Most efficient/quickest way to set NTFS permissions in PowerShell

Question

Hello all,
Trying to figure out what the most efficient/quickest way to set NTFS permissions via PowerShell is. I am currently using ICACLS but it is taking FOREVER as I can't figure out how to make inheritance work with this command.
This has prompted me to begin looking at other options for setting NTFS permissions in PowerShell, and I wondered what everyone here likes to use for this task in PowerShell?

Answer 1

Ah ok. Unfortunately, my ICACLS is taking FOREVER. Here is the code I'm using:
ICACLS "C:\users\[user]\Desktop\test" /grant:r ("[user]" + ':r') /T /C /Q
However:
1.  I can't figure out how to make the inheritance parameter work with ICACLS
2. If I do make the inheritance parameter work with ICACLS, I still need a way to add the permission to child objects that aren't inheriting.
Any tips on how to improve performance of ICACLS?
1. icacls folder /grant GROUPNAME:(OI)(CI)(F)  (i will post corrected code later, this works in CMD but not powershell couse of bracers)
2.  get-childitem -recurse -force |?{$_.psiscontainer} |%{icacls ....}  (or u can list only folders where inheritance is disabled and apply icacls just on them)
I think jrv and Mekac answered the first question about inheritance flags. I would just add that you probably don't want to use the /T switch with icacls.exe because that appears to set an explicit entry on all child items (that's probably why it's taking
so long).
For your second question, I'd suggest using the Get-Acl cmdlet. It throws terminating errors, so I usually wrap it in a try/catch block. Something like this might work if you just wanted the paths to files/folders that aren't inheriting permissions:
dir $Path -Recurse | ForEach-Object {
try {
Get-Acl $_.FullName | where { $_.AreAccessRulesProtected } | ForEach-Object { Convert-Path $_.Path }
catch {
Write-Error ("Get-Acl error: {0}" -f $_.Exception.Message)
return
If you're looking for speed/performance, you don't want to just use the PowerShell Access Control (PAC) module that Mike linked to above by itself. It's implemented entirely in PowerShell, so it's incredibly slow right now (unless you use it along with Get-Acl
/ see below for an example). I'm slowly working on creating a compiled version that is much faster, and I think I'm pretty close to having something that I can put in the gallery.
Since I wasn't sure which command would give you the best results, I used Measure-Command to test a few different ones. Each of the following four commands should do the exact same thing. Here are my results (note that I just ran the commands a few times
and averaged the results on a test system; this wasn't very rigorous testing):
# Make sure that this folder and user/group exist:
$Path = "D:\TestFolder"
$Principal = "TestUser"
# Native PowerShell/.NET -- Took about 15 ms
$Acl = Get-Acl $Path
$Acl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule(
$Principal,
"Read", # [System.Security.AccessControl.FileSystemRights]
"ContainerInherit, ObjectInherit", # [System.Security.AccessControl.InheritanceFlags]
"None", # [System.Security.AccessControl.PropagationFlags]
"Allow" # [System.Security.AccessControl.AccessControlType]
(Get-Item $Path).SetAccessControl($Acl)
# PAC Module 3.0 w/ PowerShell/.NET commands -- Took about 35 ms
$Acl = Get-Acl $Path | Add-AccessControlEntry -Principal $Principal -FolderRights Read -PassThru
(Get-Item $Path).SetAccessControl($Acl)
# icacls.exe -- Took about 40ms
icacls.exe $Path /grant "${Principal}:(OI)(CI)(R)"
# PAC Module 3.0 w/o Get-Acl -- Took about 350 ms
Add-AccessControlEntry -Path $Path -Principal $Principal -FolderRights Read -Force
Unless I messed something up, it looks like the native PowerShell/.NET commands are faster than icacls.exe, at least for modifying a single folder's DACL.