copy the security descriptor failing

Question

I want to copy the security descriptor of C:\Program Files to D:\Program Files, so I typed

Get-Acl -Path “C:\Program Files” | Set-Acl -Path “D:\Program Files”

But PowerShell responded

Set-Acl: It is not allowed to use the security identifier as the owner of this object. At line:1 char:36
+ Get-Acl -Path 'C:\Program Files' | Set-Acl -Path 'D:\Program Files'
+                                    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (D:\Program Files:String) [Set-Acl]，InvalidOperationException
    + FullyQualifiedErrorId : System.InvalidOperationException,Microsoft.PowerShell.Commands.SetAclCommand.

What should I do?

Answer 1

Hi

The error message you encountered suggests that using the security identifier (SID) as the owner of the object is not allowed. To resolve this issue, you can try using the Get-Acl and Set-Acl cmdlets separately, while excluding the owner information. Here's an example:

$sourcePath = "C:\Program Files"
$destinationPath = "D:\Program Files"

$sourceAcl = Get-Acl -Path $sourcePath
$destinationAcl = $sourceAcl | Select-Object -Property * -ExcludeProperty Owner

Set-Acl -Path $destinationPath -AclObject $destinationAcl

In this code, we first retrieve the ACL (access control list) of the source directory using Get-Acl and store it in the $sourceAcl variable. Then, we create a modified ACL for the destination directory by excluding the owner information using Select-Object with the -ExcludeProperty parameter. The modified ACL is stored in the $destinationAcl variable.

Finally, we use the Set-Acl cmdlet to apply the modified ACL to the destination directory specified by the $destinationPath variable.

By excluding the owner information, you should be able to copy the security descriptor from the source directory to the destination directory without encountering the "owner of this object" error.

Please note that modifying security permissions and copying security descriptors can have implications on file system security. Ensure that you have the necessary permissions to perform these actions and exercise caution when making changes to file and folder security.