# Problem with folder permission

**URL:** <https://forums.powershell.org/t/problem-with-folder-permission/18470>\
**Category:** PowerShell Help\
**Created:** [January 31, 2022, 7:41pm UTC](https://forums.powershell.org/t/problem-with-folder-permission/18470 "2022-01-31T19:41:41Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Perry](https://avatars.discourse-cdn.com/v4/letter/p/b4bc9f/32.png) [@Perry](https://forums.powershell.org/u/Perry)\
**Post date:** [January 31, 2022, 7:41pm UTC](https://forums.powershell.org/t/problem-with-folder-permission/18470/1 "2022-01-31T19:41:41Z")

</div>

Hi all, i’m a newbie in powershell, months ago I was helped by some forum users, so I’m still here asking for your help.  
I have a problem that I cannot solve, I need to assign the permissions listed as follows to a folder:

- Username (full Control)
- Domain Admins (full Control)
- FS technicians (Full Control).  
I copy the permissions of a folder to the destination folder but the user for which I am running the script is not entered and the permissions are like this:
- Domain Admins (Full Control)
- Domain User (Read)  
Technical FS (Full Control).  
Above the script  
Thanx all for the help  
The error begin on line 75.

```auto
Remove-Variable * -ErrorAction SilentlyContinue; Remove-Module *; $error.Clear(); Clear-Host

Add-Type -AssemblyName System.Windows.Forms

#[System.Windows.MessageBox]::Show('ATTENZIONE: lo script può essere lanciato solo in contesto Amministrativo (a+username)')

$FileBrowser = New-Object System.Windows.Forms.OpenFileDialog -Property @{
    Multiselect = $true
}

[void]$FileBrowser.ShowDialog()
$FileBrowser.FileNames

$ADUsers = Import-Csv -Path $FileBrowser.FileNames -Delimiter ';'

$ADUsers | Where-Object { $_.username -match '\S'} | ForEach-Object {
    $Username = $_.username
    if (Get-ADUser -Filter "SamAccountName -eq '$Username'" -ErrorAction SilentlyContinue) {
        Write-Warning "A user account with SamAccountName '$Username' already exist in Active Directory."
    }
    else {
        $userParams = @{
            SamAccountName = $_.username
            UserPrincipalName = "$($_.username)@reggiocity.it"
            Name = $_.username
            GivenName = $_.givenName
            Surname = $_.sn
            Enabled = $true
            DisplayName = $_.username
            Path = $_.path
            AccountPassword = (ConvertTo-SecureString $_.Password -AsPlainText -Force)
            ChangePasswordAtLogon = $true
            description = $_.description
            OfficePhone = $_.telephoneNumber
            EmailAddress = $_.mail
            POBox = $_.postOfficeBox
            ScriptPath = $_.scriptPath
            HomeDirectory = $_.homeDirectory
            HomeDrive = $_.homeDrive
            MobilePhone = $_.mobile
            HomePhone = $_.HomePhone
            Title = $_.Title
            Department = $_.department
            Company = $_.company
        }
        
        #Creazione Quota W:\
        $PSScriptRoot = “\\reggiocity.it\fs\Gestione Tecnologie e Sistemi Informativi\UOC Gestione Strutture Tecnologiche\Quota_Set”
        $arg = ("-n {0}" -f $Username)
        $proc = Start-Process -FilePath "quota_create_unity.cmd" -WorkingDirectory $PSScriptRoot -ArgumentList $arg -Wait -PassThru 
                
        if ($_.manager) {
            $userParams.Manager = $_.manager
        }
        if ($_.accountExpires) {
            $userParams.AccountExpirationDate = $_.accountExpires
        }
        New-ADUser @userParams -PassThru | 
            Set-ADUser -Replace @{pager = $($_.pager)}
            
            $Inputstring = $($_.MemberOf)
            $CharArray =$Inputstring.Split(",") 
            #$CharArray
            

            ForEach ($Items in $Username)

                {
                if (!$CharArray -eq "" -or !$CharArray -eq $null) {
                Add-ADPrincipalGroupMembership -Identity $Username -MemberOf $CharArray }
                Get-ADuser "$Username" |Set-ADuser -Replace @{PrimaryGroupID = $($_.PrimaryGroupID)}
                }                     
        
        #Start-Sleep -s 5
        #Modifica ACL per cartella W:
                    $PathSRC="\\reggiocity.it\fs\Utenti\Default"
                    $PathTRG="\\reggiocity.it\fs\utenti\" + $Username
                    Get-acl $PathSRC | Set-Acl $PathTRG
                    $acl = Get-Acl $PathTRG
                    $AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule($Username,'FullControl',('ContainerInherit,ObjectInherit'),'None','Allow')
                    $acl.SetAccessRuleProtection($true,$true)
                    $acl.SetAccessRule($AccessRule)
                    $acl | Set-Acl $PathTRG
        
        #lancio Chrome per registrazione utente su Domino
        Start-Sleep -s 5
        $url="http://webmail.municipio.re.it/utilities/reguser.nsf/Registra%20Utente?openagent"
        $null =[System.Diagnostics.Process]::Start("chrome.exe","$url")
                                
        #Write-Host "Created new user '$Username' with initial password: $($_.Password)"
        #Write-Host "gruppi a cui appartiene= $($_.MemberOf)"
    }
}

