I have a role, "Role1", - a member of "RoleA". Also, I have created a new role, "Role2", which is also a member of "RoleA".

Now, I want to change the permissions in workflows and templates of Role2. So I run the script that I have created.


$allowWSWrite = New-ItemAcl -AccessRight workflowState:write -PropagationType Any -SecurityPermission AllowAccess -Identity "Role2"
$allowWSDelete = New-ItemAcl -AccessRight workflowState:delete  -PropagationType Any -SecurityPermission AllowAccess -Identity "Role2"
$allowWCExecute = New-ItemAcl -AccessRight workflowCommand:execute -PropagationType Any -SecurityPermission AllowAccess -Identity "Role2"

Get-Item -Path "master:system/Workflows" | Set-ItemAcl -AccessRules  $allowWSWrite, $allowWSDelete, $allowWCExecute


$allowRead = New-ItemAcl -AccessRight item:read -PropagationType Any -SecurityPermission AllowAccess -Identity "Role2"
$denyDelete = New-ItemAcl -AccessRight item:delete -PropagationType Any -SecurityPermission DenyAccess -Identity "Role2"
$denyWrite = New-ItemAcl -AccessRight item:write -PropagationType Any -SecurityPermission DenyAccess -Identity "Role2"
$denyRename = New-ItemAcl -AccessRight item:rename -PropagationType Any -SecurityPermission DenyAccess -Identity "Role2"
$denyCreate = New-ItemAcl -AccessRight item:create -PropagationType Any -SecurityPermission DenyAccess -Identity "Role2"

Get-Item -Path "master:sitecore/templates" | Set-ItemAcl -AccessRules $allowRead, $denyDelete, $denyWrite, $denyRename, $denyCreate

Upon checking, Role1 cannot create/edit a page which it previously could.

Does it has something to do with the permissions I have changed in Role2? Please advise.

  • 1
    Re "Role1 cannot create/edit a page which previously can": Do you mean "Role1 cannot create/edit a page which it previously could [create/edit]" (one word added, "it", and one word changed, to "could")? Jul 9, 2019 at 21:48

1 Answer 1


Yes, it does.

When you use Set-ItemAcl you overwrite all the security settings which were assigned to that previously.

When you set new access rights for Role2 you removed everything what was set there for Role before.

If you want to add some access rights instead of overwriting everything, try using Add-ItemAcl instead:

Get-Item -Path "master:sitecore/templates" | Add-ItemAcl -AccessRules $allowRead, $denyDelete, $denyWrite, $denyRename, $denyCreate
  • Is there a way to revert the permission of Role1? Jul 10, 2019 at 0:05
  • As far as I'm aware there is no option to revert what was set there earlier.
    – Marek Musielak
    Jul 10, 2019 at 5:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.