Set group permission on folder

See if this example from Don Jones helps you: You basically take the existing acl object from the folder, add a new rule to it (SetAccessRule), and the rule contains the principal(user or group,the right and whether it's an allow or deny). The updated aclobject is then applied to the file/folder using set-acl.

#ChangeACL.ps1 $Right="FullControl" #The possible values for Rights are # ListDirectory, ReadData, WriteData # CreateFiles, CreateDirectories, AppendData # ReadExtendedAttributes, WriteExtendedAttributes, Traverse # ExecuteFile, DeleteSubdirectoriesAndFiles, ReadAttributes # WriteAttributes, Write, Delete # ReadPermissions, Read, ReadAndExecute # Modify, ChangePermissions, TakeOwnership # Synchronize, FullControl $StartingDir=Read-Host "What directory do you want to start at?" $Principal=Read-Host "What security principal do you want to grant" ` "$Right to? `n Use format domain\username or domain\group" #define a new access rule. #note that the $rule line has been artificially broken for print purposes. #it needs to be one line. the online version of the script is properly #formatted. $rule=new-object System.Security.AccessControl.FileSystemAccessRule($Principal,$Right,"Allow") foreach ($file in $(Get-ChildItem $StartingDir -recurse)) { $acl=get-acl $file.FullName #Add this access rule to the ACL $acl.SetAccessRule($rule) #Write the changes to the object set-acl $File.Fullname $acl } 

When you specify the -PassThru parameter on the New-ADGroup cmdlet, it returns the new group. The ADGroup object you get back contains a SID property which you can use to pass the IdentityReference for the access rule:

$readGroup = New-ADGroup -Name $GroupNameRead -DisplayName $GroupNameRead -GroupScope DomainLocal -GroupCategory Security -Path $FSGroupPath -Description "Ger Läs Rättigheter till sökväg: FS\Data\$_" -PassThru if(-not($readGroup)) # Make sure it got created, if not, handle the error { # Error handling in here } else { $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule($readGroup.SID,Read,Allow) }