Hi All
First:
What am I running (part of a bigger script):
$strhomedrive="\\blabla\bla"
$strsamid1="id10000"
$HomeDriveAcl2=Get-Acl $strhomedrive
$Ar2 = New-Object System.Security.AccessControl.FileSystemAccessRule($strsamid1, "FullControl", "ContainerInherit,ObjectInherit", "None", "Allow")
$HomeDriveAcl2.addAccessRule($Ar2)
Set-Acl $strhomedrive $HomeDriveAcl2
\\blabla\ is DFS path
Works fine with my account: member of Administrator group, not domain admin, member of every local admin group on the servers
it doesn't work with Service Desk account:
Set-Acl : Attempted to perform an unauthorized operation.+ CategoryInfo : PermissionDenied: (\\blabla\bla:String) [Set-Acl], UnauthorizedAccessException+ FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.SetAclCommand
Both my account and SD account have Full control on \\blabla on share level and file level, all effective permissions are green for both
-I tried to run elevated powershell with SD account by adding it to local admins - same error
-tried getting to \\blabla\bla using DFS path and directly to the server (\\server01\bla) - same error
-I can make SD user owner of \\blabla\bla using my domain admin account - same error
PS C:\Windows> ($HomeDriveAcl2).AreAccessRulesProtected
False
PS C:\Windows> ($HomeDriveAcl2).Accessruletype
IsPublic IsSerial Name BaseType
-------- -------- ---- --------
True False FileSystemAccessRule System.Security.AccessControl.AccessRule
what I've noticed:
while running this with SD account it takes ownership and adds single user ID (the one who ran the script) with full control in \\blabla\bla folder - it doesn't do that with my personal account
Any idea how to fix it, or maybe workaround with icacls? thanks