New-CMFileSystemAccessControlEntry

Create a file system access control entry.

Syntax

New-CMFileSystemAccessControlEntry
   [-AccessOption <AccessType>]
   -GroupOrUserName <String>
   [-Permission <FileSystemPermissions[]>]
   [-DisableWildcardHandling]
   [-ForceWildcardHandling]
   [<CommonParameters>]

Description

Use this cmdlet to create an access control entry (ACE) for the file system. An access control entry defines specific permissions for a specific user or group. You can use this object with the New-CMRequirementRuleFilePermissionValue cmdlet to create a requirement rule on an application deployment type that verifies file permissions.

Note

Run Configuration Manager cmdlets from the Configuration Manager site drive, for example PS XYZ:\>. For more information, see getting started.

Examples

Example 1

This example first uses the Get-CMGlobalCondition cmdlet to get a custom global condition. Then it creates two access control entries for specific users. Next it uses the New-CMRequirementRuleFilePermissionValue to create the requirement rule object. Finally it passes that rule object to the Set-CMScriptDeploymentType cmdlet to add the requirement.

$myGC = Get-CMGlobalCondition -Name "LOB app data file"

$userName = "contoso\jqpublic"
$ce = New-CMFileSystemAccessControlEntry -GroupOrUserName $userName -AccessOption Allow -Permission Read,Write

$userName2 = "contoso\jdoe"
$ce2 = New-CMFileSystemAccessControlEntry -GroupOrUserName $userName2 -AccessOption Allow -Permission Read

$myRule = New-CMRequirementRuleFilePermissionValue -GlobalCondition $myGC -ControlEntry $ce,$ce2

Set-CMScriptDeploymentType -ApplicationName "Central app" -DeploymentTypeName "Install" -AddRequirement $myRule

Parameters

-AccessOption

Specify whether this ACE is to Allow or Deny access.

Type:AccessType
Accepted values:Allow, Deny
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-DisableWildcardHandling

This parameter treats wildcard characters as literal character values. You can't combine it with ForceWildcardHandling.

Type:SwitchParameter
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-ForceWildcardHandling

This parameter processes wildcard characters and may lead to unexpected behavior (not recommended). You can't combine it with DisableWildcardHandling.

Type:SwitchParameter
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-GroupOrUserName

Specify the group or user name for this ACE. Use standard "domain\name" format. For example, contoso\jqpublic or "nwtraders\All IT Users".

Type:String
Position:Named
Default value:None
Required:True
Accept pipeline input:False
Accept wildcard characters:False

-Permission

Specify an array of one or more permissions for this ACE. Use the AccessOption parameter to specify whether these permissions Allow or Deny access.

Type:FileSystemPermissions[]
Aliases:Permissions
Accepted values:ListFolderContentsOrReadData, CreateFilesOrWriteData, CreateFoldersOrAppendData, ReadExtendedAttributes, WriteExtendedAttributes, TraverseFolderOrExecuteFile, DeleteSubfoldersAndFiles, ReadAttributes, WriteAttributes, Write, Delete, ReadPermissions, Read, Execute, ChangePermissions, TakeOwnership, FullControl
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

Inputs

None

Outputs

System.Object