Grant-sqmVolumeAccess
FilesystemsqmSQLTool v1.9.174+ · New🔒 Elevated PowerShell (local Administrator), local machine only
F:, G:, H:, I:) or on single folders, and makes sure it is also there where inheritance was switched off.How: an inheritable Allow ACE
(OI)(CI) on the root of each target, which Windows passes on to everything that still inherits. Folders with a protected DACL do not get it that way, so the function finds them and sets the same ACE on each of them, which in turn reaches everything below. With -IncludeFiles files with broken inheritance are handled too.Why not simply
icacls F:\ /grant ... /T: that leaves a duplicate ACE (explicit plus inherited) on every folder, re-propagates the whole subtree once per folder (hours on large volumes) and always ends with an error, because even Administrators are denied access to System Volume Information. On top of that, icacls /C returns exit code 0 even after "access denied", and its summary line ("Failed processing 0 files") looks like an error to a text search. Grant-sqmVolumeAccess skips the system folders, never enters junctions, symbolic links or mount points, recognises rights that are already there and reads every ACL back after the change: Granted means the right is really set.Principals:
-Principal AuthenticatedUsers and/or Administrators (resolved by SID, so it works on any OS language), plus any local or domain group, account or SID via -Account. Rights are only added, never removed. The system drive is never touched.Inheritance on/off (v1.9.175+): with
-Inheritance Off the ACE is set without inheritance flags and applies to the target folder itself only, for example to let a group open the root of H:\ without getting anything on the folders inside. Nothing below is changed or scanned.Security note: read access for Authenticated Users on data, log and backup volumes means every signed-in user can read every
.bak file, which is a full copy of the data. Prefer a dedicated group and the narrowest -Path possible.Parameters
| Parameter | Type | Required | Default | Notes |
|---|---|---|---|---|
| -Principal | string[] | Optional | , | AuthenticatedUsers (S-1-5-11), Administrators (S-1-5-32-544). At least one of -Principal or -Account is required. |
| -Account | string[] | Optional | , | Further groups/accounts (DOMAIN\SQL-Readers) or SIDs. |
| -Rights | string | Optional | ReadAndExecute | ReadAndExecute, Read, Modify, FullControl. Applies to all principals of the call. |
| -DriveLetter | string[] | Optional | F, G, H, I | Drives to process. Ignored when -Path is given. |
| -Path | string[] | Optional | , | Folders or drive roots instead of -DriveLetter. |
| -ExcludeDrive | string[] | Optional | C, S | Never touched, also for -Path. The system drive is always excluded. |
| -Inheritance | string | Optional | On | On: inheritable (OI)(CI), folders with broken inheritance are granted explicitly. Off: target folder itself only. |
| -IncludeFiles | switch | Switch | $false | Also files with broken inheritance. Reads the ACL of every file, takes correspondingly long. Ignored with -Inheritance Off. |
| -EnableException | switch | Switch | $false | Throw instead of reporting Failed. |
| -WhatIf / -Confirm | switch | Switch | $false | -WhatIf still scans the tree and lists every folder that would be changed. |
Return Value
PSCustomObject per target and principal: ComputerName, Path, Scope (Root, ProtectedFolder, ProtectedFile), Principal, Sid, Rights, Inheritance (On, Off), Action (Granted, AlreadyPresent, WhatIf, Failed, Skipped), Message.
Examples
Preview for F:, G:, H:, I:, including the folders with broken inheritance
Grant-sqmVolumeAccess -Principal AuthenticatedUsers -WhatIf
Full control for the local Administrators on the data volumes
Grant-sqmVolumeAccess -Principal Administrators -Rights FullControl -DriveLetter F, G, H, I
One domain group, only on two log folders
Grant-sqmVolumeAccess -Account 'DOMAIN\SQL-Monitoring' -Path 'F:\MSSQL\Log', 'H:\MSSQL\Log'
Two principals without prompting, show only what changed or failed
Grant-sqmVolumeAccess -Principal AuthenticatedUsers, Administrators -Rights Read -Confirm:$false | Where-Object Action -ne 'AlreadyPresent'
Only the root of H:, nothing below (inheritance off)
Grant-sqmVolumeAccess -Account 'DOMAIN\SQL-Monitoring' -Path 'H:\' -Inheritance Off