acl - Changing NTFS security on user with fullcontrol to modify -

i have thousands of folders need change users fullcontrol access modify access. following list of have:

1. a script changes ntfs perms:

   $acl = get-acl "g:\folder" $acl | format-list $acl.getaccessrules($true, $true, [system.security.principal.ntaccount]) #second $true on following line turns on inheritance, $false turns off $acl.setaccessruleprotection($true, $true) $rule = new-object system.security.accesscontrol.filesystemaccessrule("administrators","fullcontrol", "containerinherit, objectinherit", "none", "allow") $acl.addaccessrule($rule) $rule = new-object system.security.accesscontrol.filesystemaccessrule("my-serverteam","fullcontrol", "containerinherit, objectinherit", "none", "allow") $acl.addaccessrule($rule) $rule = new-object system.security.accesscontrol.filesystemaccessrule("users","read", "containerinherit, objectinherit", "none", "allow") $acl.addaccessrule($rule) set-acl "g:\folder" $acl get-acl "g:\folder" | format-list

2. a text file directories , users need changed fullcontrol modify.

i can create variable path and/or username , create foreach loop, i'm not sure how change users exist in acl each folder modify, keep admin accounts full control. appreciated.

went route , got needed. i'm not surprised noone tried me on one.... tough. i'll post scripts next person has issue. there 2 scripts. first obtained internet , altered bit. second script launches first parameters required automate.

first script named setfolderpermission.ps1:

param ([string]$path, [string]$access, [string]$permission = ("modify"), [switch]$help) function gethelp() { $helptext = @"  description: name: setfolderpermission.ps1 sets folderpermissions user on folder. creates folder if not exist.  parameters:  -path           folder create or modify (required) -user           user should have access (required) -permission     specify permission user, default set modify (optional) -help           prints helpfile (optional)  syntax: ./setfolderpermission.ps1 -path c:\folder\newfolder -access domain\username -permission fullcontrol  creates folder c:\folder\newfolder if doesn't exist. sets full control domain\username  ./setfolderpermission.ps1 -path c:\folder\newfolder -access domain\username  creates folder c:\folder\newfolder if doesn't exist. sets modify (default value) domain\username  ./setfolderpermission.ps1 -help  displays topic script  below available values -permission  "@ $helptext  [system.enum]::getnames([system.security.accesscontrol.filesystemrights])  }  <# function createfolder ([string]$path) {      # check if folder exists      if (test-path $path) {         write-host "folder: $path exists" -foregroundcolor yellow     } else {         write-host "creating $path" -foregroundcolor green         new-item -path $path -type directory | out-null     } } #>  function setacl ([string]$path, [string]$access, [string]$permission) {      # acl on folder      $getacl = get-acl $path      # set accessrule      $allinherit = [system.security.accesscontrol.inheritanceflags]"containerinherit, objectinherit"     $allpropagation = [system.security.accesscontrol.propagationflags]"none"     $accessrule = new-object system.security.accesscontrol.filesystemaccessrule($access, $permission, $allinherit, $allpropagation, "allow")      # check if access exists      if ($getacl.access | {$_.identityreference -eq $access}) {          write-host "modifying permissions for: $access on directory: $path" -foregroundcolor yellow          $accessmodification = new-object system.security.accesscontrol.accesscontrolmodification         $accessmodification.value__ = 2         $modification = $false         $getacl.modifyaccessrule($accessmodification, $accessrule, [ref]$modification) | out-null     } else {          write-host "adding permission: $permission for: $access"          $getacl.addaccessrule($accessrule)     }      set-acl -aclobject $getacl -path $path      write-host "permission: $permission set for: $access on directory: $path" -foregroundcolor green }  if ($help) { gethelp }  if ($access -and $permission) {      setacl $path $access $permission } 

the next script calls first script , adds needed parameters. csv containing 2 columns folders , usernames full control.

$path = "c:\scripts\scandata\twocolumncsvwithpathanduserwithfullcontrol.csv" $csv = import-csv -path $path foreach($line in $csv){ $usern = $line.identityreference $pathn = $line.path $dir = "$pathn" $domuser = "$usern" $perm = "modify" $scriptpath = "c:\scripts\setfolderpermission.ps1" $argumentlist1 = '-path' $argumentlist2 = "$dir" $argumentlist3 = '-access' $argumentlist4 = "$domuser" $argumentlist5 = '-permission' $argumentlist6 = "$perm" invoke-expression "$scriptpath $argumentlist1 $argumentlist2 $argumentlist3 $argumentlist4 $argumentlist5 $argumentlist6"