Share via

ACL error on file permissions inventory script

crib bar 661 Reputation points
2024-05-15T09:28:34.4+00:00

We are trying to run a permissions inventory script (based on the get-acl command) against a file share on a file server running server 2016. The script is being run 'remotely' from a workstation joined to the same domain as the file server opposed to locally whilst RDP'd onto the server, which may be having an impact. The script is also being run under the context of a domain admin account, which is therefore a member of the local admins group on the server.

I have double checked the share permissions on the share (D:\Shared) to rule out anything unusual (Everyone group has Full on the share ACL, BUILTIN\Administrators (which includes domain admins) – Full on the directory ACL side of things). However, we are hitting a number of errors on certain folders "Get-Acl: Attempted to perform an unauthorized operation", which some quick searches online suggest this is permissions related that was not expected given the permissions of the account running the script. Is there any obvious work around to this to help get a full report (e.g. where the script is run from for example) – I cannot see why a domain admin wouldn't have full control over all sub directories, and we don't really want to be amending delicate permissions for the sake of a script.

Windows Server 2016
Windows Server 2016
A Microsoft server operating system that supports enterprise-level management updated to data storage.
2,408 questions
Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,341 questions
Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,418 questions
PowerShell
PowerShell
A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
2,188 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. MotoX80 32,331 Reputation points
    2024-05-15T12:31:00.8366667+00:00

    I cannot see why a domain admin wouldn't have full control over all sub directories,

    The most likely reason is that someone disabled inheritance and removed the Administrators group from the permissions on those certain folders. Or the permissions somehow got corrupt.

    Run the script in an RDP session against the local directory (D:\Shared\Whatever) and not through the share. That will eliminate the share as the problem.

    Run icacls.exe both locally and remotely on one of the "certain folders" and see if it too errors out.

    Use the Windows explorer to view permissions on the and verify that admins have access.

    0 comments