PowerShell Genie

Set-Acl

Use Set-Acl to apply a security descriptor to a file, folder or registry key.

Command 2 min read Windows PowerShell 5.1 and PowerShell 7

Documentation: Microsoft Learn — Set-Acl

Written and tested by Dhrub Bharali · Updated

Syntax

1PS> Set-Acl [-Path] <String[]> [-AclObject] <Object> [-ClearCentralAccessPolicy] [-Passthru] [-Filter <String>] [-WhatIf] [-Confirm] [<CommonParameters>]
See the command anatomy

Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.

Set-Acl [-Path] <String[]> [-AclObject] <Object> [-ClearCentralAccessPolicy] [-Passthru] [-Filter <String>] [-WhatIf] [-Confirm] [<CommonParameters>]
  1. Stage 1Set-Acl-Path -AclObject -ClearCentralAccessPolicy -Passthru -Filter -WhatIf -Confirm

    Try it

    Windows PowerShell

    PowerShell example · browser support is limited.

    Execution scope: The full example below requires PowerShell outside this browser. You can edit this runner to use the supported practice commands; unsupported syntax returns an explanation.

    Interactive simulation · fictional data

    Examples

    Set-Acl -Path C:\Scripts

    1PS> $acl = Get-Acl C:\Scripts
    2PS> $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("CORP\Ops-Team", "Modify", "ContainerInherit,ObjectInherit", "None", "Allow")
    3PS> $acl.AddAccessRule($rule)
    4PS> Set-Acl -Path C:\Scripts -AclObject $acl
    Show reference output

    Sample output · fictional data, shaped like the real thing

        Directory: C:\


Path                                     Owner                  Access
----                                     -----                  ------
Scripts                                  BUILTIN\Administrators NT AUTHORITY\SYSTEM Allow  FullControl...

    Set-Acl -Path C:\Scripts (2)

    1PS> $acl = Get-Acl C:\Scripts
    2PS> $acl.SetAccessRuleProtection($true,$true) # break inheritance, copying current entries
    3PS> Set-Acl -Path C:\Scripts -AclObject $acl # apply the change
    Show reference output

    Sample output · fictional data, shaped like the real thing

    (No pipeline output. Inheritance was disabled on the in-memory ACL object; existing rules were preserved.)

    Set-Acl -Path C:\Scripts (3)

    1PS> $acl = Get-Acl C:\Scripts
    2PS> $acl.SetAccessRuleProtection($true, $true)
    3PS> Set-Acl -Path C:\Scripts -AclObject $acl
    Show reference output

    Sample output · fictional data, shaped like the real thing

    Path   : C:\Scripts
Owner  : BUILTIN\Administrators
Access : NT AUTHORITY\SYSTEM Allow  FullControl
         BUILTIN\Administrators Allow  FullControl
         BUILTIN\Users Allow  ReadAndExecute, Synchronize

    Parameters

    Parameter definitions:

    • -Path
    • -AclObject
    • -ClearCentralAccessPolicy
    • -Passthru
    • -Filter
    • -WhatIf
    • -Confirm

    Set-Acl on Microsoft Learn

    Practical use and troubleshooting

    Practical scenario: Use Set-Acl when you need to apply a security descriptor to a file, folder or registry key. Review syntax and sample output, then try an example in the browser lab. Start with one identified target and inspect the returned values before extending the operation to a list. Keep the identity in your report so you can trace each result back to the object or path that produced it.

    Common error and fix: Access denied when applying an ACL requires the appropriate rights on the target. Save the current descriptor, inspect the proposed rules and avoid copying unrelated inheritance settings blindly. In an unattended script, capture this failure with its original error record and record which target failed. An empty result and an unsuccessful query must remain distinguishable in the final report.

    See also: Get-Acl. Get-Acl retrieves a security descriptor; Set-Acl applies one. Review the intended access rules and ownership before writing a descriptor back to a file or directory. Read the linked command before substituting it; similar names do not imply identical inputs or output.

    Set-Acl reference on Microsoft Learn

    Recap

    Set-Acl Use Set-Acl to apply a security descriptor to a file, folder or registry key.

    Next: Get-Acl
    Genie guideSet-Acl

    Use Set-Acl to apply a security descriptor to a file, folder or registry key. The console below is pre-loaded — run it, then change a value and run it again.

    Explore PowerShell Genie

    Related