I am trying to enable "replace all child object permission entries with inheritable permission entries from this object" method using PowerShell, below is my Script

$ProfileDir = 'C:\Users\'
$Profiles = Get-ChildItem $ProfileDir \ Select-Object -ExpandProperty Name
ForEach ($X in $Profiles)
{
$Profile = $ProfileDir + $X
Write-Host "Starting $Profile"
$Acl = Get-Acl $Profile
$Acl.SetAccessRuleProtection($false, $true)
(Get-Item $Profile).SetAccessControl($Acl)
$Permissions = (Get-Acl $Profile).Access | Where-Object
{
(-not $_.isInherited) -and $_.IdentityReference -like "domain\*"
}
ForEach ($Y in $Permissions)
{
$Acl.AddAccessRule($Y)
}
(Get-Item $Profile).SetAccessRule($Acl)
(Get-Acl $Profile).Access
}
Below is the script I have created and it worked as expected.
Thank you for your suggestions and help. To replace all child objects, I have used Get-ChildItem with -recurse and it worked.
$objName = (Get-CimInstance -ClassName Win32_ComputerSystem).UserName.Split("\")[1]
$objDir = "C:\Users\$objName\"
$objUser = (Get-CimInstance -ClassName Win32_ComputerSystem).UserName
$objAccount = New-Object System.Security.Principal.NTAccount($objUser)
$objRule = $objUser,"FullControl","ContainerInherit,ObjectInherit","None","Allow"
$objFileSec = New-Object System.Security.AccessControl.FileSecurity
$objAccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule($objRule)
$objFileSec.SetOwner($objAccount)
$objAclSec = Get-Acl $objDir
$objAclSec.SetAccessRuleProtection($true,$true)
$objAclSec.PurgeAccessRules($objAccount)
$objAclSec.SetAccessRule($objAccessRule)
Get-ChildItem -Path $objDir | Set-Acl -AclObject $objAclSec
$objAclSec.Access | Format-Table
Pause
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With