---
title: "Manage NTFS Permissions with PowerShell: A Tutorial"
description: "Master the management of NTFS permissions in PowerShell with this comprehensive, step-by-step tutorial."
canonical: "https://adamtheautomator.com/ntfs-permissions/"
---

# Manage NTFS Permissions with PowerShell: A Tutorial

> Master the management of NTFS permissions in PowerShell with this comprehensive, step-by-step tutorial.

Source: https://adamtheautomator.com/ntfs-permissions/

---

ATA Learning

Tap to hide

[

ATA Learning

](/)

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Search for:  

*   [](https://twitter.com/adbertram)
*   [](https://github.com/Adam-the-Automator)
*   [](https://www.linkedin.com/company/adam-the-automator-llc)
*   [](/feed/)

![Manage NTFS Permissions with PowerShell: A Tutorial](https://adamtheautomator.com/wp-content/uploads/2020/09/New-Technology-File-System-1.png)

# Manage NTFS Permissions with PowerShell: A Tutorial

[![](https://secure.gravatar.com/avatar/4147968aa2332aa682bcebf295e4e9d0eb2672dee3d9ae0523a00ac51e7d6017?s=192&d=mm&r=g)Bill Kindle](https://adamtheautomator.com/author/bill/)10 September 20208 min. read

Categories: [IT Ops](/category/it-ops/)

Tags:[PowerShell](/tag/powershell/)

Table of Contents

*   [Prerequisites](#h-prerequisites)
*   [Creating a Files/Folders to Test With](#h-creating-a-files-folders-to-test-with)
*   [Viewing NTFS Permissions With Get-Acl](#h-viewing-ntfs-permissions-with-get-acl)
*   [Displaying NTFS Permissions](#h-displaying-ntfs-permissions)
*   [Filtering Access Objects](#h-filtering-access-objects)
*   [Modifying NTFS NTFS Permissions With Set-Acl](#h-modifying-ntfs-ntfs-permissions-with-set-acl)
*   [Copying NTFS Permissions](#h-copying-ntfs-permissions)
*   [Adding NTFS Permissions](#h-adding-ntfs-permissions)
*   [Removing NTFS Permissions](#h-removing-ntfs-permissions)
*   [Summary](#h-summary)
*   [Further Reading](#h-further-reading)

If you’re an IT professional and find yourself struggling with setting file system permission for your organizations, you’re in luck. Managing NTFS permissions using a GUI is time-consuming especially when working with many users or groups. Luckily, we have PowerShell to make it all better. How? The [Microsoft.PowerShell.Security](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.security/?view=powershell-7) module.

Not a reader? Watch this related video tutorial!

**_Not seeing the video? Make sure your ad blocker is disabled._**

PowerShell has two cmdlets specifically for working with ACLs called `Get-ACL` and `Set-ACL`. These two cmdlets can retrieve and assign any number of NTFS permissions which you’ll learn all about in this tutorial. If you want to become more efficient and immediately useful in managing NTFS permissions, keep reading.

> _No time to read? Not a problem! Watch this companion video from [TechSnips.io](http://techsnips.io/)‘s Anthony Howell below:_

> Manage and Report Active Directory, Exchange and Microsoft 365 with ManageEngine ADManager Plus. [Download Free Trial!](https://www.manageengine.com/products/ad-manager/tp/windows-active-directory-management-tool.html?utm_source=ata&utm_medium=website-listing&utm_campaign=admp-ntfs)

## Prerequisites

To follow along with the examples in this tutorial, you need:

*   PowerShell 7 or Windows PowerShell 5.1
*   A basic understanding of [NTFS file and folder permissions](https://www.ntfs.com/ntfs-permissions-file-folder.htm)

## Creating a Files/Folders to Test With

This tutorial will be built around a simple “lab” or a single folder. You’ll learn how work with NTFS permissions in PowerShell from the ground up; no extra work needed on your part.

