CmdID

CmdID / PowerShell / Cmdlets / Get

Get-Acl

Gets the security descriptor for a resource, such as a file or registry key. PowerShell reference

From the PowerShell reference 9 parameters

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

What it does

from the PowerShell reference, CC BY 4.0

Gets the security descriptor for a resource, such as a file or registry key. The Get-Acl cmdlet gets objects that represent the security descriptor of a file or resource. The security descriptor contains the access control lists (ACLs) of the resource. The ACL specifies the permissions that users and user groups have to access the resource. Beginning in Windows PowerShell 3.0, you can use the InputObject parameter of Get-Acl to get the security descriptor of objects that do not have a path.

Get-Acl [[-Path] <String[]>] [-Audit] [-AllCentralAccessPolicies] [-Filter <String>] [-Include <String[]>] [-Exclude <String[]>] [-UseTransaction] [<CommonParameters>]
Get-Acl -InputObject <PSObject> [-Audit] [-AllCentralAccessPolicies] [-Filter <String>] [-Include <String[]>] [-Exclude <String[]>] [-UseTransaction] [<CommonParameters>]
Get-Acl [-LiteralPath <String[]>] [-Audit] [-AllCentralAccessPolicies] [-Filter <String>] [-Include <String[]>] [-Exclude <String[]>] [-UseTransaction] [<CommonParameters>]

Example 1- Get an ACL for a folder

Get-Acl C:\WindowsIdentify

Example 2 - Get an ACL for a folder using wildcards

Get-Acl C:\Windows\s*.log | Format-List -Property PSPath, SddlIdentify

Example 3 - Get count of Audit entries for an ACL

Get-Acl C:\Windows\s*.log -Audit | ForEach-Object { $_.Audit.Count }Identify

Example 4 - Get an ACL for a registry key

Get-Acl -Path HKLM:\System\CurrentControlSet\Control | Format-ListIdentify

Example 5 - Get an ACL using InputObject

Get-Acl -InputObject (Get-StorageSubSystem -Name S087)Identify

Its page in the reference: Get-Acl.

Parameters

9 in the PowerShell reference
-AllCentralAccessPoliciesGets information about all central access policies that are enabled on the computer. Beginning in Windows Server 2012, administrators can use Active Directory and Group Policy to set central access policies for users and groups. For more information, see Dynamic Access Control: Scenario Overview. This parameter is introduced in Windows PowerShell 3.0.
-AuditGets the audit data for the security descriptor from the system access control list (SACL).
-ExcludeOmits the specified items. The value of this parameter qualifies the Path parameter. Enter a path element or pattern, such as *.txt. Wildcards are permitted.
-FilterSpecifies a filter in the provider's format or language. The value of this parameter qualifies the Path parameter. The syntax of the filter, including the use of wildcards, depends on the provider. Filters are more efficient than other parameters, because the provider applies them when getting the objects, rather than having PowerShell filter the objects after they are retrieved.
-IncludeGets only the specified items. The value of this parameter qualifies the Path parameter. Enter a path element or pattern, such as *.txt. Wildcards are permitted.
-InputObjectGets the security descriptor for the specified object. Enter a variable that contains the object or a command that gets the object. You cannot pipe an object, other than a path, to Get-Acl. Instead, use the InputObject parameter explicitly in the command. This parameter is introduced in Windows PowerShell 3.0.
-LiteralPathSpecifies the path to a resource. Unlike Path, the value of the LiteralPath parameter is used exactly as it is typed. No characters are interpreted as wildcards. If the path includes escape characters, enclose it in single quotation marks. Single quotation marks tell PowerShell not to interpret any characters as escape sequences. This parameter is introduced in Windows PowerShell 3.0.
-PathSpecifies the path to a resource. Get-Acl gets the security descriptor of the resource indicated by the path. Wildcards are permitted. If you omit the Path parameter, Get-Acl gets the security descriptor of the current directory. The parameter name ("Path") is optional.
-UseTransactionIncludes the command in the active transaction. This parameter is valid only when a transaction is in progress. For more information, see about_Transactions.

See also

Set-Acl