SetOwner without permission to Get-ACL
Hey everyone, I'm new to powershell and have started to try and make my life by scripting a few of my more time consuming tasks at work.
I've created a script to delete and recreate some folders but I'm running into a situation with a few folders' permissions.
for example there is a folder with an owner $user. With a domain admin account I in explorer can change the owner, give domain admins full control, and then delete the folder. Let's not worry about subfolders and files for now.
In powershell I use start job to authenticate as a domain admin and try to change ownership:
$account = New-Object System.Security.Principal.NTAccount("domainnt", "Domain Admins")
$acl = Get-Acl -Path $folder.fullname
$acl.SetOwner($account)
Set-Acl -Path $folder.fullname -AclObject $acl
When I attempt this Powershell gives me:
Attempted to perform an unauthorized operation. + CategoryInfo : NotSpecified: (:) [Get-Acl], UnauthorizedAccessException + FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.GetAclCommand + PSComputerName : localhost
It seems to me that I don't have permission to read the acl to be able to modify it, yet I can still change this folder's ownership via explorer. Are there any other ways within powershell that would allow me to modify the owner in this circumstance?
Edit: I accidently included the incorrect error output, now it's fixed and accurate.
Posted Jul 19, 2016, 5:40 PM UTC · edited
I hate
Get-ACLandSet-ACLthey never work right for me.Are there any "weird" characters in the path name? Specifically
[ ( - ) ]or a space? If so (or even if not) have you tried changing-Pathin both the Get/Set ACL to-LiteralPath? If there is a space in the path anywhere, you'll have to wrap the path in quotes...Shit! I realized reading this that I included the wrong error output test.
I don't believe it's a path issue but I'm open to anything at this point. These folders don't have any abnormal characters. all alphanumeric, sometimes containing a period. They're user folders actually, or copies of them.
Ah, an unauthorized error makes a little more sense now. :)
Try running PowerShell / ISE as administrator... if that doesn't work (I honestly don't think it will), you might have to use a hacky solution where you take ownership of the file/folder, then set the owner to something else:
I thought of that too just to be thorough but no sadly elevating did not work :(.
See though, that's what I'm trying to do. I haven't looked into takeown.exe but I may have to.
But could I possibly construct a blank acl and apply it? I was trying to use get acl to then modify the owner and set the updated acl back onto the folder. If I can't get it as a reference, is there any other way to create and apply an acl without the previous acl structure?