1.  To begin, open a PowerShell session as Administrator.
2.  Create an empty folder called _Share_ somewhere on your filesystem. In the following examples, let’s assume that folder is located at _C:\\Share_. This will keep the examples shorter and easier to follow. You can create this directory by copying the code below:

```powershell
New-Item -ItemType Directory -Path 'C:\Share'
```

3\. Create a folder called _C:\\Share\\Assets_.

```powershell
New-Item -ItemType Directory -Path 'C:\Share\Assets'
```

4\. Create a file called client\_list.txt in the C:\\Share folder.

```powershell
New-Item -ItemType File -Path 'C:\Share\Client_list.txt'
```

5\. Create a file called client\_projects.txt in the C:\\Share folder.

```powershell
New-Item -ItemType File -Path 'C:\Share\Client_projects.txt'
```

6\. Next, assign a variable for the _Share_ folder path. Creating variables cuts down on typing and makes the path easier to reuse. Assuming you are using _C:\\Share_, copy the following code example into your PowerShell session:

```powershell
$dir = 'C:\Share'
```

7\. Press Enter. You now have an empty directory and saved that path as a variable.

## Viewing NTFS Permissions With [Get-Acl](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-acl?view=powershell-7)

PowerShell allows you to quickly view NTFS permissions using the `Get-Acl` cmdlet. In the following sections, you will learn how to use the cmdlet to view NTFS permissions for a file or folder.

> _[An access control list (ACL](https://docs.microsoft.com/en-us/windows/win32/secauthz/access-control-lists#:~:text=An%20access%20control%20list%20\(ACL\)%20is%20a%20list,types%20of%20ACLs%3A%20a%20DACL%20and%20a%20SACL.) is a list of access control entries (ACE). Each ACE in an ACL identifies a trustee and specifies the access rights allowed, denied, or audited. The security descriptor for a securable object can contain two types of ACLs: a DACL and a SACL._

### Displaying NTFS Permissions

Traditionally, you would view an ACL by right-clicking on the _C:\\Share_ folder, clicking on **Properties**, selecting the **Security** tab, and clicking on the **Advanced** button. You can see an example of how the GUI displays permissions below.

![Access Control List using Advanced Security Settings for Share](https://adamtheautomator.com/wp-content/uploads/2020/09/Untitled-98-1.png)

Access Control List using Advanced Security Settings for Share

The above example has some permission entries and properties numbered. Examine them closely as you will see the comparison later in this section.

Using the directory that you created earlier, display the current NTFS permissions for the directory by using `Get-Acl`.

```powershell
Get-Acl -Path $dir
```

You should now see the path, owner and access level details in the following screenshot.

![Access Control List](https://adamtheautomator.com/wp-content/uploads/2020/09/Untitled-99-1.png)

Access Control List

The `Access` property shown in the above screenshot contains additional information regarding the ACL, but it scrolls off the screen as shown by the triple dots at the end of _FullControl_ above. There’s a better way to view this property by enclosing the previous command in round brackets or parenthesis to view `Access` [object properties](https://adamtheautomator.com/powershell-objects/). Only look for the `Access` property on this object by running the below code.

```powershell
(Get-Acl -Path $dir).Access
```

> _The above command can also be expressed using the `Access` object and using the `-ExpandProperties` parameter: `Get-Acl -Path $dir | Select-Object -ExpandProperty Access`_

As shown in the following screenshot, the output is wrapped to make the command easier to see individual `Access` properties:

![Access Control Entities](https://adamtheautomator.com/wp-content/uploads/2020/09/Untitled-100-1.png)

Access Control Entities

Viewing access properties in the above manner can make the terminal output scroll down the screen fast if you have many Access Control Entities (ACE). Each entity contains [FileSystemRights, AccessControlType, IdentityReference, IsInherited, InheritenceFlags, and PropagationFlags properties](https://docs.microsoft.com/en-us/dotnet/api/system.security.accesscontrol.filesystemaccessrule?view=dotnet-plat-ext-3.1). To make this all a bit more readable, pipe the objects to `Format-Table -AutoSize`. Run the following command.

```powershell
(Get-Acl -Path $dir).Access | Format-Table -AutoSize
```

As you can see in the below screenshot, the access properties are cleaner and more organized when using `Format-Table -AutoSize`:

![Cleaner output when piping to Format-Table](https://adamtheautomator.com/wp-content/uploads/2020/09/Untitled-2020-09-08T180844.035-1-1024x144.png)

Cleaner output when piping to Format-Table

Examine the properties and column number. Notice these are the same properties that you saw in the GUI at the beginning of the tutorial.

