windows 使用powershell删除文件夹上的所有ACL
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/6573308/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Removing all ACL on folder with powershell
提问by Anarko_Bizounours
I'm pretty new to powershell scripting (nearly 1 month since I started learning powershell.)
我对 powershell 脚本很陌生（自从我开始学习 powershell 将近 1 个月。）
I'm currently working on a script with powershell 2.0 to clean folder NTFS ACL. I want to delete every acl except the administrator one.
我目前正在使用 powershell 2.0 编写一个脚本来清理文件夹 NTFS ACL。我想删除除管理员之外的所有 acl。
My problem is that I can't find a way to delete every acl that are not administrator, without knowing them.
我的问题是我找不到删除所有不是管理员的 acl 的方法，而不知道它们。
So I came here to sought for powershell pro.
所以我来这里寻找powershell pro。
回答by Anarko_Bizounours
This code remove acl :
此代码删除 acl ：
$acl = Get-Acl \remote_server\share_folder\HAL.9000
$acl.Access | %{$acl.RemoveAccessRule($_)}
This code add administrator acl :
此代码添加管理员 acl ：
#BUILTIN administrator
$acl = Get-Acl \remote_server\share_folder\HAL.9000
$permission = "BUILTIN\Administrators","FullControl", "ContainerInherit,ObjectInherit","None","Allow"
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission
$acl.SetAccessRule($accessRule)
Set-Acl \remote_server\share_folder\HAL.9000 $acl
#Domain controller administrator
$acl = Get-Acl \remote_server\share_folder\HAL.9000
$permission = "DOMAINCONTROLLER\Administrators","FullControl", "ContainerInherit,ObjectInherit","None","Allow"
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission
$acl.SetAccessRule($accessRule)
Set-Acl \remote_server\share_folder\HAL.9000 $acl
Hope this will help someone :)
希望这会帮助某人:)
回答by DarkLite1
For convenience I've copy/pasted all this stuff together in a function. If it can be of use to anyone, here it is:
为方便起见，我已将所有这些内容复制/粘贴到一个函数中。如果它对任何人都有用，这里是：
Function Remove-ACL {
[CmdletBinding(SupportsShouldProcess=$True)]
Param(
[parameter(Mandatory=$true,ValueFromPipeline=$true,Position=0)]
[ValidateNotNullOrEmpty()]
[ValidateScript({Test-Path $_ -PathType Container})]
[String[]]$Folder,
[Switch]$Recurse
)
Process {
foreach ($f in $Folder) {
if ($Recurse) {$Folders = $(Get-ChildItem $f -Recurse -Directory).FullName} else {$Folders = $f}
if ($Folders -ne $null) {
$Folders | ForEach-Object {
# Remove inheritance
$acl = Get-Acl $_
$acl.SetAccessRuleProtection($true,$true)
Set-Acl $_ $acl
# Remove ACL
$acl = Get-Acl $_
$acl.Access | %{$acl.RemoveAccessRule($_)} | Out-Null
# Add local admin
$permission = "BUILTIN\Administrators","FullControl", "ContainerInherit,ObjectInherit","None","Allow"
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission
$acl.SetAccessRule($rule)
Set-Acl $_ $acl
Write-Verbose "Remove-HCacl: Inheritance disabled and permissions removed from $_"
}
}
else {
Write-Verbose "Remove-HCacl: No subfolders found for $f"
}
}
}
}
Usage:
用法：
# For only one folder:
Remove-ACL 'C:\Folder' -Verbose
# For all subfolders:
Remove-ACL 'C:\Folder' -Recurse -Verbose
# Pipe stuff
'C:\Folder 1', 'C:\Folder 2' | Remove-ACL -Verbose
回答by Alexander Dyakov
This code remove acl : $acl = Get-Acl \remote_server\share_folder\HAL.9000 $acl.Access | %{$acl.RemoveAccessRule($_)}
此代码删除 acl ： $acl = Get-Acl \remote_server\share_folder\HAL.9000 $acl.Access | %{$acl.RemoveAccessRule($_)}
it does not work until you do
在你做之前它不起作用
Set-Acl \remote_server\share_folder\HAL.9000 $acl
回答by Viktor Briukhanov
Why not create a new list. For example:
为什么不创建一个新列表。例如：
$identity = New-Object System.Security.Principal.NTAccount('NT AUTHORITY\SYSTEM')
$acl = New-Object System.Security.AccessControl.DirectorySecurity
$acl.SetOwner($identity)
$acl.SetGroup($identity)
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule('NT AUTHORITY\SYSTEM', 'FullControl', 'ContainerInherit, ObjectInherit', 'None','Allow')
$acl.AddAccessRule($rule)
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule('BUILTIN\Administrators', 'FullControl', 'ContainerInherit, ObjectInherit', 'None', 'Allow')
$acl.AddAccessRule($rule)
Set-Acl -LiteralPath "C:\MyFolder" -AclObject $acl
Get-Acl -LiteralPath "C:\MyFolder" | Format-List
