# error handling during get-acl access denied

**URL:** <https://forums.powershell.org/t/error-handling-during-get-acl-access-denied/5898>\
**Category:** PowerShell Help\
**Created:** [March 2, 2016, 5:03am UTC](https://forums.powershell.org/t/error-handling-during-get-acl-access-denied/5898 "2016-03-02T05:03:00Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![partho-sankar-roy](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/partho-sankar-roy/32/626_2.png) [@partho-sankar-roy](https://forums.powershell.org/u/partho-sankar-roy)\
**Post date:** [March 2, 2016, 5:03am UTC](https://forums.powershell.org/t/error-handling-during-get-acl-access-denied/5898/1 "2016-03-02T05:03:00Z")

</div>

Hi Guys,

I am trying to query for a list of users/groups having access to some shared location. However in some folders even administrator doesnt have permission, So the script I have come up with will skip those files/folders, but I am not sure why its not logging in to error.log. Any idea ?

$success = @()  
$failed = @()

gci $vStartingPath -recurse|

foreach-object {

$success = @()  
$failed = @()  
foreach-object {

if (get-acl $_.fullname){  
$success += get-acl $_.fullname |select pschildname, pspath, accesstostring  
}  
else {$failed += “Failed to get ACL on $($\_.fullname)”}  
}

$success | export-csv “C:\WINDOWS\system32\WindowsPowerShell\v1.0\vHope.csv”  
$failed | out-file error.log

---

<div class="post-metadata">

**Author:** ![donj](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/donj/32/137_2.png) [@donj](https://forums.powershell.org/u/donj)\
**Post date:** [March 2, 2016, 6:05am UTC](https://forums.powershell.org/t/error-handling-during-get-acl-access-denied/5898/2 "2016-03-02T06:05:34Z")

</div>

Look through “The Big Book of PowerShell Error Handling” (Resources menu, eBooks item) here for information on how to handle errors in script.

---

<div class="post-metadata">

**Author:** ![random-commandline](https://avatars.discourse-cdn.com/v4/letter/r/e56c9b/32.png) [@random-commandline](https://forums.powershell.org/u/random-commandline)\
**Post date:** [March 2, 2016, 7:19am UTC](https://forums.powershell.org/t/error-handling-during-get-acl-access-denied/5898/3 "2016-03-02T07:19:11Z")

</div>

```
# Export ACLs to csv and errors to txt file
Get-ChildItem $vStartingPath -Recurse -ErrorAction SilentlyContinue -ErrorVariable +failederrors | ForEach-Object {Get-acl -Path $_.FullName | 
Select-Object pschildname,pspath,accesstostring} | Export-Csv .\ACL.csv -NoTypeInformation
$failederrors.exception | out-file .\failederrors.txt
```

---

<div class="post-metadata">

**Author:** ![rohn-edwards](https://avatars.discourse-cdn.com/v4/letter/r/ce7236/32.png) [@rohn-edwards](https://forums.powershell.org/u/rohn-edwards)\
**Post date:** [March 2, 2016, 10:17am UTC](https://forums.powershell.org/t/error-handling-during-get-acl-access-denied/5898/4 "2016-03-02T10:17:48Z")

</div>

If you want to take a different approach, you might try to get version 4.0 of the [PowerShell Access Control Module](https://gallery.technet.microsoft.com/scriptcenter/PowerShellAccessControl-d3be7b83) (source available [here](https://github.com/rohnedwards/PowerShellAccessControl/tree/v4.0_devel)).

One of the features it offers is enabling the SeBackupPrivilege, which will let you completely ignore the DACLs on the files and folders that are giving you trouble (of course you have to have been granted that privilege, which is usually only for admins and/or backup operators). An example of using it to export all of the ACEs for your $vStartingPath location would look like this:

```
gci $vStartingPath -Recurse | 
    Get-PacAccessControlEntry -PacSDOption (New-PacSDOption -BypassAclCheck) | 
    Export-Csv c:\powershell\permissions.csv -NoTypeInformation
```

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 8:42pm UTC](https://forums.powershell.org/t/error-handling-during-get-acl-access-denied/5898/5 "2024-05-16T20:42:48Z")

</div>