名前 Set-Acl 概要 Changes the security descriptor of a specified item, such as a file or a registry key. 構文 Set-Acl [-Path] [-AclObject] [[-CentralAccessPolicy] ] [-ClearCentralAccessPolic y] [-Exclude ] [-Filter ] [-Include ] [-Passthru] [-Confirm] [-WhatIf] [-UseTran saction []] [] Set-Acl [-AclObject] [[-CentralAccessPolicy] ] [-ClearCentralAccessPolicy] [-Exclude ] [-Filter ] [-Include ] [-Passthru] -LiteralPath [-Confirm] [-WhatIf] [-Us eTransaction []] [] Set-Acl [-InputObject] [-AclObject] [-Exclude ] [-Filter ] [-Include < String[]>] [-Passthru] [-Confirm] [-WhatIf] [-UseTransaction []] [] 説明 The Set-Acl cmdlet changes the security descriptor of a specified item, such as a file or a registry key, to match the values in a security descriptor that you supply. To use Set-Acl, use the Path or InputObject parameter to identify the item whose security descriptor you wan t to change. Then, use the AclObject or SecurityDescriptor parameters to supply a security descriptor that h as the values you want to apply. Set-Acl applies the security descriptor that is supplied. It uses the value of the AclObject parameter as a model and changes the values in the item's security descriptor to match the values in the AclObject parameter. パラメーター -AclObject Specifies an ACL with the desired property values. Set-Acl changes the ACL of item specified by the Path or InputObject parameter to match the values in the specified security object. You can save the output of a Get-Acl command in a variable and then use the AclObject parameter to pass the variable, or type a Get-Acl command. 必須 true 位置 2 既定値 パイプライン入力を許可する true (ByValue) ワイルドカード文字を許可する false -Exclude Omits the specified items. The value of this parameter qualifies the Path parameter. Enter a path elemen t or pattern, such as "*.txt". Wildcards are permitted. 必須 false 位置 named 既定値 パイプライン入力を許可する false ワイルドカード文字を許可する true -Filter Specifies a filter in the provider's format or language. The value of this parameter qualifies the Path parameter. The syntax of the filter, including the use of wildcards, depends on the provider. Filters ar e more efficient than other parameters, because the provider applies them when retrieving the objects, r ather than having Windows PowerShell filter the objects after they are retrieved. 必須 false 位置 named 既定値 パイプライン入力を許可する false ワイルドカード文字を許可する true -Include Changes only the specified items. The value of this parameter qualifies the Path parameter. Enter a path element or pattern, such as "*.txt". Wildcards are permitted. 必須 false 位置 named 既定値 パイプライン入力を許可する false ワイルドカード文字を許可する true -Passthru [] Returns an object that represents the security descriptor that was changed. By default, this cmdlet doe s not generate any output. 必須 false 位置 named 既定値 False パイプライン入力を許可する false ワイルドカード文字を許可する false -Path Changes the security descriptor of the specified item. Enter the path to an item, such as a path to a fi le or registry key. Wildcards are permitted. If you pass a security object to Set-Acl (either by using the AclObject or SecurityDescriptor parameter s or by passing a security object from Get-Acl to Set-Acl), and you omit the Path parameter (name and va lue), Set-Acl uses the path that is included in the security object. 必須 true 位置 1 既定値 パイプライン入力を許可する true (ByPropertyName) ワイルドカード文字を許可する true -CentralAccessPolicy Establishes or changes the central access policy of the item. Enter the CAP ID or friendly name of a cen tral access policy on the computer. Beginning in Windows Server 2012, administrators can use Active Directory and Group Policy to set centr al access policies for users and groups. For more information, see "Central Access Policies" at http://g o.microsoft.com/fwlink/?LinkId=238408. This parameter is introduced in Windows PowerShell 3.0. 必須 false 位置 3 既定値 パイプライン入力を許可する true (ByPropertyName) ワイルドカード文字を許可する false -ClearCentralAccessPolicy [] Removes the central access policy from the specified item. Beginning in Windows Server 2012, administrators can use Active Directory and Group Policy to set centr al access policies for users and groups. For more information, see "Central Access Policies" at http://g o.microsoft.com/fwlink/?LinkId=238408. This parameter is introduced in Windows PowerShell 3.0. 必須 false 位置 named 既定値 False パイプライン入力を許可する false ワイルドカード文字を許可する false -InputObject Changes the security descriptor of the specified object. Enter a variable that contains the object or a command that gets the object. You cannot pipe the object to be changed to Set-Acl. Instead, use the InputObject parameter explicitly i n the command. This parameter is introduced in Windows PowerShell 3.0. 必須 true 位置 1 既定値 パイプライン入力を許可する true (ByPropertyName) ワイルドカード文字を許可する false -LiteralPath Changes the security descriptor of the specified item. Unlike Path, the value of the LiteralPath paramet er is used exactly as it is typed. No characters are interpreted as wildcards. If the path includes esca pe characters, enclose it in single quotation marks. Single quotation marks tell Windows PowerShell not to interpret any characters as escape sequences. This parameter is introduced in Windows PowerShell 3.0. 必須 true 位置 named 既定値 パイプライン入力を許可する true (ByPropertyName) ワイルドカード文字を許可する false -Confirm [] Prompts you for confirmation before running the cmdlet. 必須 false 位置 named 既定値 false パイプライン入力を許可する false ワイルドカード文字を許可する false -WhatIf [] Shows what would happen if the cmdlet runs. The cmdlet is not run. 必須 false 位置 named 既定値 false パイプライン入力を許可する false ワイルドカード文字を許可する false -UseTransaction [] Includes the command in the active transaction. This parameter is valid only when a transaction is in pr ogress. For more information, see 必須 false 位置 named 既定値 false パイプライン入力を許可する false ワイルドカード文字を許可する false このコマンドレットは、次の共通パラメーターをサポートします: Verbose、 Debug、ErrorAction、ErrorVariable、WarningAction、WarningVariable、 OutBuffer, PipelineVariable、および OutVariable。詳細については、 about_CommonParameters (http://go.microsoft.com/fwlink/?LinkID=113216) を参照してください。 入力 System.Security.AccessControl.ObjectSecurity, System.Security.AccessControl.CommonSecurityDescriptor You can pipe an ACL object or a security descriptor to Set-Acl. 出力 System.Security.AccessControl.FileSecurity By default, Set-Acl does not generate any output. However, if you use the Passthru parameter, it generat es a security object. The type of the security object depends on the type of the item. メモ The Set-Acl cmdlet is supported by the Windows PowerShell file system and registry providers. As such, y ou can use it to change the security descriptors of files, directories, and registry keys. -------------------------- EXAMPLE 1 -------------------------- PS C:\>$DogACL = Get-Acl C:\Dog.txt PS C:\>Set-Acl -Path C:\Cat.txt -AclObject $DogACL These commands copy the values from the security descriptor of the Dog.txt file to the security descriptor o f the Cat.txt file. When the commands complete, the security descriptors of the Dog.txt and Cat.txt files ar e identical. The first command uses the Get-Acl cmdlet to get the security descriptor of the Dog.txt file. The assignment operator (=) stores the security descriptor in the value of the $DogACL variable. The second command uses Set-Acl to change the values in the ACL of Cat.txt to the values in $DogACL. The value of the Path parameter is the path to the Cat.txt file. The value of the AclObject parameter is the model ACL, in this case, the ACL of Dog.txt as saved in the $DogACL variable. -------------------------- EXAMPLE 2 -------------------------- PS C:\>Get-Acl C:\Dog.txt | Set-Acl -Path C:\Cat.txt This command is almost the same as the command in the previous example, except that it uses a pipeline opera tor to send the security descriptor from a Get-Aclcommand to a Set-Acl command. The first command uses the Get-Acl cmdlet to get the security descriptor of the Dog.txt file. The pipeline o perator (|) passes an object that represents the Dog.txt security descriptor to the Set-Acl cmdlet. The second command uses Set-Acl to apply the security descriptor of Dog.txt to Cat.txt. When the command co mpletes, the ACLs of the Dog.txt and Cat.txt files are identical. -------------------------- EXAMPLE 3 -------------------------- PS C:\>$NewAcl = Get-Acl File0.txt PS C:\>Get-ChildItem c:\temp -Recurse -Include *.txt -Force | Set-Acl -AclObject $NewAcl These commands apply the security descriptors in the File0.txt file to all text files in the C:\Temp directo ry and all of its subdirectories. The first command gets the security descriptor of the File0.txt file in the current directory and uses the a ssignment operator (=) to store it in the $NewACL variable. The first command in the pipeline uses the Get-ChildItem cmdlet to get all of the text files in the C:\Temp directory. The Recurse parameter extends the command to all subdirectories of C:\temp. The Include parameter limits the files retrieved to those with the ".txt" file name extension. The Force parameter gets hidden fi les, which would otherwise be excluded. (You cannot use "c:\temp\*.txt", because the Recurse parameter works on directories, not on files.) The pipeline operator (|) sends the objects representing the retrieved files to the Set-Acl cmdlet, which ap plies the security descriptor in the AclObject parameter to all of the files in the pipeline. In practice, it is best to use the Whatif parameter with all Set-Acl commands that can affect more than one item. In this case, the second command in the pipeline would be "Set-Acl -AclObject $NewAcl -WhatIf". This c ommand lists the files that would be affected by the command. After reviewing the result, you can run the co mmand again without the Whatif parameter. 関連するリンク Online Version: http://go.microsoft.com/fwlink/p/?linkid=293939 Get-Acl