>

Inspect and modify ACLs with Get-Acl and Set-Acl

Object-based NTFS permission management — read ACEs as structured data and write modified descriptors back with Set-Acl.

WindowsFilespermissionspowershellMedium risk
Run (Get-Acl <path>).Access | Format-Table to list permission entries; modify the object and pass it to Set-Acl to apply.

01Command

Command
$ (Get-Acl 'C:\Shared\Reports').Access | Format-Table IdentityReference, FileSystemRights, AccessControlType, IsInherited

02What it does

Get-Acl returns a .NET DirectorySecurity/FileSecurity object whose .Access collection gives typed fields — identity, rights, allow/deny, inheritance — instead of icacls' flat text. The usual pattern is $acl = Get-Acl $path; $acl.SetAccessRule(...); Set-Acl $path $acl, which also enables cloning a folder's security to another folder. Works for registry keys too with the RegistrySecurity provider.

03Risk

RiskMedium risk
RequirementsPowerShell; administrator rights to modify ACLs
!Warning: Set-Acl applies the whole descriptor, not a diff — if you edit a stale object you'll erase permissions that changed in the meantime, so re-read Get-Acl right before writing.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • Get-Acl - PowerShell
    SS64 · technical · 2026-09-17
    Evidence: SS64 shows Get-Acl piped to Select-Object/Format-Table to list ACEs, and saving a descriptor with $acl | Set-Acl.
  • Get-Acl | Microsoft Learn
    Microsoft · vendor-doc · 2026-09-17
    Evidence: Microsoft documents Get-Acl returning a security descriptor object with an Access collection, and the paired Set-Acl for applying modified descriptors.

Last verified: 2026-09-17 · Category: Files & Folders

06Related solutions

Check a drive for file system errors with chkdsk
WindowsFilessystemDiagnostics

Diagnose NTFS file system errors and bad sectors on any volume — including the system drive while Windows is running — before committing to a repair.

Low risk ✓ 2026-09-17
Mirror folders with robocopy for exact backups
WindowsFilessystemTerminal

Robocopy is Windows' built-in robust file copier: use /MIR to keep a destination folder as an exact one-way mirror of a source, resumable and restartable.

High risk ✓ 2026-09-17
Grep on Windows: Select-String
Windowssearchtextpowershell

Search inside text files and logs with regex, returning file, line number and match.

Low risk ✓ 2026-09-17