PowerShell script to alter item security inheritance

Question

I am working on SPE code to set user permissions for a specific tree item.

$role = "Michael"
$path = "master:\content\home\distributors\a-b\Austria"
$acl1 = New-ItemAcl -AccessRight item:read -PropagationType Any -SecurityPermission AllowAccess -Identity $role
$acl2 = New-ItemAcl -AccessRight item:write -PropagationType Any -SecurityPermission AllowAccess -Identity $role
$acl3 = New-ItemAcl -AccessRight item:rename -PropagationType Descendants -SecurityPermission AllowAccess -Identity $role
$acl3a = New-ItemAcl -AccessRight item:rename -PropagationType Entity -SecurityPermission DenyAccess -Identity $role
$acl4 = New-ItemAcl -AccessRight item:create -PropagationType Any -SecurityPermission AllowAccess -Identity $role
$acl5 = New-ItemAcl -AccessRight item:delete -PropagationType Descendants -SecurityPermission AllowAccess -Identity $role
$acl5a = New-ItemAcl -AccessRight item:delete -PropagationType Entity -SecurityPermission DenyAccess -Identity $role
$acl6 = New-ItemAcl -AccessRight item:read -PropagationType Descendants -SecurityPermission AllowInheritance -Identity $role
Get-Item -Path $path | Add-ItemAcl -AccessRules $acl1, $acl2, $acl3, $acl3a, $acl4, $acl5, $acl5a, $acl6 -PassThru

This is working to set the item and descendants for read, write, rename, create, and delete. I can't figure out how to also set the inheritance option for item and descendants though.

It doesn't seem I can do item:inheritance under -AccessRight.

When I try doing: New-ItemAcl -AccessRight item:read -PropagationType Descendants -SecurityPermission AllowInheritance -Identity $role it doesn't do anything.

Any thoughts on this?

Answer 1

As seen in the official docs you should be assigning the output from New-ItemAcl to a variable and then using Set-ItemAcl to assign to an item; alone it won't change anything on the item.

Note: Add-ItemAcl works with the existing access controls on the item. Set-ItemAcl overwrites with whatever you provide.

From the example here you can see the following:

$acl1 = New-ItemAcl -AccessRight item:delete -PropagationType Any -SecurityPermission AllowAccess -Identity "sitecore\adam"
$acl2 = New-ItemAcl -AccessRight item:read -PropagationType Descendants -SecurityPermission DenyAccess -Identity "sitecore\mikey"
Get-Item -Path master:\content\home | Set-ItemAcl -AccessRules $acl1, $acl2 -PassThru

Let's say I want to set the inheritance on the item like in the following image:

$item = Get-Item -Path "master:" -ID "{110D559F-DEA5-42EA-9C1C-8A5DF7E70EF9}"

$aclEntity = New-ItemAcl -Identity "sitecore\Developer" -AccessRight "*" -PropagationType Entity -SecurityPermission AllowInheritance
$aclDescendants = New-ItemAcl -Identity "sitecore\Developer" -AccessRight "*" -PropagationType Descendants -SecurityPermission AllowInheritance 
$item | Set-ItemAcl -AccessRules $aclEntity,$aclDescendants -PassThru

Combining our two scripts you can achieve this:

$item = Get-Item -Path "master:" -ID "{110D559F-DEA5-42EA-9C1C-8A5DF7E70EF9}"

$role = "sitecore\Developer"

$acl1 = New-ItemAcl -AccessRight item:read -PropagationType Any -SecurityPermission AllowAccess -Identity $role
$acl2 = New-ItemAcl -AccessRight item:write -PropagationType Any -SecurityPermission AllowAccess -Identity $role
$acl3 = New-ItemAcl -AccessRight item:rename -PropagationType Descendants -SecurityPermission AllowAccess -Identity $role
$acl3a = New-ItemAcl -AccessRight item:rename -PropagationType Entity -SecurityPermission DenyAccess -Identity $role
$acl4 = New-ItemAcl -AccessRight item:create -PropagationType Any -SecurityPermission AllowAccess -Identity $role
$acl5 = New-ItemAcl -AccessRight item:delete -PropagationType Descendants -SecurityPermission AllowAccess -Identity $role
$acl5a = New-ItemAcl -AccessRight item:delete -PropagationType Entity -SecurityPermission DenyAccess -Identity $role
$acl6 = New-ItemAcl -AccessRight item:read -PropagationType Descendants -SecurityPermission AllowInheritance -Identity $role

$aclEntity = New-ItemAcl -Identity $role -AccessRight "*" -PropagationType Entity -SecurityPermission AllowInheritance
$aclDescendants = New-ItemAcl -Identity $role -AccessRight "*" -PropagationType Descendants -SecurityPermission AllowInheritance 
$item | Set-ItemAcl -AccessRules $acl1, $acl2, $acl3, $acl3a, $acl4, $acl5, $acl5a, $acl6, $aclEntity, $aclDescendants -PassThru