Set-ACL删除内置帐户

Question

我尝试添加权限到现有共享。该共享在Windows Server 2012（创建者所有者，系统...）上具有4个默认权限。

当我从Win7客户端运行脚本时，它会删除所有ntfs权限，并仅添加脚本中的帐户。任何想法???

$folder = Get-Acl "\\win-gv2fnajsqvu\a-og"
$newACL = New-Object System.Security.AccessControl.FileSystemAccessRule("test\user2","FullControl","ContainerInherit,ObjectInherit","None","Allow")
$folder.AddAccessRule($newACL)
Set-Acl "\\win-gv2fnajsqvu\a-og" -aclobject $Folder    

Answer 1

看起来这些是要删除的继承属性。尝试在SetAccessRuleProtection对象上强制$true到$folder获取“preserveInheritance”：

$folder = Get-Acl "\\win-gv2fnajsqvu\a-og"
$folder.SetAccessRuleProtection($true, $true)
$newACL = New-Object System.Security.AccessControl.FileSystemAccessRule("test\user2","FullControl","ContainerInherit,ObjectInherit","None","Allow")
$folder.AddAccessRule($newACL)
Set-Acl "\\win-gv2fnajsqvu\a-og" -aclobject $folder