This script tries to do the following
Unfortunately, at the end, the rights remains the same, and Utilisateurs is still in the rules !
What am I doing wrong ?
$sharePath = "C:\SHARE"
New-Item -Path $sharePath -ItemType Directory
$acl = Get-Acl -Path $sharePath
$acl.SetAccessRuleProtection($true, $true)
Set-Acl -Path $sharePath -AclObject $acl
Write-Host "Before :"
$acl.Access | Format-List *
$groupToRemove = "BUILTIN\Utilisateurs"
foreach ($accessRule in $acl.Access) {
if ($accessRule.IdentityReference -eq $groupToRemove) {
# Delete the rule. It seems to work because it returns true in powershell
$acl.RemoveAccessRule($accessRule)
}
}
Set-Acl -Path $sharePath -AclObject $acl
Write-Host "After :"
$acl.Access | Format-List *
Solved, you need to get the acl again after disabling inheritance
$sharePath = "C:\SHARE"
New-Item -Path $sharePath -ItemType Directory
$acl = Get-Acl -Path $sharePath
$acl.SetAccessRuleProtection($true, $true)
Set-Acl -Path $sharePath -AclObject $acl
# NEED TO GET THE ACL AGAIN
$acl = Get-Acl -Path $sharePath
Write-Host "Before :"
$acl.Access | Format-List *
$groupToRemove = "BUILTIN\Utilisateurs"
foreach ($accessRule in $acl.Access) {
if ($accessRule.IdentityReference -eq $groupToRemove) {
# Delete the rule. It seems to work because it returns true in powershell
$acl.RemoveAccessRule($accessRule)
}
}
Set-Acl -Path $sharePath -AclObject $acl
Write-Host "After :"
$acl.Access | Format-List *