Execute icacls in PowerShell to grant access to a file share for domain computer

Question

I wonder how to uses icacls within a PowerShell script for setting up permissions on a fileshare for a computeraccount for e.g. Domain\myServer$.

This is what I'm trying:

$ComputerAccount = "domain\myServer$"
$Folder = "\\TestServer\TestShare\folder1"
$rule = $ComputerAccount+':(M),(OI),(CI)'
$resICacls = Invoke-Expression "icacls $folder /grant $rule"

I got this error message:

Invoke-Expression : At line:1 char:83
+ ... ant Domain\myServer$:(M),(OI),(CI)
+                    ~~

Variable reference is not valid. '$' was not followed by a valid variable name
character. Consider using ${} to delimit the name.
At c:\Binary\testacl.ps1:12 char:26
+             $resICacls = Invoke-Expression "icacls $folder /grant $rule"
+                          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ParserError: (:) [Invoke-Expression], ParseException
    + FullyQualifiedErrorId : InvalidVariableReference,Microsoft.PowerShell.Commands.InvokeExpressionCommand

I tried different variants of escaping the $ but found no solution. Anyone haves a hint how to do this?

Ansgar Wiechers · Accepted Answer · 2019-08-14 09:11:47Z

8

Try using the call operator (&) or cmd /c instead of Invoke-Expression:

& icacls $folder /grant $rule

cmd /c icacls $folder /grant $rule

or use Get-Acl/Set-Acl for changing permissions:

$permissions = 'Modify'
$inheritance = 'ContainerInherit, ObjectInherit'

$acl = Get-Acl -Path $folder
$ace = New-Object Security.AccessControl.FileSystemAccessRule ($ComputerAccount, $permissions, $inheritance, 'InheritOnly', 'Allow')
$acl.AddAccessRule($ace)
Set-Acl -AclObject $acl -Path $folder

edited Aug 14, 2019 at 9:11

answered Oct 30, 2014 at 10:32

Ansgar Wiechers

202k27 gold badges286 silver badges363 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Sᴀᴍ Onᴇᴌᴀ · Accepted Answer · 2017-07-05 16:04:59Z

1

Invoke-Expression -Command:icacls foldername /grant groupName:"(CI)(OI)M"

This works fine. So I guess that if you will put the command into single quote (i.e. '') it will work. For example:

$ComputerAccount = "domain\myServer$"
Invoke-Expression -Command:"icacls $ComputerAccount /grant GroupName:'(CI)(OI)M'"

edited Jul 5, 2017 at 16:04

Sᴀᴍ Onᴇᴌᴀ

8,3028 gold badges38 silver badges61 bronze badges

answered Jul 5, 2017 at 15:55

Maciej

312 bronze badges

Comments

Bbb · Accepted Answer · 2025-08-01 14:53:06Z

0

None of the answers above worked, below is what worked for me. The syntax is very finicky and the colon cannot be in the same string as the group or user and the permissions. The directory name does need to be in quotes

    $directory = "C:\Program Files (x86)\Tenacity";
    $group = "Everyone";
    $permissions = "(F) /T /C";
    $icaclsCommand = "icacls `"$($directory)`" /grant $($group):$($permissions)"
    cmd /c $icaclsCommand;

answered Aug 1 at 14:53

Bbb

72112 silver badges39 bronze badges

Collectives™ on Stack Overflow

Execute icacls in PowerShell to grant access to a file share for domain computer

3 Answers 3

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related