```

The error is here:

 ![errore creazione utente](https://us1.discourse-cdn.com/flex019/uploads/powershell/original/2X/5/5fce51f85ec283f26d7c788d35b700bc07003f36.jpeg)

---

<div class="post-metadata">

**Author:** ![kvprasoon](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/kvprasoon/32/4449_2.png) [@kvprasoon](https://forums.powershell.org/u/kvprasoon)\
**Post date:** [February 1, 2022, 3:55am UTC](https://forums.powershell.org/t/problem-with-folder-permission/18470/2 "2022-02-01T03:55:31Z")

</div>

It would be great if you can convert the error to English which is the forum language.

---

<div class="post-metadata">

**Author:** ![Perry](https://avatars.discourse-cdn.com/v4/letter/p/b4bc9f/32.png) [@Perry](https://forums.powershell.org/u/Perry)\
**Post date:** [February 1, 2022, 7:19am UTC](https://forums.powershell.org/t/problem-with-folder-permission/18470/3 "2022-02-01T07:19:39Z")

</div>

Sure, sorry my OS is in Italian,below the translation:

Set Acl: unable to convert part and or all of the identity references

…

Exception when calling “SetAccessRule” with “1” argument (s):unable to convert part and or all of the identity references

…

Set Acl: unable to convert part and or all of the identity references

…

---

<div class="post-metadata">

**Author:** ![Perry](https://avatars.discourse-cdn.com/v4/letter/p/b4bc9f/32.png) [@Perry](https://forums.powershell.org/u/Perry)\
**Post date:** [February 1, 2022, 12:21pm UTC](https://forums.powershell.org/t/problem-with-folder-permission/18470/4 "2022-02-01T12:21:58Z")

</div>

Helpdesk users who run this script, and see the error, belong to the AD Account Operators group. If I try it with the Domain Admin user everything works fine. It seems that the Account Operators group does not have the privileges to write ACLs, is this possible? If so, what privileges must the user have to modify and write permissions on a folder? Thank you

---

<div class="post-metadata">

**Author:** ![Perry](https://avatars.discourse-cdn.com/v4/letter/p/b4bc9f/32.png) [@Perry](https://forums.powershell.org/u/Perry)\
**Post date:** [February 1, 2022, 4:19pm UTC](https://forums.powershell.org/t/problem-with-folder-permission/18470/5 "2022-02-01T16:19:09Z")

</div>

I Solved, this work:

```auto
$Username='Pippo'
$PathTRG = ('\\reggiocity.it\fs\utenti\' + $Username)

#1 - Rimuovere hineritance dalla Homefolder del nuovo utente
icacls $PathTRG /inheritance:d

#Rimuove i domain users dalla cartella del nuovo utente
icacls $PathTRG /remove "pdc-cued\domain users"

#Aggiunge all'utente gli attributi di fullcontrol:
#icacls $PathTRG /grant:r '"pdc-cued\Pippo:(OI)(CI)(F)"' /T /C

$rule = $Username + ':(OI)(CI)(F)'
icacls $PathTRG /grant $rule /T /C

```

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 8:19pm UTC](https://forums.powershell.org/t/problem-with-folder-permission/18470/6 "2024-05-16T20:19:40Z")

</div>