Removing modify/sync NTFS permissions using removeaccessruleall in Powershell

Question

Hi,
I've got a script together which removes all non-inherited groups from a user's home folder. It's working fine until I run into groups which have modify/sync permission. Even though I'm using the removeaccessruleall permission, those groups just don't
remove. I've attached the code I'm using below and I can provide the full script if needed.
$objAccessRule1 = New-Object System.Security.AccessControl.FileSystemAccessRule($strAccount,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
$objACL.RemoveAccessRuleAll($objAccessRule1)
I'd appreciate any insight anyone can provide.
Cheers,
Ed Narayan


Answer 1

Hi Rohn,
Still no luck. The modify/sync permission still remains. Here's my code:
import-module activedirectory
$StrInvocation = (Get-Variable MyInvocation).Value
$strRunDir = Split-Path $StrInvocation.MyCommand.Path
$strDate = get-date -format "dd-MMM-yyyy-HHmm"
# Set everyone to list folder contents - this folder only and remove extra groups on folder
function phase1
$strSharePath = $args[0]
$objACL = Get-Acl $strSharePath
# Define permissions
$strPermission1 = "Everyone","ListDirectory","None","None","Allow"
# Attach permissions to access rules
$objAccessRule1 = New-Object System.Security.AccessControl.FileSystemAccessRule $strPermission1
# Attach access rules to ACL object
$objACL.SetAccessRule($objAccessRule1)
$objACL.PurgeAccessRules([System.Security.Principal.NTAccount]"AccountAdmins")
$objACL.PurgeAccessRules([System.Security.Principal.NTAccount]"SHR-MDRIVE")
$objACL.PurgeAccessRules([System.Security.Principal.NTAccount]"SYSTEM")
# Set access rules on ACL object
Set-Acl $strSharePath $objACL
# For each folder processed, turn on inheritance if it's off, remove orphaned acls and non-inherited groups
function phase2
[CmdletBinding()]
Param([Parameter(Mandatory=$True,ValueFromPipeline=$True,ValueFromPipelinebyPropertyName=$True)]
[string]$strFolder)
PROCESS{
# Set variables
$strLog = "$strRunDir\Logs\log-$strDate.txt"
$arrGroups = @()
$objACEs = @()
$objACL = get-acl $strFolder
$objACEs = $objACL.Access | Where-Object {!$_.IsInherited} | select-object IdentityReference -unique
[bool]$blnIsInherit = [bool](get-inheritance $strFolder | select-object -expandproperty inheritanceenabled)
[bool]$blnGroupExists = $false
$objChildObjects = Get-ChildItem $strFolder -recurse
write-output "`n" | Out-file $strLog -append
write-output "FOLDER:$strFolder `n" | Out-file $strLog -append
write-output "Inheritance enabled - $blnIsInherit `n" | Out-file $strLog -append
# If inheritance is turned off, enable it
if(!$blnIsInherit)
write-output "Enabling inheritance for $strFolder`n" | Out-file $strLog -append
$objACL.SetAccessRuleProtection($False, $True)
# If non-inherited permissions exist, process each of them
if(($objACEs| Measure-Object).Count -gt 0)
foreach($objACE in $objACEs)
[bool]$blnIsGroup = $false
[string]$strAccount = $objACE.IdentityReference
if($strAccount -like "*\*")
$arrSplit = $strAccount.split("\")
$strAccount= $arrSplit[1]
# Check if permission is for a group
$blnIsGroup = [bool](get-adgroup $strAccount -erroraction silentlycontinue)
# If permission is for a group, create an acl entry for removing it. Multiple remove entries can be created depending on the number of groups found
if($blnIsGroup)
Write-output "Removing:$strAccount`n" | Out-file $strLog -append
$objACL.PurgeAccessRules([System.Security.Principal.NTAccount]$strAccount)
if($strAccount-like "*SYSTEM*" -or $strAccount-like "*CREATOR OWNER*" -or $strAccount-like "*USERS*" -or $strAccount-like "*Administrators*" -or $strAccount-like "*S-1-5-*")
Write-output "Removing:$strAccount`n" | Out-file $strLog -append
$objACL.PurgeAccessRules([System.Security.Principal.NTAccount]$strAccount)
Set-acl $strFolder $objACL
Phase 1 changes the everyone group to list folder contents on this folder only and removes a bunch of groups from the root folder.
Phase 2 removes all orphaned sids and non-inherited groups from the folder and turns on inheritance if it's turned off.
At this stage, this feels like a bug within the ACL cmdlets.
Cheers,
Ed