PowerShell Setting ACL Inheritance and Propegation

I recently worked on a project that required a lot of  AdHoc moving of user home directories. To make the process easier for the support teams, I put together a PowerShell script (and a web front end for it, but more on that later) that would move a users home directory to a new server and update their account's homeDirectory attribute.

As is often the case these days, these home directories are stored on NAS devices that typically auto-create home directories on the fly with the appropriate permissions. As a result, my script needed to explicitly grant the user Full Control to their new folder. I didn't find the native help on the set-acl cmdlet very helpful in regard to adding a user to an existing folder's ACL. Luckily I did something similar in VB.NET and had good idea of what needed to be done. That along with a little get-acl and get-member action (and a little trial and error) got me where I needed to be.

The process is actually pretty straight froward.

1. Capture the current ACL with Get-ACL
   $DirACL = Get-ACL "\\FileServer\users$\JoeUser"
2. Create a new FileSystemAccessRule for the user and add it to the ACL you just captured
   $AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule "Domain\JoeUser","FullControl","ContainerInherit,ObjectInherit","None","Allow"
   $DirACL.AddAccessRule($AccessRule)
3. Write the new ACL back with set-acl
   Set-ACL "\\FileServer\users$\JoeUser" $DirACL

Since it take a couple of lines and is something that often needs to be repeated, it could easily be made a function like this:

Function Set-FullControl {

     param ([string]$User, [string]$FolderPath)

     $DirACL = Get-ACL $FolderPath

     $AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $User,"FullControl","ContainerInherit,ObjectInherit","None","Allow"

     $DirACL.AddAccessRule($AccessRule)

     Set-ACL $FolderPath $DirACL

}

Set-FullControl "DOMAIN\JoeUser" "\\FileServer\users$\JoeUser"