I have a SAN that someone has removed the system account from the NTFS permissions for all of the files?  Is there a way to add the system account with full control to all those files?

The "issue" with using the get-acl and set-acl cmdlets from PowerShell is that you'll have to use the get-acl on every file/folder to get its current permissions, and then use set-acl on every file/folder to add the SYSTEM account.

What operating systems? A combo of cacls (or icacls) and PowerShell might be more efficient...

I can't test the code now but give this a try:

$folder = "d:\foo"
$acl = Get-acl $folder
$rule= New-Object system.security.accesscontrol.filesystemaccessrule("NT AUTHORITY\SYSTEM","FullControl","Allow")
$acl.SetAccessRule($rule)
Set-Acl$folder $acl

If it doesn;t work try this:


$folder = "d:\test"
$access=[System.Security.AccessControl.AccessControlType]::Allow
$rights = [System.Security.AccessControl.FileSystemRights]"FullControl,Read,Write"
$inherit = [System.Security.AccessControl.InheritanceFlags]"ContainerInherit,ObjectInherit"
$propagate = [System.Security.AccessControl.PropagationFlags]::InheritOnly
$ace = New-Object System.Security.AccessControl.FileSystemAccessRule("NT AUTHORITY\SYSTEM",$rights,$inherit,$propagate,$access)

$acl = Get-Acl $folder
$acl.AddAccessRule($ace)
$acl.SetAccessRuleProtection($false,$false)
Set-Acl $folder $acl


Check this article too:
http://www.microsoft.com/technet/sc...p0516.mspx

The OS is server 2003