Get-Acl

Get-Acl
    [[-Path] <String[]>]
    [-Audit]
    [-AllCentralAccessPolicies]
    [-Filter <String>]
    [-Include <String[]>]
    [-Exclude <String[]>]
    [-UseTransaction]
    [<CommonParameters>]

Get-Acl
    -InputObject <PSObject>
    [-Audit]
    [-AllCentralAccessPolicies]
    [-Filter <String>]
    [-Include <String[]>]
    [-Exclude <String[]>]
    [-UseTransaction]
    [<CommonParameters>]

Get-Acl
    [-LiteralPath <String[]>]
    [-Audit]
    [-AllCentralAccessPolicies]
    [-Filter <String>]
    [-Include <String[]>]
    [-Exclude <String[]>]
    [-UseTransaction]
    [<CommonParameters>]

The Get-Acl cmdlet gets objects that represent the security descriptor of a file or resource. The security descriptor contains the access control lists (ACLs) of the resource. The ACL specifies the permissions that users and user groups have to access the resource.

Beginning in Windows PowerShell 3.0, you can use the InputObject parameter of Get-Acl to get the security descriptor of objects that do not have a path.

Get-Acl C:\Windows

This command gets the security descriptor of the C:Windows directory.

Get-Acl C:\Windows\k*.log | Format-List -Property PSPath, Sddl

This command gets the Windows PowerShell path and SDDL for all of the .log files in the C:\Windows directory whose names begin with "k."

The command uses the Get-Acl cmdlet to get objects representing the security descriptors of each log file. It uses a pipeline operator (|) to send the results to the Format-List cmdlet. The command uses the Property parameter of Format-List to display only the PsPath and SDDL properties of each security descriptor object.

Lists are often used in Windows PowerShell, because long values appear truncated in tables.

The SDDL values are valuable to system administrators, because they are simple text strings that contain all of the information in the security descriptor. As such, they are easy to pass and store, and they can be parsed when needed.

Get-Acl C:/Windows/k*.log -Audit | ForEach-Object { $_.Audit.Count }

This command gets the security descriptors of the .log files in the C:\Windows directory whose names begin with "k." It uses the Audit parameter to get the audit records from the SACL in the security descriptor. Then it uses theForEach-Object cmdlet to count the number of audit records associated with each file. The result is a list of numbers representing the number of audit records for each log file.

Get-Acl -Path HKLM:\System\CurrentControlSet\Control | Format-List

This command uses the Get-Acl cmdlet to get the security descriptor of the Control subkey (HKLM\SYSTEM\CurrentControlSet\Control) of the registry.

The Path parameter specifies the Control subkey. The pipeline operator (|) passes the security descriptor that Get-Acl gets to the Format-List command, which formats the properties of the security descriptor as a list so that they are easy to read.

Get-Acl -InputObject (Get-StorageSubSystem -Name S087)

This command uses the InputObject parameter of Get-Acl to get the security descriptor of a storage subsystem object.

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

You can pipe a string that contains a path to Get-Acl.

Get-Acl returns an object that represents the ACLs that it gets. The object type depends upon the ACL type.

By default, Get-Acl displays the Windows PowerShell path to the resource (<provider>::<resource-path>), the owner of the resource, and "Access", a list (array) of the access control entries in the discretionary access control list (DACL) for the resource. The DACL list is controlled by the resource owner.

When you format the result as a list, ("Get-Acl | Format-List"), in addition to the path, owner, and access list, Windows PowerShell displays the following properties and property values:

• Group: The security group of the owner.
• Audit: A list (array) of entries in the system access control list (SACL). The SACL specifies the types of access attempts for which Windows generates audit records.
• Sddl: The security descriptor of the resource displayed in a single text string in Security Descriptor Definition Language format. Windows PowerShell uses the GetSddlForm method of security descriptors to get this data.

Because Get-Acl is supported by the file system and registry providers, you can use Get-Acl to view the ACL of file system objects, such as files and directories, and registry objects, such as registry keys and entries.