NTFSSecurity: Remove-NTFSAccess cannot remove an ACE with the GenericAll AccessRights

Get-NTFSAccess -Path 'c:\mypath' -Account 'creator owner' | Remove-NTFSAccess

Results in the following error:

Remove-NTFSAccess : The value '269484032' is not valid for this usage of the type FileSystemRights.
Parameter name: fileSystemRights
    + CategoryInfo          : WriteError: (c:\mypath:String) [Remove-NTFSAccess], ArgumentOutO fRangeException
    + FullyQualifiedErrorId : RemoveAceError,NTFSSecurity.RemoveAccess

About this issue

Original URL
State: open
Created 7 years ago
Comments: 16 (8 by maintainers)

Most upvoted comments

Following up on my previous comment, I found another directory with a similar ACE.

This time I tried Giving myself GenericalAll via Add-NTFSAccess. What I found was that instead of AccessRights “GenericAll”, I had received Access Rights “Synchronize, GenericAll”, Further I found that I could remove those rights with remove-ntfsaccess So I though, “what if I try giving the user with GenericAll right, the same rights again?” Will they get that Synchronize right?

Add-NTFSAccess -Path H:\CAXX\HOME\anotheruser -Account Contoso\anotheruser -AccessRights GenericAll -AccessType Allow -AppliesTo SubfoldersAndFilesOnly

Well, lo and behold, they do!! They end up with

Contoso\anotheruser                     Synchronize... SubfoldersAndFilesOnly    Allow          False

And now you can easily remove that ACE

So I think we have a WORKAROUND

$Path = "T:\This\Dir"
$Account = "Contoso\ThatAccount"
$ACE = Get-NTFSAccess -Path $Path -Account $account

try {
    $ACE | Remove-NTFSAccess -ErrorAction Stop
}
catch {
    Add-NTFSAccess -Account $Account -Path $Path -AccessRights GenericAll -AccessType Allow -AppliesTo SubfoldersAndFilesOnly
    Get-NTFSAccess -Path $path -account $Account | Remove-NTFSAccess
}

EDIT: Yes, I realize that this could be an expensive operation depending on the number of files and folders in a directory tree. Let me know what you think!

AspenForester on Apr 3, 2020

Still broken.

CastyMcBoozer on Mar 20, 2020

It happens when I try to remove the Everyone ACE when it has these rights.

Account Access Rights Applies to Type IsInherited InheritedFrom

Everyone GenericAll SubfoldersAndFilesOnly Allow False

dougawouga on Oct 1, 2019

Late to the party but I ran into this with trying to remove invalid SIDS from Shares. Seems if the AccessRights are GenericAll this issue comes up.

Get-NTFSOrphanedAccess -Path $UserShare | Remove-NTFSAccess

PSJeffH on Nov 19, 2018