[Autogenerated] Now let's dive into one of the most vital aspects of
server management setting and managing file permissions.
No more fussing with intricate gooey settings.
Starting off we have set AC L.
This command let helps you set permissions without breaking a sweat.
Be it a single file or a complex directory tree.
Then you have get AC L need to check who has access to what a quick
get AC L reference and you got a full report.
This is also an invaluable tool for auditing for reading permissions.
All right.
Time to get our hands dirty.
Yet in the following demo,
we're setting up permissions for a new department in the company.
First, we're going to use set AC L to establish the baseline permissions.
You'll see how we can control who gets in and who
doesn't down to the finest detail.
But what happens when roles change?
Well, all the fly adjustments are part of it life and guess what?
Well, changing permissions is just command away with set AC L.
You can modify settings in real time without disrupting workflows.
So let's not waste any more time here and dive into the demo.
So let's now see what it takes to set up some permissions on a file folder.
So to get started, I have my PowerShell console up here on my machine.
The first thing you want to do is create a new folder that
will store our confidential hr files.
So I'm using the new item caille to create a new folder
called HR records under the C chairs folder.
I'm using the force parameter here to also create the shares
directory if it doesn't already exist.
All right.
So now that that folder exists, let's look at who currently has access for that.
I'll use the get AC L command lit.
Now I'm currently assigning the output of get AC L to an AC L variable
because we'll need to modify that a little bit later.
So now that that is done,
let's check out the AC L variable and see what's in there.
All right.
So it looks like built in administrators is the owner and we
need to dive in a little bit into the axis,
see what that looks like.
All right.
So here are the individual A CE S or access control entries.
You can tell they're all set via inheritance because of
those inheritance flag container, inherit object,
inherit container, inherit object inherit.
That means that those A CE s are being inherited from the parent folder.
We only want hr staff to access this folder.
So let's create a custom access rule to do that.
We will create a new object using the new object cail it.
When you create a new object command that creates a new .NET object,
a file system access rule in particular.
And the first argument is the group that you want to give access to.
The next is the level of access.
In this case, it's full control.
And we want to allow that you can also do deny as well.
Now that we have that rule,
we need to add that rule to the original AC L using the set access rule method.
All right, we've got an error when it says could not be translated.
That means whenever you create a file system access rule,
it needs to translate that into a SID or a security
identifier for NTFS to understand it.
So at this point, whenever I just put human resources,
it couldn't translate that name to a security identifier.
So the reason it couldn't transfer that name is because
I actually had the group name wrong.
So let's go up here and we'll change the group name to
what it actually is in active directory.
So let's create a new object and we will set that access rule.
And now it works.
So at this point, the hr admin group has access on this AC L.
But so does anyone else via inheritance?
We need to block inheritance and to do that,
we need to execute a method called set access rule protection.
The true argument here stops inheritance by passing false.
And the second argument we are both blocking any new inheritor permissions and
also removing any permissions that were previously inherited,
giving us a clean slate to work with almost done.
So right now, nothing has changed.
We are essentially setting up this AC L object to apply it.
We need to run set AC L.
All right,
we provide the path to the target folder and the
updated AC L and let's see what happens.
Okay.
Looks like it worked.
Let's now check the AC L and see what it looks like.
That looks better.
Pretty simple.
Now,
there's only one A ce here and it's for hr admins and they have full
control and no inheritance exactly what we want.
Let's test this out by launching another PowerShell console as an
HR user to launch PowerShell as another user.
You need to open up file explorer here,
you can right-click this and then go to open file location.
And then once you're in the file explorer,
you see the shortcut,
you hold shift down right-click and run as a different user.
Let's log in as Susie.
She's in hr here we go.
And now let's try to create just a single file and
it looks like it worked great.
The file was created.
Now,
let's switch back and log in as another user with another PowerShell
console for a user that is not in the Hr Admins group.
I know Bob is in accounting he shouldn't have access.
Let's see if Bob can create a file too.
No access is denied exactly what we wanted permissions are working as expected.
So we successfully applied in tested setting permissions
using the well quote standard way, the default power show way.
But a community provided module make this process a lot easier.
That module is called NTFS security.
So let's demonstrate that real quick to do this
process with the NTFS security module.
You first need to download it from the PowerShell gallery,
close off of Bob's console here and get back to the one
that I was on clear the screen here.
And now we run install dash module and then provide the name of NTFS security.
This will go out to the PowerShell gallery and download this module for me.
All right, looks like it is installed.
Let's see if it is available in my session.
Looks like it is okay.
Let's see what commands it has.
I can run GIT command like I do on any good module
and I can run in TFS security.
And it looks like you see that you have a lot of different options.
You can do a lot of things with this module.
I'm not going to go into each of these by any means.
I'm just going to replicate setting that AC L like we did earlier.
So recall that we had to create an A ce an entry and then modify that AC L.
It went through all this rigmarole with the NTFS security module.
It has an A NTFS access command that we can use with the A NTFS access command.
Let, we can simply specify the path,
the account that we need and the access rights hit enter.
And we're all done.
We don't have to go through each of those steps like we did before the NTFS
security module makes manage permissions so much easier.
All right.
So we've covered the end-to-end workflow for
restricting folder access with PowerShell.
We went over the NTFS security module,
get AC L and we went over the NTFS security module.
But if you don't have access to the module,
get AC L and set AC L, all your friends for managing permissions with PowerShell.