powershell - 删除继承后，使用Powershell从NTFS文件夹中删除组失败并显示SeSecurityPrivilege

Question

当尝试从用户的主驱动器中删除“域用户”时，我发现Powershell 3.0出现了异常情况，并希望与他人联系，以了解是否有人对原因有所了解。

伪代码，这样您就可以了解我在尝试做什么

 Create a new folder
 Grant User access to write their home drive
 Remove Inherited Permissions from folder
 Remove general access from all Domain Users

实际代码(为简化起见删除了错误处理)

$UserName = "auser"
$Path = "\\domain.com\user\users\" + $UserName
$UserIdentityReference = "DOMAIN\" + $UserName

$NewFolder = New-Item -ItemType directory -Path $Path

#Need to allow the user to write to the folder
$GrantUserAccesRule = New-Object System.Security.AccessControl.FileSystemAccessRule($UserIdentityReference, @("ListDirectory", "ReadData", "WriteData", "CreateFiles", "CreateDirectories", "AppendData", "ReadExtendedAttributes", "WriteExtendedAttributes", "Traverse", "ExecuteFile", "ReadAttributes", "WriteAttributes", "Write", "ReadPermissions", "Read", "ReadAndExecute", "Modify", "Synchronize"), "ContainerInherit,ObjectInherit", "None", "Allow")
$acl = Get-Acl $NewFolder
$acl.AddAccessRule($GrantUserAccesRule)
Set-Acl -aclobject $acl -Path $NewFolder

# Remove inheritence from parent folder.
$acl = Get-Acl $NewFolder
$acl.SetAccessRuleProtection($true,$true)
Set-Acl -aclobject $acl -Path $NewFolder

#Need to prevent any domain user from accessing the folder
$acl = Get-Acl $NewFolder
$RemoveDomainUsersACLRule = $acl | Select -ExpandProperty Access | where-object {$_.IdentityReference -eq $UserIdentityReference}
$acl.RemoveAccessRule($RemoveDomainUsersACLRule)
#ERROR OCCURS HERE
Set-Acl -aclobject $acl -Path $NewFolder

错误是:

Set-Acl : The process does not possess the 'SeSecurityPrivilege' privilege which is required for this operation.
At line:4 char:3
+   Set-Acl -aclobject $acl -Path $NewFolder
+   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  + CategoryInfo          : PermissionDenied: (\\gifs.com\user\users\tautomation:String) [Set-Acl], PrivilegeNotHeldException
  + FullyQualifiedErrorId : System.Security.AccessControl.PrivilegeNotHeldException,Microsoft.PowerShell.Commands.SetAclCommand

奇怪的是，一旦执行SetAccessRuleProtection($ true，$ true)，我就无法添加角色，也无法删除刚刚添加的角色。

我尝试过的事情

我可以删除添加的角色，只要在SetAccessRuleProtection之前执行即可。

从文件资源管理器中手动删除“域用户”组。

以提升的用户身份运行powershell。这与

没有区别

研究已经完成:
我读了
http://blogs.technet.com/b/josebda/archive/2010/11/12/how-to-handle-ntfs-folder-permissions-security-descriptors-and-acls-in-powershell.aspx

Answer 1

听起来像this Connect bug。我始终建议不要对文件/文件夹使用SetAccessControl()，而不要使用Set-Acl(Set-Acl在文件系统方面存在一些问题)。我将所有Set-Acl调用都更改为此:

(Get-Item $NewFolder).SetAccessControl($acl)