When using PowerShell to set the DACL of an object in PowerShell you may get the error:
"The Security Identifier is not allowed to be the owner of this object"
$FolderPath = "C:\Temp"
$ACL = Get-ACL $FolderPath
$AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule($UserName, "Modify, Synchronize","ContainerInherit, ObjectInherit", "None", "Allow")
$ACL.SetAccessRule($AccessRule)
Set-ACL $FolderPath $ACL
The mystery for me was that I wasn't trying to modify the owner, just the DACL. The interesting thing about this case, is that the issue lies with the Get-ACL.
Whaaa! Well the limited features of Get-ACL means that you always read the full security descriptor including the owner whether you intended to or not. That means that when you come to write to the object based on a modified version of what you read, you are attempting to write back to the owner attribute.
The solution is to replace
$ACL = Get-ACL $FolderPath
With
$ACL = (Get-Item $FolderPath).GetAccessControl('Access')
The GetAccessControl('Access') method reads only the DACL so when you write it back you are not trying to write something you did not intend to.
Cheers!
ReplyDeleteThis is a perfect way to change permissions. Instead of using external modules
Thank you for this :)
This helped me so much.
Hugely helpful!! Many thanks!
ReplyDeleteThis worked perfectly! Thanks!
ReplyDeleteGee - I just had the same problems and this article helped me solving it in 2 minutes. Thanks!!!
ReplyDeleteBastian
Six years after, still useful. Thank you!
ReplyDeleteAwesome post. thank you. Still relevant ttoday!
ReplyDeleteMuch thanks! Helped me a lot.
ReplyDeleteJust wanted to one-up saying this was useful.
ReplyDeleteOnce I knew this I wrote the command like
Set-Acl $target (Get-Item $source).GetAccessControl('Access')
to have it on one line.
This shouldn't be necessary if MS improved get/set-ACL, but due the lack of that you had to do this great job ;-)
ReplyDeleteThanks a lot for sharing
Super helpful, thanks!
ReplyDeletethank you for the great solution. Helped me a lot.
ReplyDeleteThis was posted on my birthday (Coincidence? I think not!) 7 years ago - and it's still relevant! Man, you helped me a lot! Many thanks!
ReplyDeleteJust a baby engineer in her first job dropping in to let you know that this solved my problem in 2022. Thank you!
ReplyDeleteVery helpful for unlocking and re-locking the "C:\Windows\System32\spool\drivers" path allowing Windows Server Backups when the system has the PrintNightmare mitigation implemented. Thank you so much for the guidance!
ReplyDeleteYep, saved my day
ReplyDelete