![Access Control List using Advanced Security Settings for Share](https://adamtheautomator.com/wp-content/uploads/2020/09/Untitled-2020-09-08T180939.655.png)

Access Control List using Advanced Security Settings for Share

### Filtering Access Objects

There are times which you will want to be more precise when discovering NTFS permissions. To do so, you can filter for a specific ACE, or find particular results that have [inherited or explicit NTFS permissions](http://www.ntfs.com/ntfs-permissions-explicit.htm) within an ACL using PowerShell. Instead of scrolling the terminal window with your eyes line by line, you can use the [`Where-Object`](https://adamtheautomator.com/powershell-where-object/ "Where-Object") cmdlet to do some filtering.

The code example below filters for objects not inheriting NTFS permissions. This is done by using `Where-Object` with the `-Not` operand looking at the current object in the pipeline `$_.` member object property of `IsInherited` , which denotes if the ACE is the result of inheritance and is not explicitly set:

```powershell
(Get-Acl -Path $dir).Access | Where-Object {$_.IsInherited -eq $true} | Format-Table -AutoSize
```

> _Remember to pipe objects to `Format-Table -AutoSize` or the output will scroll down the screen. Make this a new habit; you’ll thank me later!_

Using the code below, replace `'USERNAME'` with another username to see specific results:

```powershell
(Get-Acl -Path $dir).Access | Where-Object {$_.IdentityReference -like 'USERNAME'} | Format-Table -AutoSize
```

Below is an example of what the results could look like:

![Sample output from the filtering](https://adamtheautomator.com/wp-content/uploads/2020/09/Untitled-2020-09-08T181109.121.png)

Sample output from the filtering

The above example shows all ACE’s which the `IdentityReference` property is the user or security group assigned permissions.

> _Go ahead and practice what you’ve learned so far about `Get-Acl` . Examine some different files and folders on your system. This will help you see many different security descriptors for different contexts. This will also help build some muscle memory._

Let’s kick things up a notch and assign NTFS permissions.

## Modifying NTFS NTFS Permissions With [Set-Acl](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-acl?view=powershell-7)

Now that you can view NTFS permissions, it’s time to assign and modify NTFS permissions using PowerShell. The `Set-Acl` cmdlet makes that possible. The following sections will demonstrate how to use this cmdlet in conjunction with `Get-Acl` to copy, modify inheritance, and remove NTFS permissions from a file or folder.

### Copying NTFS Permissions

You may have a file or folder that contains the appropriate level of NTFS permissions that you need to use for a new ACL. You can save time by [copying permissions from one file or folder to another](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-acl?view=powershell-7#example-1--copy-a-security-descriptor-from-one-file-to-another).

> _Copying existing ACLs/ACEs can reduce human error when setting up NTFS permissions, assuming the security descriptor you are copying from is correct and appropriate for the destination in the first place. As the saying goes, “With great power comes great responsibility.”. Keep that in mind._

Consider the following screenshot. Here you are taking a look at the ACL for a file in _C:\\Share_ called _Client\_List.txt._ The ACL has the correct level of NTFS permissions that you want:

![Client list with appropriate NTFS permissions for Bill, the new employee.](https://adamtheautomator.com/wp-content/uploads/2020/09/Untitled-2020-09-08T181225.630.png)

Client list with appropriate NTFS permissions for Bill, the new employee.

