How to Set Folder Permissions Using PowerShell

Today, I got an interesting requirement from one of my clients. They wanted to set permissions for a folder and nested folders. In this tutorial, I will explain how to set folder permissions using PowerShell.

Before setting permissions, let us first understand what NTFS permissions.

Table of Contents

Understanding NTFS Permissions

NTFS (New Technology File System) permissions control the access that users and groups have to files and folders. Common permissions include:

Full Control: Allows users to read, write, modify, and delete files and subfolders.
Modify: Allows users to read, write, modify, and delete files.
Read & Execute: Allows users to read and run files.
List Folder Contents: Allows users to view the names of files and subfolders.
Read: Allows users to view the contents of files.
Write: Allows users to add files and subfolders.

Note: Make sure to open PowerShell with administrative privileges (search for “PowerShell” in the Start menu, right-click, and select “Run as administrator”).

Check out Create Folder Structure from CSV using PowerShell

Basic PowerShell Commands for Managing Folder Permissions

Now, let me show you some basic PowerShell commands to manage permissions.

View Current Folder Permissions

Before making any changes, you might want to view the current permissions of a folder. Use the Get-Acl cmdlet for this purpose:

$folderPath = "C:\ExampleFolder"
$acl = Get-Acl $folderPath
$acl | Format-List

This command retrieves the Access Control List (ACL) for the specified folder and displays it in a readable format.

You can see in the screenshot below that it displays my permission for the folder from my system.

Read Create Multiple Folders in PowerShell

Add Permissions to the Folder

To add permissions, you need to create a new access rule and then apply it to the folder. Here’s how to grant “Full Control” to a user named Bijay:

$folderPath = "C:\ExampleFolder"
$acl = Get-Acl $folderPath
$permission = "FullControl"
$inheritance = "ContainerInherit, ObjectInherit"
$propagation = "None"
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("Bijay", $permission, $inheritance, $propagation, "Allow")
$acl.SetAccessRule($accessRule)
Set-Acl $folderPath $acl

Remove Permissions

To remove permissions, use the RemoveAccessRule method. For example, to remove “Full Control” permissions from Bijay, you can write the below PowerShell script.

$folderPath = "C:\ExampleFolder"
$acl = Get-Acl $folderPath
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("Bijay", "FullControl", "ContainerInherit, ObjectInherit", "None", "Allow")
$acl.RemoveAccessRule($accessRule)
Set-Acl $folderPath $acl

Check out Create Folders with Year, Month, and Day Using PowerShell

Set Permissions for Multiple Users

If you need to set permissions for multiple users, you can loop through a list of usernames. Here’s an example of granting “Read” permissions to a list of users to the folder.

$folderPath = "C:\ExampleFolder"
$acl = Get-Acl $folderPath
$users = @("JohnDoe", "JaneSmith", "AliceJohnson")

foreach ($user in $users) {
    $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule($user, "Read", "ContainerInherit, ObjectInherit", "None", "Allow")
    $acl.SetAccessRule($accessRule)
}

Set-Acl $folderPath $acl

Apply Permissions to a Folder and Subfolders Recursively

To apply permissions recursively to all subfolders and files, use the -Recurse parameter. This is useful when you need to ensure that all contents within a directory inherit the same permissions:

$folderPath = "C:\ExampleFolder"
$acl = Get-Acl $folderPath
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("JohnDoe", "Modify", "ContainerInherit, ObjectInherit", "None", "Allow")
$acl.SetAccessRule($accessRule)
Set-Acl $folderPath $acl

Get-ChildItem $folderPath -Recurse | ForEach-Object {
    $acl = Get-Acl $_.FullName
    $acl.SetAccessRule($accessRule)
    Set-Acl $_.FullName $acl
}

Check out Create a Folder with the Current Date using PowerShell

Use CSV Files for Bulk Permissions

For large-scale operations, you can use a CSV file to manage permissions. This method is particularly useful in enterprise environments where you need to update permissions for numerous users and folders.

I created this PowerShell script for the client to provide bulk permissions using a CSV file.

Create a CSV file (permissions.csv) with the following format:

FolderPath,Username,Permission
C:\ExampleFolder,JohnDoe,FullControl
C:\ExampleFolder,JaneSmith,Read

Use the following PowerShell script to apply the permissions:

$csv = Import-Csv "C:\Bijay\permissions.csv"

foreach ($entry in $csv) {
    $folderPath = $entry.FolderPath
    $username = $entry.Username
    $permission = $entry.Permission

    $acl = Get-Acl $folderPath
    $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule($username, $permission, "ContainerInherit, ObjectInherit", "None", "Allow")
    $acl.SetAccessRule($accessRule)
    Set-Acl $folderPath $acl
}

Read Create a Shortcut to a Folder Using PowerShell

Troubleshooting Common Issues

Since I received a few common errors while assigning permissions to folders, I thought to share the solutions.

Permission Denied Errors

If you encounter permission denied errors, ensure that you are running PowerShell with administrative privileges. Additionally, verify that the user or group you are modifying exists and has the necessary permissions to change ACLs.

Inheritance Issues

Sometimes, permissions may not propagate as expected due to inheritance settings. Use the -Recurse parameter and ensure that inheritance flags (ContainerInherit and ObjectInherit) are correctly set.

Verifying Changes

After making changes, always verify that the permissions are set correctly:

$folderPath = "C:\ExampleFolder"
$acl = Get-Acl $folderPath
$acl | Format-List

Conclusion

In this tutorial, I explained how to set folder permissions using PowerShell to manage access control in a Windows environment. Please let me know if you encounter any issues in the comments below, and I will be happy to help you.