# Get/Set-ACL, Auditing, Inheritance

**URL:** <https://forums.powershell.org/t/get-set-acl-auditing-inheritance/22564>\
**Category:** PowerShell Help\
**Created:** [July 5, 2023, 4:07pm UTC](https://forums.powershell.org/t/get-set-acl-auditing-inheritance/22564 "2023-07-05T16:07:31Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tao](https://avatars.discourse-cdn.com/v4/letter/t/f9ae1b/32.png) [@tao](https://forums.powershell.org/u/tao)\
**Post date:** [July 5, 2023, 4:07pm UTC](https://forums.powershell.org/t/get-set-acl-auditing-inheritance/22564/1 "2023-07-05T16:07:31Z")

</div>

Hi,

Hope you can help. I’ve created this script to remove all auditing from all files/folder/sub-folders. It seems to work apart from where inheritance has been disabled. What am I doing wrong please?

````auto
$PathList = Get-Content C:\NetApp\script\pathlist.txt

foreach($path in $PathList) 
{
  $acl = Get-Acl $path -Audit
  $acl.SetAuditRuleProtection($True, $False)
  $acl.GetAuditRules($True, $False, [System.Security.Principal.SecurityIdentifier]) | Foreach-Object { $acl.RemoveAuditRule($_); }
  Set-Acl $path $acl

    $files = Get-ChildItem -Path $Path -File -Recurse
    foreach ($file in $files) {
        $fileacl = Get-Acl $file.FullName -Audit
        $fileacl.SetAuditRuleProtection($True, $False)
        $fileacl.GetAuditRules($True, $False, [System.Security.Principal.SecurityIdentifier]) | Foreach-Object { $fileacl.RemoveAuditRule($_); }
        Set-Acl $file.FullName $fileacl
       
    }
}```
````

---

<div class="post-metadata">

**Author:** ![tao](https://avatars.discourse-cdn.com/v4/letter/t/f9ae1b/32.png) [@tao](https://forums.powershell.org/u/tao)\
**Post date:** [July 9, 2023, 7:09am UTC](https://forums.powershell.org/t/get-set-acl-auditing-inheritance/22564/2 "2023-07-09T07:09:16Z")

</div>

Anyone please? Thanks in advance

---

<div class="post-metadata">

**Author:** ![matt-bloomfield](https://avatars.discourse-cdn.com/v4/letter/m/dec6dc/32.png) [@matt-bloomfield](https://forums.powershell.org/u/matt-bloomfield)\
**Post date:** [July 9, 2023, 10:36am UTC](https://forums.powershell.org/t/get-set-acl-auditing-inheritance/22564/3 "2023-07-09T10:36:26Z")

</div>

I can’t replicate the problem you’re having. I have tested your code with the following folder structure:

```auto
Folder1\
 File1.txt
 Folder2\
    File2.txt

```

I applied a SACL to Folder1, then disabled inheritence on File2.txt and converted to the SACL to an explicit audit entry on File2.txt. I also created a second entry on File2.txt.

When I run your code, with Folder1 listed in `pathlist.txt`, the audit entries are removed from all folders and files, including File2.txt.

As your code is OK, this may be a problem with your permissions or the ownership of the files. Are you able to remove the entries manually via the Explorer GUI?

---

<div class="post-metadata">

**Author:** ![tao](https://avatars.discourse-cdn.com/v4/letter/t/f9ae1b/32.png) [@tao](https://forums.powershell.org/u/tao)\
**Post date:** [July 13, 2023, 1:28pm UTC](https://forums.powershell.org/t/get-set-acl-auditing-inheritance/22564/4 "2023-07-13T13:28:36Z")

</div>

Thanks for your response Matt. My test environment looks like this:

![test.folders](https://us1.discourse-cdn.com/flex019/uploads/powershell/original/2X/1/1ba04f361661d4708bfe1e15c36cd906b75ae91c.jpeg)

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 8:14pm UTC](https://forums.powershell.org/t/get-set-acl-auditing-inheritance/22564/5 "2024-05-16T20:14:46Z")

</div>