Now, consider the next screenshot. This time you are taking a look at the ACL for another file in _C:\\Share_ called _Client\_Projects.txt._ This file does not have the NTFS permissions you desire:

![Client Projects with no access for Bill.](https://adamtheautomator.com/wp-content/uploads/2020/09/Untitled-2020-09-08T181304.214.png)

Client Projects with no access for Bill.

You need to copy the NTFS permissions from _Client\_List.txt_ to _Client\_Projects.txt_. How can you do this? You will modify permissions by getting the ACL from _Client\_List.txt_ and then using the `Set-Acl` cmdlet with the `-AclObject` parameter. When you run the code below, the entire ACL from _Client\_List.txt_ is copied to _Client\_Projects.txt_ :

```powershell
# Copy Client_list.txt Security Descriptors to Client_Projects.txt
$Acl = Get-Acl -Path 'C:\Share\Client_list.txt'
Set-Acl -AclObject $Acl -Path 'C:\Share\Client_Projects.txt'
```

As you can see in the numbered screenshot below, the _Client\_Projects.txt_ file now has the same security descriptors as _Client\_list.txt_.

1.  Get an existing ACL from an existing file.
2.  Set copied ACL object to file or folder.
3.  Check that the ACL copied to the file or folder correctly.

![NTFS Permissions Copied](https://adamtheautomator.com/wp-content/uploads/2020/09/Untitled-2020-09-08T181345.102.png)

NTFS Permissions Copied

You see now that the ACL is identical for the file _Client\_Projects.txt_ file as the _Client\_List.txt_ filein the _IdentityReference_ column with _AccessControlType_ set to _Allow_. You use the same technique for assigning NTFS permissions to folders too.

### Adding NTFS Permissions

In the last section, you copied existing NTFS permissions from one file object to another. This time you are going to create NTFS permissions from scratch. This will allow you to assign NTFS permissions that will be assigned to a file or folder.

First, start assigning some variables to use for creating a new object used by `Set-Acl`. Doing it this way makes it a little easier to when it’s time to run the command. The code below builds the properties of an ACE that will become the NTFS permissions assgined to a file or folder:

```powershell
# Create the ACE
$identity = 'domain\user'
$rights = 'FullControl' #Other options: [enum]::GetValues('System.Security.AccessControl.FileSystemRights')
$inheritance = 'ContainerInherit, ObjectInherit' #Other options: [enum]::GetValues('System.Security.AccessControl.Inheritance')
$propagation = 'None' #Other options: [enum]::GetValues('System.Security.AccessControl.PropagationFlags')
$type = 'Allow' #Other options: [enum]::GetValues('System.Securit y.AccessControl.AccessControlType')
$ACE = New-Object System.Security.AccessControl.FileSystemAccessRule($identity,$rights,$inheritance,$propagation, $type)
```

Next, assign one more variable which will get the initial ACL for the folder `Assets` . Then, using the `AddAccessRule` method member type, add an access rule using the `$ACE` variable:

```powershell
$Acl = Get-Acl -Path "$dir\Assets"
$Acl.AddAccessRule($ACE)
```

You are now ready to add the newly minted ACE to the ACL of `C:\Share\Assets`. Now use `Set-Acl` to apply this new ACE to the proper directory:

```powershell
Set-Acl -Path "$dir\Assets" -AclObject $Acl
```

Next, verify that the user you chose has the permissions to view the directory needed using the code below:

```powershell
(Get-Acl -Path "$dir\Assets").Access | Format-Table -Autosize
```

### Removing NTFS Permissions

There will come a time when you need to remove NTFS permissions from a resource.

