Disable inheritance and manually apply permissions when creating a folder in Powershell

Question

Im trying to make a new folder in Powershell but I do not want it to inherit any NTFS security permissions and manually add 2 users: The creator and my own admin account.

I have this:

    $FolderPath = "\\srv\path"
New-Item -ItemType directory -Path $FolderPath
$acl = Get-Acl "\\srv\path"
$acl.SetAccessRuleProtection($True, $False)
$acl.Access | %{$acl.RemoveAccessRule($_)} # I remove all security
$acl.SetOwner([System.Security.Principal.NTAccount] $env:USERNAME) # I set the current user as owner
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule('myadminaccount','FullControl','Allow') # I set my admin account as also having access
$acl.AddAccessRule($rule)
Set-Acl $FolderPath $acl | Out-Null

It does not work and it sill inherits the parent's security permissions.

I changed it to the comment below but it does not allow the user to set ACLs for a folder HE created. Over the root folder (path), he has change permissions privileges...

This is the access error recieved

What permissions should he have over the folder he just created with the code above? The owner should be able to modify it freely.

Added the full control share permission for the user and now I get that the process does not have "SeSecurityPrivilege". This happens when I add the $acl.SetAccessRuleProtection($True, $False) line

How can I get this to work?

Answer 1

Use the SetAccessRuleProtection() method to exclude the ACL from inheriting rules:

$acl.SetAccessRuleProtection($true,$false)

The second argument (preserveInheritance) also removes existing inherited rules when set to false, leaving just the system default ACE's.

---

If you have problems applying the inheritance protection, make sure you update the ACL with the ownership information before setting access rule protection:

$acl = Get-Acl "\\srv\path"
# SetOwner
$acl.SetOwner([System.Security.Principal.NTAccount] $env:USERNAME)
# Write updated ownership info back
Set-Acl $FolderPath $acl | Out-Null
# SetAccessRuleProtection
$acl.SetAccessRuleProtection($True, $False)
# Write updated ACL back
Set-Acl $FolderPath $acl | Out-Null