Why does Set-Acl on the drive root try to set ownership of the “object”?

Question

I would like to change the ACL of the C: drive. What im trying to do is remove the permission that a user can create a folder directly on the drive. I tested th

Answer 1

People may find this easier:

icacls c:\ /remove "authenticated users"

Answer 2

The below code works for me:

$ApplicationPoolIdentity = "everyone"

function SetACL()
{
    param (
        [Parameter(Mandatory=$true)]
        [string]        $Path 
    )

    $Acl = (Get-Item $Path).GetAccessControl('Access')
    Write-Host "Path:" $Path "ID:" $ApplicationPoolIdentity
    $Ar = New-Object  system.security.accesscontrol.filesystemaccessrule($ApplicationPoolIdentity,"Write","Allow")
    $Acl.SetAccessRule($Ar)
    Write-Host $Acl
    $Acl | Set-Acl $Path
}

SetACL "C:\Test\"

Answer 3

You need the SeRestorePrivilege to set the owner. I used Lee Holmes' script from the URL below to elevate my process with this additional priv and was able to set the owner to someone other than myself.

http://www.leeholmes.com/blog/2010/09/24/adjusting-token-privileges-in-powershell/

I tried the (get-item $path).getaccesscontrol("access") method but still got the same error since my process didn't have the SeRestorePrivilege.

Answer 4

I found the answer. Microsoft says

Unfortunately Get-Acl is missing some features. It always reads the full security descriptor even if you just want to modify the DACL. That’s why Set-ACL also wants to write the owner even if you have not changed it. Using the GetAccessControl method allows you to specify what part of the security descriptor you want to read.

Replace the Get-Acl call with

$acl = (Get-Item $path).GetAccessControl('Access')

Answer 5

$Acl = (Get-Item $Path).GetAccessControl('Access')

Worked for me. I run my PS Script from CMD and in this PS Script i run another PS Script everything works fine as long as i do it with my own User. When i use different User i get the same Error: Set-Acl : The security identifier is not allowed to be the owner of this object.

Just changed Get-ACL to that Line above and it worked fine. Thanks again.