To remove NTFS permissions, start by getting the current ACL for the file or folder. In this example, that file is `Client_Projects.txt`:

```powershell
$Acl = Get-Acl -Path "$dir\Client_Projects.txt"
```

Now filter for the specific ACE you want to remove. You do this by calling on the `$Acl` member objects and piping those results to `Where-Object` and a few operands:

```powershell
$Ace = $Acl.Access | Where-Object {($_.IdentityReference -eq 'domain\user') -and -not ($_.IsInherited)}
```

Next, use the `$Acl` variable which contains the current ACL security descriptors, call the `RemoveAccessRule` method and pass the ACE object created above using the `New-Object` cmdlet to the `RemoveAccessRule()` method. This will remove the entry:

```powershell
$Acl.RemoveAccessRule($Ace)
```

> _It is important to remember that you have modified an existing ACL here and have not yet committed the changes._

Now to make those changes stick, run the `Set-Acl` cmdlet, providing parameters `-Path` and `-AclObject` with the appropriate values of `"$dir\Client_Projects.txt"` and `$Acl` . Once you’ve entered the command below, press **Enter**:

```powershell
Set-Acl -Path "$dir\Client_Projects.txt" -AclObject $Acl
```

> Manage and Report Active Directory, Exchange and Microsoft 365 with ManageEngine ADManager Plus. [Download Free Trial!](https://www.manageengine.com/products/ad-manager/tp/windows-active-directory-management-tool.html?utm_source=ata&utm_medium=website-listing&utm_campaign=admp-ntfs)

## Summary

In this article, you’ve learned about [managing NTFS permissions with PowerShell](https://adamtheautomator.com/powershell-scheduled-task/). You’ve learned about the two cmdlets, `Get-Acl` and `Set-Acl`, and what they do with NTFS permissions.

You’ve also learned how to use filters to target a specific ACE in an ACL for use in the above cmdlets. With a little practice, you’ll easily manage more NTFS permission requests than ever before.

## Further Reading

*   [Get-Acl](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-acl?view=powershell-7)
*   [Set-Acl](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-acl?view=powershell-7)
*   [FileSystemRights Enum](https://docs.microsoft.com/en-us/dotnet/api/system.security.accesscontrol.filesystemrights?view=dotnet-plat-ext-3.1)
*   \[Access Control Lists\]([https://docs.microsoft.com/en-us/windows/win32/secauthz/access-control-lists#:~:text=An access control list (ACL) is a list,types of ACLs%3A a DACL and a SACL.)](https://docs.microsoft.com/en-us/windows/win32/secauthz/access-control-lists#:~:text=An%20access%20control%20list%20%28ACL%29%20is%20a%20list,types%20of%20ACLs%3A%20a%20DACL%20and%20a%20SACL.\))
*   [Copy-Acl](https://gallery.technet.microsoft.com/Copy-ACL-From-One-Item-To-7d5cc590)

Share this article

[Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fntfs-permissions%2F&text=Manage%20NTFS%20Permissions%20with%20PowerShell%3A%20A%20Tutorial)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fntfs-permissions%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fntfs-permissions%2F)

## Related Posts

![](https://adamtheautomator.com/wp-content/uploads/2026/06/26995-troubleshoot-dns-issues-powershell-codex.webp)

### [Troubleshoot DNS Issues with PowerShell](/troubleshoot-dns-issues-powershell/)

Troubleshoot DNS issues with PowerShell by testing name resolution, DNS client settings, cache entries, and network connectivity in a repeatable workflow.

![](https://adamtheautomator.com/wp-content/uploads/2025/10/image_2025-10-24_095322075.png)

### [Migrating from PowerShell 6 to 7.5: Breaking Changes/New Features](/migrating-powershell-6-to-7-5/)

Migrate from PowerShell Core 6 to 7.5: breaking changes, features, and testing tips.

![](https://adamtheautomator.com/wp-content/uploads/2025/06/featured-image-6.png)

### [How to Add Timeouts to Pester Tests with PowerShell Runspaces](/pester-test-timeout-runspaces/)

Prevent Pester tests from hanging indefinitely using PowerShell runspaces. Learn to handle variable scoping, module loading, TestDrive access, and stream capture challenges with timeout protection.

## Categories

*   [IT Ops](/category/it-ops/)
*   [Cloud](/category/cloud/)
*   [DevOps](/category/devops/)
*   [Home Ops](/category/home-ops/)
*   [Information Security](/category/infosec/)
*   [Software Development](/category/software-development/)

## Site

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)