I am working on a script and I am stuck trying to grant an AD group modify permissions to a share path. Currently when ran it does add the group to the folder but only with "list" permissions. Any ideas?

$groupname = "group_users"
$fullsharepath = "\\severname\servervol\share"


$acl = Get-Acl $fullsharepath
$permission = "domain\$groupname","Modify", [System.Security.AccessControl.InheritanceFlags]"ContainerInherit", [system.security.accesscontrol.PropagationFlags]"None","Allow"
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission
$acl.SetAccessRule($accessRule)
$acl | Set-Acl $fullsharepath -Verbose

CodePudding user response：

Your code is working for me, knowing that your domain name is domain.
Else, just remove domain from "domain\$groupname" if you are on the same domain as the group.

Below is another example, that is more simplified:

$ACL = Get-Acl -Path "\\severname\servervol\share"
$groupname = "group_users" #or "yourDomain\group_users"

$Ace = New-Object System.Security.AccessControl.FileSystemAccessRule("$groupname","Modify", "ContainerInherit", "None", "Allow")

#Append the ACE to the ACL
$ACL.AddAccessRule( $Ace )

#Push settings
Set-Acl -AclObject $ACL $fullsharepath