en-US/about_WindowsAccessControl.help.txt
|
TOPIC
about_WindowsAccessControl SHORT DESCRIPTION Pipeline-first Windows security descriptor management for PowerShell. LONG DESCRIPTION WindowsAccessControl manages Windows identities, privileges, access rules, audit rules, ownership, inheritance, effective access, and portable security descriptors across filesystems, registry keys, services, processes, SMB shares, Active Directory, Task Scheduler, and supported CNG private keys. Filesystem commands accept strings and FileSystemInfo objects through the pipeline. State-changing commands support WhatIf and Confirm. EXAMPLES PS C:\> Get-ChildItem C:\Data | Get-NTFSAccessRule -ExcludeInherited PS C:\> Add-NTFSAccessRule -LiteralPath C:\Data -Account CONTOSO\Analysts -AccessRights Modify PS C:\> Get-ChildItem C:\Data -Recurse | Backup-NTFSItemSecurityDescriptor -DestinationPath C:\Backup\permissions.json NOTE The module is supported only on Windows. Audit operations require SeSecurityPrivilege, and setting arbitrary owners can require SeRestorePrivilege. Filesystem commands address a canonical file system path. A Win32 device-namespace path (\\?\ or \\.\) and a bare drive specification such as C: are refused, because neither names one unambiguous target; supply the normalized path or C:\ instead. A junction, a symbolic link, or a volume mount point carries its own security descriptor and is addressed as itself; its destination is not read and not changed, which is what Get-Acl, Set-Acl, and icacls also do. No command walks a directory tree: a command operates on the targets it is given plus one level of wildcard expansion, so no operation can follow a reparse-point cycle. The registry is the opposite case: a registry symbolic link is followed, so HKLM:\SYSTEM\CurrentControlSet reports and writes the control set it currently names. The 32-bit and 64-bit registry views are independent objects; select one with RegistryView rather than by naming the reserved redirection node. SEE ALSO Get-NTFSAccessRule Get-NTFSAuditRule Get-NTFSItemSecurityDescriptor Edit-NTFSItemSecurityDescriptor Get-NTFSItemEffectiveAccess Get-TaskFolderSecurityDescriptor Get-ScheduledTaskSecurityDescriptor Get-CertificatePrivateKeySecurityDescriptor KEYWORDS Windows, NTFS, registry, service, process, SMB, Active Directory, Task Scheduler, CNG, certificate, private key, ACL, DACL, SACL, permissions, ownership, inheritance, Authz, DSC |