Get‑NTFSItemEffectiveAccess

SYNOPSIS

Gets effective NTFS access for a user SID.

SYNTAX

Path (Default)

Get-NTFSItemEffectiveAccess [[-Path] <String[]>] [-Account <String>] [-AccessRights <FileSystemRights>]
 [-ThrottleLimit <Int32>] [<CommonParameters>]

LiteralPath

Get-NTFSItemEffectiveAccess -LiteralPath <String[]> [-Account <String>] [-AccessRights <FileSystemRights>]
 [-ThrottleLimit <Int32>] [<CommonParameters>]

DESCRIPTION

Uses the Windows Authz API with MAXIMUM_ALLOWED to evaluate a file or directory security descriptor for a valid user SID. SID-based contexts can omit logon-specific groups and are less complete than a live token.

EXAMPLES

EXAMPLE 1

Get-NTFSItemEffectiveAccess -LiteralPath C:\Data -Account 'CONTOSO\Alice' -AccessRights Modify

Evaluates whether Alice receives Modify rights on C:\Data.

PARAMETERS

-AccessRights

Optional rights to test against the granted mask. IsAllowed is null when no requested rights are supplied.

Type: FileSystemRights
Parameter Sets: (All)
Aliases:
Accepted values: ReadData, ListDirectory, WriteData, CreateFiles, AppendData, CreateDirectories, ReadExtendedAttributes, WriteExtendedAttributes, ExecuteFile, Traverse, DeleteSubdirectoriesAndFiles, ReadAttributes, WriteAttributes, Write, Delete, ReadPermissions, Read, ReadAndExecute, Modify, ChangePermissions, TakeOwnership, Synchronize, FullControl

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Account

The user account name or SID evaluated by Authz. The current process identity is used when this parameter is omitted.

Type: String
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-LiteralPath

One or more filesystem paths used exactly as supplied. FileSystem objects bind to this parameter through their PSPath property.

Type: String[]
Parameter Sets: LiteralPath
Aliases: PSPath

Required: True
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-Path

One or more filesystem paths. Wildcards are expanded by the FileSystem provider, and path strings can be supplied through the pipeline.

Type: String[]
Parameter Sets: Path
Aliases: FullName

Required: False
Position: 1
Default value: .
Accept pipeline input: True (ByPropertyName, ByValue)
Accept wildcard characters: True

-ThrottleLimit

Limits concurrently processed canonical paths. One requests deterministic sequential execution.

Type: Int32
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: [Math]::Max(1, [Math]::Min(8, [Environment]::ProcessorCount))
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

System.String

System.IO.FileSystemInfo

OUTPUTS

WindowsAccessControl.EffectiveAccess

NOTES

RELATED LINKS