Get file or folder permissions using PowerShell

by Bharat Suneja

The Get-Acl cmdlet in PowerShell’s Security module (Microsoft.PowerShell.Security) does a great job of getting file or folder permissions (aka the Access Control List or ACL). But getting useful info from the default output can take some getting used to.

Instead, it’d be great to simply be able to see what the Security tab of a file, folder or other resource displays, but without having to go through the File Explorer UI and multiple clicks.

Security tab of folder properties in Windows
Figure 1: Security tab of a folder in Windows Explorer

One-liner: Get file or folder permissions

Here’s a one-liner to do exactly that:

(get-acl <folder name>).access | ft IdentityReference,FileSystemRights,AccessControlType,IsInherited,InheritanceFlags -auto

The output:
PowerShell Output of Get-Acl

The Get-Permissions function

Want to make the output more readable? Here’s a PowerShell function that uses custom labels (titles in each column of the table).

You can either save it as a PowerShell script or add it to your PowerShell profile so it’s always available.

1
2
3
4
5
6
7
8
9
  function Get-Permissions ($folder) {
  (get-acl $folder).access | select `
		@{Label="Identity";Expression={$_.IdentityReference}}, `
		@{Label="Right";Expression={$_.FileSystemRights}}, `
		@{Label="Access";Expression={$_.AccessControlType}}, `
		@{Label="Inherited";Expression={$_.IsInherited}}, `
		@{Label="Inheritance Flags";Expression={$_.InheritanceFlags}}, `
		@{Label="Propagation Flags";Expression={$_.PropagationFlags}} | ft -auto
		}

You can omit the two inheritance-related properties if you don’t need that information.

Now you can use Get-Permissions with the folder name:

Get-Permissions c:\myfolder

The output:
Screenshot: Output of Get-Permissions function

You can also pipe output from the dir, ls or gci commands, all of which are PowerShell aliases for the Get-ChildItem cmdlet.

dir <path> | % {Get-Permissions -path $_.fullname}

A function to open file or folder Properties in Explorer

If you really like to see the permissions in the File Explorer GUI, you can use this function to open the Properties > General page of the file or folder. (I haven’t found a way to directly open the Security tab. If you know how to do this, please share in the post comments.).

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
function Get-Properties ($path) {
	#exit if path not found
	if (-not ($path | Test-Path)) {
        Write-Host "$path not found. Please specify a valid file or folder path." -foregroundcolor red
        return }
 
	$o = new-object -com Shell.Application
	$item = get-item $path
 
	if ($item.gettype() -eq [System.IO.DirectoryInfo]) {
		write-host "Found folder $path... Getting properties"	
		$fso = $o.Namespace("$path")
		$fso.self.InvokeVerb("properties")
	        }
 
	if ($item.gettype() -eq [System.IO.FileInfo])
		{write-host "Found file $path... Getting properties"		
		$fso = $o.Namespace($item.directoryname)
		$file = $fso.parsename($item.pschildname)
		$file.InvokeVerb("properties")
		}
}

Now just use Get-Properties <Folder of file name> to quickly open the file or folder’s properties page from the shell.

Screenshot: File or folder Properties > General tab
Figure 2: Use the Get-Properties function to quickly open a file or folder’s Properties from PowerShell

File System Security PowerShell Module

Microsoft PFE Raimund Andrée published the File System Security PowerShell Module a while ago. It adds some useful cmdlets to manage file system permissions using PowerShell. Also checkout his corresponding blog posts Weekend Scripter: Use PowerShell to Get, Add, and Remove NTFS Permissions and NTFSSecurity Tutorial 2 – Managing NTFS Inheritance and Using Privileges.

{ 1 comment… read it below or add one }

Pelle August 1, 2018 at 4:12 am

Hi. This works great but do you know how come I cannot see Sharing tab in it?

Reply

Leave a Comment

Previous post:

Next post: