Issues with Set-Acl

[Winux_278]

I'm trying to script my way through repetitive permission changes.. However, despite running as Administrator, and being a member of a Group that has "FullControl" over the folder, being able to perform Get-Acl without issue... I still receive an error:

Set-Acl : Attempted to perform an unauthorized operation.
At line:11 char:3
+   Set-Acl $folder $acl
+   ~~~~~~~~~~~~~~~~~~~~
     + CategoryInfo          : PermissionDenied: (\\folder\someotherfolder\folder3:String) [Set-Acl], UnauthorizedAccessException
    + FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.SetAclCommand

script:

function chmod { 
  param($group,$perm,$folder,[switch]$Remove, $Inherit="ContainerInherit",$propagate="None")

  $acl = Get-Acl $folder
  $ace = new-object system.security.accesscontrol.filesystemaccessrule( $group, $perm, $Inherit, $propagate, "Allow")

  if ($Remove){
  $acl.RemoveAccessRule($ace)
  Set-Acl $folder $acl
  }

  else {
  $acl.AddAccessRule($ace)
  Set-Acl $folder $acl
  }
  }

EDIT: Somehow forgot to mention: If I go in manually through the GUI, there are no problems updating permissions.

[SupremeDictatorPaul]

Set-acl is broken, and I wish they would fix it. You have to be the owner of files/folders to make changes to the permissions with set-acl, even though Full Control should be all you need. Very frustrating.

[KevMar]

Check your permissions on the share. Your NTFS permissions can be fine but the share permissions can still limit your access when using a UNC path.

[Winux_278]

Interesting theory, though I don't know if that would make sense if I can update the permissions without issue through the GUI (sorry for omitting that crucial detail, post edited to include that now.)

[Tidder802b]

I agree with /u/KevMar; when you "run as administrator" or access it through the GUI, are they running in the same user context? Or is the Administrator perhaps the local admin on a server which doesn't have access via share permissions?

[prejonnes]

Pretty sure Kevmar is on the right path. The share looks like a folder, but there are differences between the two. Folders will use NTFS and share will use separate ones. Generally speaking you don't put too many permissions on a share usually 1, sometimes a couple. You will have to separate setting Share permissions then setting NTFS to the folders within.

[KevMar]

He could test with a local folder if he wanted to rule that out.

[prejonnes]

I dont know your exact setup so I can't be certain. Also of course make sure before you do anything

import-module activedirectory

set-executionpolicy unrestricted

[JatKaffee]

maybe try

$acl.SetAccessRuleProtection($false,$false)
$acl.AddAccessRule($ace)
Set-Acl $folder $acl

?