Set‑NTFSItemSecurityDescriptor

SYNOPSIS

Persists an edited NTFS security descriptor object to its item.

SYNTAX

Set-NTFSItemSecurityDescriptor [-InputObject] <PSObject> [-RequireUnchanged] [-PassThru]
 [-WhatIf] [-Confirm] [<CommonParameters>]

DESCRIPTION

Writes the selected sections of a WindowsAccessControl.SecurityDescriptor object back to the filesystem item it was read from. The descriptor is obtained from Get-NTFSItemSecurityDescriptor and can be edited in memory by piping it through mutating commands such as Add-NTFSAccessRule before it is persisted. Only the sections recorded on the descriptor are written, and the write happens once under ShouldProcess. A junction, a symbolic link, or a volume mount point is written as itself; its destination is not changed.

EXAMPLES

EXAMPLE 1

Get-NTFSItemSecurityDescriptor -LiteralPath C:\Data -Sections Access |
    Add-NTFSAccessRule -Account 'CONTOSO\Analysts' -AccessRights Read |
    Set-NTFSItemSecurityDescriptor

Stages a read access rule in memory and persists the DACL with one write.

EXAMPLE 2

$descriptor | Set-NTFSItemSecurityDescriptor -RequireUnchanged

Fails instead of overwriting a DACL that another writer changed.

PARAMETERS

-InputObject

A WindowsAccessControl.SecurityDescriptor object returned by Get-NTFSItemSecurityDescriptor, optionally after in-memory edits.

Type: PSObject
Parameter Sets: (All)
Aliases:

Required: True
Position: 1
Default value: None
Accept pipeline input: True (ByValue)
Accept wildcard characters: False

-PassThru

Returns the descriptor object after it is persisted. By default, the command does not emit output.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-RequireUnchanged

Rejects the write when the selected sections of the live item no longer match the ConcurrencyToken recorded when the descriptor was read. The default is last-writer-wins.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-Confirm

Prompts you for confirmation before running the cmdlet.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: cf

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-WhatIf

Shows what would happen if the cmdlet runs. The cmdlet is not run.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: wi

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

WindowsAccessControl.SecurityDescriptor

OUTPUTS

None

WindowsAccessControl.SecurityDescriptor

NOTES

RELATED LINKS