Get file or folder permissions using PowerShell

The Get-Acl cmdlet in PowerShell’s Security module (Microsoft.PowerShell.Security) does a great job of getting file or folder permissions (aka the Access Control List or ACL). But getting useful info from the default output can take some getting used to.

Instead, it’d be great to simply be able to see what the Security tab of a file, folder or other resource displays, but without having to go through the File Explorer UI and multiple clicks.

Figure 1: Security tab of a folder in Windows Explorer

One-liner: Get file or folder permissions

Here’s a one-liner to do exactly that:

(get-acl <folder name>).access | ft IdentityReference,FileSystemRights,AccessControlType,IsInherited,InheritanceFlags -auto

The output:

But this is a long command to remember. To avoid having to cut and paste every time you need to check file or folder permissions, it’s easier to add it as a function to your PowerShell profile.

Make it easier, use the Get-Permissions function

Want to make the output more readable? Here’s a PowerShell function that uses custom labels (titles in each column of the table).

You can either save it as a PowerShell script or add it to your PowerShell profile so it’s always available.

1
2
3
4
5
6
7
8
9

  function Get-Permissions ($folder) {
  (get-acl $folder).access | select `
		@{Label="Identity";Expression={$_.IdentityReference}}, `
		@{Label="Right";Expression={$_.FileSystemRights}}, `
		@{Label="Access";Expression={$_.AccessControlType}}, `
		@{Label="Inherited";Expression={$_.IsInherited}}, `
		@{Label="Inheritance Flags";Expression={$_.InheritanceFlags}}, `
		@{Label="Propagation Flags";Expression={$_.PropagationFlags}} | ft -auto
		}

You can omit the two inheritance-related properties if you don’t need that information.

Now you can use Get-Permissions with the folder name:

Get-Permissions c:\myfolder

The output:

You can also pipe output from the dir, ls or gci commands, all of which are PowerShell aliases for the Get-ChildItem cmdlet.

dir <path> | % {Get-Permissions -path $_.fullname}

A function to open file or folder Properties in Explorer

If you really like to see the permissions in the File Explorer GUI, you can use this function to open the Properties > General page of the file or folder. (I haven’t found a way to directly open the Security tab. If you know how to do this, please share in the post comments.).

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

function Get-Properties ($path) {
	#exit if path not found
	if (-not ($path | Test-Path)) {
        Write-Host "$path not found. Please specify a valid file or folder path." -foregroundcolor red
        return }
 
	$o = new-object -com Shell.Application
	$item = get-item $path
 
	if ($item.gettype() -eq [System.IO.DirectoryInfo]) {
		write-host "Found folder $path... Getting properties"	
		$fso = $o.Namespace("$path")
		$fso.self.InvokeVerb("properties")
	        }
 
	if ($item.gettype() -eq [System.IO.FileInfo])
		{write-host "Found file $path... Getting properties"		
		$fso = $o.Namespace($item.directoryname)
		$file = $fso.parsename($item.pschildname)
		$file.InvokeVerb("properties")
		}
}

Now just use Get-Properties <Folder of file name> to quickly open the file or folder’s properties page from the shell.

Figure 2: Use the Get-Properties function to quickly open a file or folder’s Properties from PowerShell

File System Security PowerShell Module

Microsoft PFE Raimund Andrée published the File System Security PowerShell Module a while ago. It adds some useful cmdlets to manage file system permissions using PowerShell. Also checkout his corresponding blog posts Weekend Scripter: Use PowerShell to Get, Add, and Remove NTFS Permissions and NTFSSecurity Tutorial 2 – Managing NTFS Inheritance and Using Privileges.

Tags
PowerShell   Scripts   Security   Windows