Establishes or changes the central access policy of the item. Enter the CAP ID or friendly name of a central
access policy on the computer.
Beginning in Windows Serverr 2012, administrators can use Active Directory and Group Policy to set central
access policies for users and groups. For more information, see Dynamic Access Control: Scenario
Overviewhttp://go.microsoft.com/fwlink/?LinkId=238408 on TechNet.
This parameter was introduced in Windows PowerShell 3.0.
Required? false
Position? 2
Default value None
Accept pipeline input? True (ByPropertyName)
Accept wildcard characters? false
-ClearCentralAccessPolicy []
Removes the central access policy from the specified item.
Beginning in Windows Serverr 2012, administrators can use Active Directory and Group Policy to set central
access policies for users and groups. For more information, see Dynamic Access Control: Scenario
Overviewhttp://go.microsoft.com/fwlink/?LinkId=238408 on TechNet.
This parameter was introduced in Windows PowerShell 3.0.
Required? false
Position? named
Default value False
Accept pipeline input? False
Accept wildcard characters? false
-Confirm []
Prompts you for confirmation before running the cmdlet.
Required? false
Position? named
Default value False
Accept pipeline input? False
Accept wildcard characters? false
-Exclude
Omits the specified items. The value of this parameter qualifies the Path parameter. Enter a path element or
pattern, such as "*.txt". Wildcards are permitted.
Required? false
Position? named
Default value None
Accept pipeline input? False
Accept wildcard characters? false
-Filter
Specifies a filter in the provider's format or language. The value of this parameter qualifies the Path
parameter. The syntax of the filter, including the use of wildcards, depends on the provider. Filters are more
efficient than other parameters, because the provider applies them when retrieving the objects, rather than
having Windows PowerShell filter the objects after they are retrieved.
Required? false
Position? named
Default value None
Accept pipeline input? False
Accept wildcard characters? false
-Include
Changes only the specified items. The value of this parameter qualifies the Path parameter. Enter a path
element or pattern, such as "*.txt". Wildcards are permitted.
Required? false
Position? named
Default value None
Accept pipeline input? False
Accept wildcard characters? false
-InputObject
Changes the security descriptor of the specified object. Enter a variable that contains the object or a
command that gets the object.
You cannot pipe the object to be changed to Set-Acl . Instead, use the InputObject parameter explicitly in the
command.
This parameter was introduced in Windows PowerShell 3.0.
Required? true
Position? 0
Default value None
Accept pipeline input? True (ByPropertyName)
Accept wildcard characters? false
-LiteralPath
Changes the security descriptor of the specified item. Unlike Path , the value of the LiteralPath parameter is
used exactly as it is typed. No characters are interpreted as wildcards. If the path includes escape
characters, enclose it in single quotation marks. Single quotation marks tell Windows PowerShell not to
interpret any characters as escape sequences.
This parameter was introduced in Windows PowerShell 3.0.
Required? true
Position? named
Default value None
Accept pipeline input? True (ByPropertyName)
Accept wildcard characters? false
-Passthru []
Returns an object that represents the security descriptor that was changed. By default, this cmdlet does not
generate any output.
Required? false
Position? named
Default value False
Accept pipeline input? False
Accept wildcard characters? false
-Path
Changes the security descriptor of the specified item. Enter the path to an item, such as a path to a file or
registry key. Wildcards are permitted.
If you pass a security object to Set-Acl (either by using the AclObject or SecurityDescriptor parameter, or by
passing a security object from Get-Acl to Set-Acl ), and you omit the Path parameter (name and value), Set-Acl
uses the path that is included in the security object.
Required? true
Position? 0
Default value None
Accept pipeline input? True (ByPropertyName)
Accept wildcard characters? false
-UseTransaction []
Includes the command in the active transaction. This parameter is valid only when a transaction is in
progress. For more information, see Includes the command in the active transaction. This parameter is valid
only when a transaction is in progress. For more information, see
Required? false
Position? named
Default value False
Accept pipeline input? False
Accept wildcard characters? false
-WhatIf []
Shows what would happen if the cmdlet runs. The cmdlet is not run.
Required? false
Position? named
Default value False
Accept pipeline input? False
Accept wildcard characters? false
This cmdlet supports the common parameters: Verbose, Debug,
ErrorAction, ErrorVariable, WarningAction, WarningVariable,
OutBuffer, PipelineVariable, and OutVariable. For more information, see
about_CommonParameters (https:/go.microsoft.com/fwlink/?LinkID=113216).
These commands copy the values from the security descriptor of the Dog.txt file to the security descriptor of the
Cat.txt file. When the commands complete, the security descriptors of the Dog.txt and Cat.txt files are identical.
The first command uses the Get-Acl cmdlet to get the security descriptor of the Dog.txt file. The assignment
operator (=) stores the security descriptor in the value of the $DogACL variable.
The second command uses Set-Acl to change the values in the ACL of Cat.txt to the values in $DogACL.
The value of the Path parameter is the path to the Cat.txt file. The value of the AclObject parameter is the model
ACL, in this case, the ACL of Dog.txt as saved in the $DogACL variable.
Example 2: Use the pipeline operator to pass a descriptor
These commands apply the security descriptors in the File0.txt file to all text files in the C:\Temp directory and
all of its subdirectories.
The first command gets the security descriptor of the File0.txt file in the current directory and uses the
assignment operator (=) to store it in the $NewACL variable.
The first command in the pipeline uses the Get-ChildItem cmdlet to get all of the text files in the C:\Temp
directory. The Recurse parameter extends the command to all subdirectories of C:\temp. The Include parameter
limits the files retrieved to those with the ".txt" file name extension. The Force parameter gets hidden files,
which would otherwise be excluded. (You cannot use "c:\temp\ .txt", because the Recurse* parameter works on
directories, not on files.)
The pipeline operator (|) sends the objects representing the retrieved files to the Set-Acl cmdlet, which applies
the security descriptor in the AclObject parameter to all of the files in the pipeline.
In practice, it is best to use the WhatIf parameter with all Set-Acl commands that can affect more than one item.
In this case, the second command in the pipeline would be `Set-Acl -AclObject $NewAcl -WhatIf`. This command lists
the files that would be affected by the command. After reviewing the result, you can run the command again without
the WhatIf parameter.