PowerShell设置高级NTFS权限

权限经过大量修改,如下所示：

(Get-Acl 'L:TestBeezRAPJOURAppels ListCorrect').Access

FileSystemRights  : FullControl
AccessControlType : Allow
IdentityReference : BUILTINAdministrators
IsInherited       : False
InheritanceFlags  : ContainerInherit,ObjectInherit
PropagationFlags  : None

FileSystemRights  : CreateFiles,AppendData,DeleteSubdirectoriesAndFiles,ReadAndExecute,Synchronize
AccessControlType : Allow
IdentityReference : DomainDirk
IsInherited       : False
InheritanceFlags  : None
PropagationFlags  : None

FileSystemRights  : DeleteSubdirectoriesAndFiles,Modify,Synchronize
AccessControlType : Allow
IdentityReference : DomainDirk
IsInherited       : False
InheritanceFlags  : ContainerInherit,ObjectInherit
PropagationFlags  : InheritOnly

>除了以下内容外,其他所有内容均已启用：完全控制,写入属性,写入扩展属性,删除,更改权限和获取所有权.

>一切都在开启,除了：完全控制,更改权限和获得所有权.

这是我用来应用权限的一段代码.在这种情况下,必须在更改部分中定义：

$f = 'L:TestBeezRAPJOURAppels ListWrong'
 $ADobject = 'DomainUser'
 $acl = Get-Acl $f

 $Grant = 'Change'
    # Remove user/group first
    $rule = New-Object system.security.AccessControl.FileSystemAccessRule("$ADobject","Read","Allow")
    $acl.RemoveAccessRuleAll($rule)

    # Add read permissions
    if ($Grant -eq 'ReadAndExecute') {
        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("$ADobject","ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
    }

    if ($Grant -eq 'Change') {
        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("$ADobject","Modify","Synchronize","Allow  DeleteSubdirectoriesAndFiles")
        $acl.AddAccessRule($rule)
        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("$ADobject","AppendData","Allow  CreateFiles","DeleteSubdirectoriesAndFiles")
    }

    if ($Grant -eq 'Modify') {
        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("$ADobject","Allow")
    }

    if ($Grant -eq 'FullControl') {
        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("$ADobject","FullControl","Allow")
    }

    if ($Grant -eq 'ListFolderContents') {
        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("$ADobject","ContainerInherit","Allow")
    }

$acl.AddAccessRule($rule)
Set-Acl $f $acl

我似乎无法正确的语法..谢谢你的帮助.

多亏了这个post,我已经找到了这个部分：

>’仅限子文件夹和文件’：“ContainerInherit,ObjectInherit”,“InheritOnly”
>’仅限此文件夹’：“无”,“继承仅限”