUser $UserName -HomeDirectory \"$HomePath\\$UserName\" -HomeDrive U:\n#Get the ACL\n$ACL = Get-Acl \"$HomePath\\$UserName\"\n#Turn off inheritance\n$ACL.SetAccessRuleProtection($true, $false)\n#Remove the old ACL's\n$ACL.Access | ForEach { [Void]$ACL.RemoveAccessRule($_) }\n#Add Domain Admins as Full Control, copy this line if you need more groups to have this level\n$ACL.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule(\"$NTDomain\\Domain Admins\",\"FullControl\", \"ContainerInherit, ObjectInherit\", \"None\", \"Allow\")))\n#Grant the user modify permissions\n$ACL.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule(\"$NTDomain\\$UserName\",\"Modify\", \"ContainerInherit, ObjectInherit\", \"None\", \"Allow\")))\n#Save the ACL back\nSet-Acl \"$HomePath\\$UserName\" $ACL\n<\/code><\/pre>\n
Edited to add comments.<\/p>","upvoteCount":2,"datePublished":"2016-08-22T17:47:50.000Z","url":"https://community.spiceworks.com/t/powershell-ntfs-right/520048/3","author":{"@type":"Person","name":"martin9700","url":"https://community.spiceworks.com/u/martin9700"}},{"@type":"Answer","text":"
\n
\n
<\/div>\n\"\" Neally:<\/div>\n
\n
Hello, when you post code, please use the ‘insert code’ button. Please and thank you!<\/p>\n<\/blockquote>\n<\/aside>\n
It’s a pet peeve of his. ¯_(ツ)_/¯<\/p>\n
@alexw<\/a><\/p>","upvoteCount":0,"datePublished":"2016-08-22T17:50:44.000Z","url":"https://community.spiceworks.com/t/powershell-ntfs-right/520048/4","author":{"@type":"Person","name":"zuphzuph","url":"https://community.spiceworks.com/u/zuphzuph"}},{"@type":"Answer","text":"
\n
\n
<\/div>\n\"\" zuphzuph:<\/div>\n
\n
\n
\n
<\/div>\n\"\" Neally:<\/div>\n
\n
Hello, when you post code, please use the ‘insert code’ button. Please and thank you!<\/p>\n<\/blockquote>\n<\/aside>\n
It’s a pet peeve of his. ¯_(ツ)_/¯<\/p>\n<\/blockquote>\n<\/aside>\n
And one we encourage. It’s even in the PLEASE READ BEFORE POSTING<\/a> sticky \":slight_smile:\"<\/p>","upvoteCount":2,"datePublished":"2016-08-22T17:52:05.000Z","url":"https://community.spiceworks.com/t/powershell-ntfs-right/520048/5","author":{"@type":"Person","name":"martin9700","url":"https://community.spiceworks.com/u/martin9700"}},{"@type":"Answer","text":"
\n
\n
<\/div>\n\"\" zuphzuph:<\/div>\n
\n
\n
\n
<\/div>\n\"\" Neally:<\/div>\n
\n
Hello, when you post code, please use the ‘insert code’ button. Please and thank you!<\/p>\n<\/blockquote>\n<\/aside>\n
It’s a pet peeve of his. ¯_(ツ)_/¯<\/p>\n<\/blockquote>\n<\/aside>\n
\n
\n
<\/div>\n\"\" Martin9700:<\/div>\n
\n
\n
\n
<\/div>\n\"\" zuphzuph:<\/div>\n
\n
\n
\n
<\/div>\n\"\" Neally:<\/div>\n
\n
Hello, when you post code, please use the ‘insert code’ button. Please and thank you!<\/p>\n<\/blockquote>\n<\/aside>\n
It’s a pet peeve of his. ¯_(ツ)_/¯<\/p>\n<\/blockquote>\n<\/aside>\n
And one we encourage. It’s even in the PLEASE READ BEFORE POSTING<\/a> sticky \":slight_smile:\"<\/p>\n<\/blockquote>\n<\/aside>\n
