How to Use Windows PowerShell ‘Get-Acl’ and ‘Set-Acl’ to Manage File Permissions

The Nightmare of NTFS Permissions

Managing file and folder permissions in Windows (NTFS) via the graphical interface is a tedious process. You right-click a folder, select Properties, click the Security tab, click Advanced, and navigate a labyrinth of checkboxes to grant an employee “Modify” access.

If you need to audit who has access to the “Finance” folder, or if you need to instantly mirror the permissions of the “Marketing” folder onto a newly created “Sales” folder, the GUI is essentially useless.

For scalable, programmatic control over Windows file security, administrators rely on two powerful PowerShell cmdlets: Get-Acl (Access Control List) and Set-Acl.

1. Auditing Permissions (Get-Acl)

To instantly see who has access to a specific file or folder, use Get-Acl.

Get-Acl "C:\Finance\Q4_Report.xlsx"

By default, this command outputs a condensed table showing the Path, the Owner of the file, and a summarized string of the Access rights.

Extracting the Details

The default output isn’t very helpful for deep auditing. To see the exact, granular permissions assigned to each user or group, you need to expand the Access property.

(Get-Acl "C:\Finance\Q4_Report.xlsx").Access | Format-Table -AutoSize

This command extracts the hidden object data and formats it into a beautiful, readable table. You will clearly see the IdentityReference (the username or group, like CORP\jsmith), the FileSystemRights (e.g., FullControl, ReadAndExecute), and whether the permission was explicitly granted or inherited from a parent folder.

2. Cloning Permissions (The Magic Trick)

This is where PowerShell vastly outperforms the graphical interface.

Suppose you have a perfectly configured folder called TemplateProject. Only the management group can write to it, and employees can only read it. You just created a new folder called ProjectAlpha, and you want it to have the exact same complex security rules.

Instead of clicking through checkboxes for 10 minutes, you can clone the ACL in a single line of code:

Get-Acl "C:\Data\TemplateProject" | Set-Acl "C:\Data\ProjectAlpha"

How this works: PowerShell grabs the entire security object from the Template folder and instantly pipes it into the Set-Acl command, applying it flawlessly to the new folder. This guarantees zero human error when setting up secure directories.

3. Modifying Specific Permissions

Adding a new user to an existing folder is slightly more complex, as you have to construct a new security rule object before applying it.

Here is the standard three-step script to grant a user named “Alice” explicit “Modify” access to a folder, without wiping out the existing permissions of other users:

# 1. Grab the current ACL of the folder
$acl = Get-Acl "C:\Data\ProjectAlpha"

# 2. Create a new access rule (User: Alice, Rights: Modify, Type: Allow)
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule("CORP\Alice", "Modify", "Allow")

# 3. Add the rule to our ACL variable, and then save it back to the folder
$acl.SetAccessRule($rule)
Set-Acl "C:\Data\ProjectAlpha" $acl

Conclusion

The Get-Acl and Set-Acl cmdlets are essential for Windows system administration. By treating security rules as scriptable PowerShell objects, administrators can automate complex onboarding procedures, instantly audit sensitive directories, and eliminate the risk of accidental data exposure caused by manual GUI configuration.