windows - Trying to prevent a security group from applying to other folders/files -


i'm trying make $adnamero , $adnamerw (that i've created below) don't applied folders below let rest of permissions inherited.

i've tried change propagation flag 2 strings applied folder , files added to, still get's added sub files , folders...

i thought might need change inheritanceflags object both of strings, when changed manually (through windows gui) didn't seem work correctly...

any appreciated.

function new-ace {   [cmdletbinding()]   param(     [parameter(mandatory=$true, position=0)]     [security.principal.ntaccount]$account,     [parameter(mandatory=$false, position=1)]     [security.accesscontrol.filesystemrights]$permissions = 'readandexecute',     [parameter(mandatory=$false, position=2)]     [security.accesscontrol.inheritanceflags]$inheritanceflags = 'containerinherit,objectinherit',     [parameter(mandatory=$false, position=3)]     [security.accesscontrol.propagationflags]$propagationflags = 'none',     [parameter(mandatory=$false, position=4)]     [security.accesscontrol.accesscontroltype]$type = 'allow'   )    new-object security.accesscontrol.filesystemaccessrule(     $account, $permissions, $inheritanceflags, $propagationflags, $type   ) }  $domain = 'esg.intl' $administrators = ([wmi]"win32_sid.sid='s-1-5-32-544'").accountname $addomainusers = "$domain\domain users"  $acl = get-acl $path  $administrators, "$domain\domain admins" | foreach-object {   $acl.addaccessrule((new-ace $_ 'fullcontrol')) } $acl.addaccessrule((new-ace $adnamerw 'modify')) $acl.addaccessrule((new-ace $adnamero 'readandexecute')) $acl.addaccessrule((new-ace $addomainusers 'readandexecute')) 

setting access permissions folders , files without inheritance requires 2 aces: 1 "this folder only" , 1 "files only". former set both inheritance , propagation flags none, latter set inheritance flags objectinherit , propagation flags inheritonly:

$acl.addaccessrule((new-ace $adnamerw 'modify' 'none')) $acl.addaccessrule((new-ace $adnamerw 'modify' 'objectinherit' 'inheritonly')) $acl.addaccessrule((new-ace $adnamero 'readandexecute' 'none')) $acl.addaccessrule((new-ace $adnamero 'readandexecute' 'objectinherit' 'inheritonly')) 

Comments

Popular posts from this blog

html - Styling progress bar with inline style -

java - Oracle Sql developer error: could not install some modules -

How to use autoclose brackets in Jupyter notebook? -