CmdID / PowerShell / Cmdlets / Set
Set-Acl
Changes the security descriptor of a specified item, such as a file or a registry key. PowerShell reference
From the PowerShell reference 13 parameters 2 Sigma rules look for it
What it does
Changes the security descriptor of a specified item, such as a file or a registry key. The Set-Acl cmdlet changes the security descriptor of a specified item, such as a file or a registry key, to match the values in a security descriptor that you supply. To use Set-Acl, use the Path or InputObject parameter to identify the item whose security descriptor you want to change. Then, use the AclObject or SecurityDescriptor parameters to supply a security descriptor that has the values you want to apply. Set-Acl applies the security descriptor that is supplied. It uses the value of the AclObject parameter as a model and changes the values in the item's security descriptor to match the values in the AclObject parameter.
Set-Acl [-Path] <String[]> [-AclObject] <Object> [[-CentralAccessPolicy] <String>] [-ClearCentralAccessPolicy] [-PassThru] [-Filter <String>] [-Include <String[]>] [-Exclude <String[]>] [-WhatIf] [-Confirm] [-UseTransaction] [<CommonParameters>]Set-Acl [-InputObject] <PSObject> [-AclObject] <Object> [-PassThru] [-Filter <String>] [-Include <String[]>] [-Exclude <String[]>] [-WhatIf] [-Confirm] [-UseTransaction] [<CommonParameters>]Set-Acl -LiteralPath <String[]> [-AclObject] <Object> [[-CentralAccessPolicy] <String>] [-ClearCentralAccessPolicy] [-PassThru] [-Filter <String>] [-Include <String[]>] [-Exclude <String[]>] [-WhatIf] [-Confirm] [-UseTransaction] [<CommonParameters>]Copy a security descriptor from one file to another
$DogACL = Get-Acl -Path "C:\Dog.txt"
Set-Acl -Path "C:\Cat.txt" -AclObject $DogACLIdentifyTrips 1 Sigma rule: highPowerShell Script Change Permission Via Set-Acl by Nasreddine Bencherchali (Nextron Systems)
Use the pipeline operator to pass a descriptor
Get-Acl -Path "C:\Dog.txt" | Set-Acl -Path "C:\Cat.txt"IdentifyApply a security descriptor to multiple files
$NewAcl = Get-Acl File0.txt
Get-ChildItem -Path "C:\temp" -Recurse -Include "*.txt" -Force | Set-Acl -AclObject $NewAclIdentifyTrips 1 Sigma rule: highPowerShell Script Change Permission Via Set-Acl by Nasreddine Bencherchali (Nextron Systems)
Disable inheritance and preserve inherited access rules
$NewAcl = Get-Acl -Path "C:\Pets\Dog.txt"
$isProtected = $true
$preserveInheritance = $true
$NewAcl.SetAccessRuleProtection($isProtected, $preserveInheritance)
Set-Acl -Path "C:\Pets\Dog.txt" -AclObject $NewAclIdentifyTrips 1 Sigma rule: highPowerShell Script Change Permission Via Set-Acl by Nasreddine Bencherchali (Nextron Systems)
Grant Administrators Full Control of the file
$NewAcl = Get-Acl -Path "C:\Pets\Dog.txt"
# Set properties
$identity = "BUILTIN\Administrators"
$fileSystemRights = "FullControl"
$type = "Allow"
# Create new rule
$fileSystemAccessRuleArgumentList = $identity, $fileSystemRights, $type
$newParams = @{
TypeName = 'System.Security.AccessControl.FileSystemAccessRule'
ArgumentList = $fileSystemAccessRuleArgumentList
}
$fileSystemAccessRule = New-Object @newParams
# Apply new rule
$NewAcl.SetAccessRule($fileSystemAccessRule)
Set-Acl -Path "C:\Pets\Dog.txt" -AclObject $NewAclIdentifyTrips 1 Sigma rule: highPowerShell Script Change Permission Via Set-Acl by Nasreddine Bencherchali (Nextron Systems)
Its page in the reference: Set-Acl.
Parameters
-AclObjectSpecifies an ACL with the desired property values. Set-Acl changes the ACL of item specified by the Path or InputObject parameter to match the values in the specified security object.
You can save the output of a Get-Acl command in a variable and then use the AclObject parameter to pass the variable, or type a Get-Acl command.-CentralAccessPolicyEstablishes or changes the central access policy of the item. Enter the CAP ID or friendly name of a central access policy on the computer.
Beginning in Windows Server 2012, administrators can use Active Directory and Group Policy to set central access policies for users and groups. For more information, see Dynamic Access Control: Scenario Overview.
This parameter was introduced in Windows PowerShell 3.0.-ClearCentralAccessPolicyRemoves the central access policy from the specified item.
Beginning in Windows Server 2012, administrators can use Active Directory and Group Policy to set central access policies for users and groups. For more information, see Dynamic Access Control: Scenario Overview.
This parameter was introduced in Windows PowerShell 3.0.-ExcludeOmits the specified items. The value of this parameter qualifies the Path parameter. Enter a path element or pattern, such as *.txt. Wildcards are permitted.-FilterSpecifies a filter in the provider's format or language. The value of this parameter qualifies the Path parameter. The syntax of the filter, including the use of wildcards, depends on the provider. Filters are more efficient than other parameters, because the provider applies them when retrieving the objects, rather than having PowerShell filter the objects after they are retrieved.-IncludeChanges only the specified items. The value of this parameter qualifies the Path parameter. Enter a path element or pattern, such as *.txt. Wildcards are permitted.-InputObjectChanges the security descriptor of the specified object. Enter a variable that contains the object or a command that gets the object.
You cannot pipe the object to be changed to Set-Acl. Instead, use the InputObject parameter explicitly in the command.
This parameter was introduced in Windows PowerShell 3.0.-LiteralPathChanges the security descriptor of the specified item. Unlike Path, the value of the LiteralPath parameter is used exactly as it is typed. No characters are interpreted as wildcards. If the path includes escape characters, enclose it in single quotation marks ('). Single quotation marks tell PowerShell not to interpret any characters as escape sequences.
This parameter was introduced in Windows PowerShell 3.0.-PassThruReturns an object that represents the security descriptor that was changed. By default, this cmdlet does not generate any output.-PathChanges the security descriptor of the specified item. Enter the path to an item, such as a path to a file or registry key. Wildcards are permitted.
If you pass a security object to Set-Acl (either by using the AclObject or SecurityDescriptor parameters or by passing a security object from Get-Acl to Set-Acl), and you omit the Path parameter (name and value), Set-Acl uses the path that is included in the security object.-UseTransactionIncludes the command in the active transaction. This parameter is valid only when a transaction is in progress. For more information, see about_Transactions.-ConfirmPrompts you for confirmation before running the cmdlet.-WhatIfShows what would happen if the cmdlet runs. The cmdlet is not run.