Assigning file access rights to IIS_IUSRS using PowerShell

Question

I'm trying to add access rights for the user group IIS_IUSRS to a folder using PowerShell.

Currently I have

$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("BUILTIN\IIS_IUSRS", "FullControl", "Allow")
$acl = Get-ACL "C:\tmp"
$acl.AddAccessRule($accessRule)
Set-ACL -Path "C:\tmp" -ACLObject $acl

When run, this adds IIS_IUSRS to the list of users but there are no privileges assigned.

What have I missed?

Answer 1

On my system i needed to use just IIS_IUSRS, so drop the BUILTIN\. Furthermore, I think you need to construct the FileSystemAccessRule with extra parameters inheritanceFlags and propagationFlags to get what you want.

Try this:

$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("IIS_IUSRS", "FullControl", "ContainerInherit,ObjectInherit", "None", "Allow")
$acl = Get-ACL "C:\tmp"
$acl.AddAccessRule($accessRule)
Set-ACL -Path "C:\tmp" -ACLObject $acl

See: https://msdn.microsoft.com/en-us/library/sfe70whw(v=vs.110).aspx