使用PowerShell更改权限不会传播给孩子

Question

当我使用powershell和set-acl设置新的filesystemaccess规则时,我将继承标志设置为传播给子对象和叶对象

$acl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule(
    "username","FullControl", "ContainerInherit, ObjectInherit", "None", "Allow")))
Set-Acl -path $filename -aclObject $acl

当我在安全选项卡中查看资源管理器中的权限..高级..传播设置正确.但如果我亲眼看看孩子,他们就不会显示新的安全规则.

如果在资源管理器中,我添加另一个具有不同SID的规则..并保存它(不强制选项'替换所有子对象权限...').然后手册和powershell规则都显示在孩子身上.它似乎需要某种启动才能让孩子们接受新的传播规则.为了使子对象显示添加了新规则,我缺少什么？

Answer 1

我有同样的逻辑问题......

$acl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule(
"username","FullControl", "ContainerInherit, ObjectInherit", "None", "Allow")))

最后'无'你说的是:不要传播...改为:

$acl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule(
"username","FullControl", "ContainerInherit, ObjectInherit", "InheritOnly", "Allow")))

它会传播你的设置.在这里查看访问规则选项:http://msdn.microsoft.com/en-us/library/ms147785.aspx

这些是传播标志:http: //msdn.microsoft.com/en-us/library/system.security.accesscontrol.propagationflags.aspx

Answer 2

这很奇怪。我有类似的代码，以相同的方式设置权限。我从未检查过孩子们的权限是否已设置。这可能只是 Windows 资源管理器 UI 中的一些奇怪现象。您是否使用 PowerShell 获取其中一个子级的 ACL 以检查权限是否已应用？

作为参考，这是我用来授予权限的代码：

foreach( $permission in $Permissions )
{
    $right = ($permission -as "Security.AccessControl.FileSystemRights")
    if( -not $right )
    {
        throw "Invalid FileSystemRights: $permission.  Must be one of $([Enum]::GetNames("Security.AccessControl.FileSystemRights"))."
    }
    $rights = $rights -bor $right
}

Write-Host "Granting $Identity $Permissions on $Path."
# We don't use Get-Acl because it returns the whole security descriptor, which includes owner information.
# When passed to Set-Acl, this causes intermittent errors.  So, we just grab the ACL portion of the security descriptor.
# See http://www.bilalaslam.com/2010/12/14/powershell-workaround-for-the-security-identifier-is-not-allowed-to-be-the-owner-of-this-object-with-set-acl/
$currentAcl = (Get-Item $Path).GetAccessControl("Access")

$inheritanceFlags = [Security.AccessControl.InheritanceFlags]::None
if( Test-Path $Path -PathType Container )
{
    $inheritanceFlags = ([Security.AccessControl.InheritanceFlags]::ContainerInherit -bor `
                         [Security.AccessControl.InheritanceFlags]::ObjectInherit)
}
$propagationFlags = [Security.AccessControl.PropagationFlags]::None
$accessRule = New-Object "Security.AccessControl.FileSystemAccessRule" $identity,$rights,$inheritanceFlags,$propagationFlags,"Allow"    
$currentAcl.SetAccessRule( $accessRule )
Set-Acl $Path $currentAcl