Get-Acl
Use Get-Acl to return the security descriptor of a file, folder, registry key or other securable object.
Documentation: Microsoft Learn — Get-Acl
Syntax
See the command anatomy
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
Get-Acl [[-Path] <string[]>] [-Audit] [-Filter <String>] [-AllCentralAccessPolicies] [<CommonParameters>]- Stage 1Get-Acl
-Path -Audit -Filter -AllCentralAccessPolicies
Try it
PowerShell example · browser support is limited.
Execution scope: The full example below requires PowerShell outside this browser. You can edit this runner to use the supported practice commands; unsupported syntax returns an explanation.
Follow the objects
Run the command to inspect each stage.
Examples
Get-Acl -Path C:\Scripts
Show reference output
Sample output · fictional data, shaped like the real thing
Path : Microsoft.PowerShell.Core\FileSystem::C:\Scripts Owner : BUILTIN\Administrators Group : CORP\Domain Users Access : CORP\Ops-Team Allow Modify
Parameters
Parameter definitions:
-Path-Audit-Filter-AllCentralAccessPolicies
Practical use and troubleshooting
Practical scenario: Use Get-Acl when you need to return the security descriptor of a file, folder, registry key or other securable object. Start with one identified target and inspect the returned values before extending the operation to a list. Keep the identity in your report so you can trace each result back to the object or path that produced it.
Common error and fix: Access denied means the account cannot read the relevant security information. Verify the exact target and required rights rather than assuming access to file contents grants access to all security data. In an unattended script, capture this failure with its original error record and record which target failed. An empty result and an unsuccessful query must remain distinguishable in the final report.
See also: Set-Acl. Get-Acl retrieves a security descriptor; Set-Acl applies one. Review the intended access rules and ownership before writing a descriptor back to a file or directory. Read the linked command before substituting it; similar names do not imply identical inputs or output.
Recap
Get-Acl Use Get-Acl to return the security descriptor of a file, folder, registry key or other securable object.
Next: Set-Acl