He’s just teasing :¬P ¯_(ツ)_/¯<\/p>","upvoteCount":1,"datePublished":"2016-08-22T17:55:26.000Z","url":"https://community.spiceworks.com/t/powershell-ntfs-right/520048/6","author":{"@type":"Person","name":"Neally","url":"https://community.spiceworks.com/u/Neally"}},{"@type":"Answer","text":"
I haven’t been here for a while. I’m really sorry<\/p>","upvoteCount":0,"datePublished":"2016-08-22T17:55:54.000Z","url":"https://community.spiceworks.com/t/powershell-ntfs-right/520048/7","author":{"@type":"Person","name":"j-seb","url":"https://community.spiceworks.com/u/j-seb"}},{"@type":"Answer","text":"
\n
\n
<\/div>\n\"\" J-Seb:<\/div>\n
\n
I haven’t been here for a while. I’m really sorry<\/p>\n<\/blockquote>\n<\/aside>\n
No worries J-Seb, we just want to help.<\/p>","upvoteCount":1,"datePublished":"2016-08-22T17:57:01.000Z","url":"https://community.spiceworks.com/t/powershell-ntfs-right/520048/8","author":{"@type":"Person","name":"martin9700","url":"https://community.spiceworks.com/u/martin9700"}},{"@type":"Answer","text":"
Hey Martin,<\/p>\n
It’s pretty much the same i have except that we don’t set the home folder that way, this is not my choice.
\nI’m not sure if my pic was posted with it but here’s what i get from running it.<\/p>\n
\"ntfs.jpg\"
<\/use><\/svg>ntfs.jpg<\/span>1297×648 122 KB<\/span><\/use><\/svg><\/div><\/a><\/div><\/p>","upvoteCount":0,"datePublished":"2016-08-22T18:02:02.000Z","url":"https://community.spiceworks.com/t/powershell-ntfs-right/520048/9","author":{"@type":"Person","name":"j-seb","url":"https://community.spiceworks.com/u/j-seb"}},{"@type":"Answer","text":"
Well, I’m not seeing an apples to apples comparison here, so I can’t really say what the problem is. In the picture you have the basic page highlighted on Domain Admins, but the permissions you show are for your user (you). The permissions for that seemed OK to me, so I’m not sure what the problem is.<\/p>","upvoteCount":0,"datePublished":"2016-08-22T18:08:46.000Z","url":"https://community.spiceworks.com/t/powershell-ntfs-right/520048/10","author":{"@type":"Person","name":"martin9700","url":"https://community.spiceworks.com/u/martin9700"}},{"@type":"Answer","text":"
if you look on the left side under allow there is no check mark.
\nI included another one that will clarify the problem.<\/p>\n
\"ntfs2.jpg\"
<\/use><\/svg>ntfs2.jpg<\/span>1152×648 85.1 KB<\/span><\/use><\/svg><\/div><\/a><\/div><\/p>","upvoteCount":0,"datePublished":"2016-08-23T10:03:07.000Z","url":"https://community.spiceworks.com/t/powershell-ntfs-right/520048/11","author":{"@type":"Person","name":"j-seb","url":"https://community.spiceworks.com/u/j-seb"}},{"@type":"Answer","text":"
Thanks so much Gungnir.<\/p>\n
There is a language barrier in my case and sometimes i do not fully understand.
\nThat’s exactly what i was looking for. You save me some headaches for sure.<\/p>\n
I removed the inheritonly flag and they now get the permission on the folder itself.<\/p>","upvoteCount":0,"datePublished":"2016-08-23T10:34:38.000Z","url":"https://community.spiceworks.com/t/powershell-ntfs-right/520048/13","author":{"@type":"Person","name":"j-seb","url":"https://community.spiceworks.com/u/j-seb"}}]}}