如何用脚本给单个文件夹下多子文件夹分配NTFS读写权限？

Absolutely, you can automate this bulk NTFS permission assignment using a PowerShell script—it’s ideal for this kind of repetitive admin task. Below is a tested, flexible script that will apply Read/Write permissions to every subfolder under your target directory, while respecting your existing non-inheritance settings.

Prerequisites #

• Run PowerShell as Administrator (required to modify NTFS security settings)
• Have the exact user account names (domain or local) ready for your 4 users

The PowerShell Script #

# Replace with your parent folder path
$parentFolder = "C:\Your\Main\Folder"

# List your 4 users here (use Domain\Username for domain accounts, or just Username for local)
$targetUsers = @("Corp\JaneDoe", "Corp\JohnSmith", "LocalAdmin", "GuestUser")

# Define the permission level (Modify = full Read/Write access)
$permissionLevel = "Modify"

# Get all subfolders (remove -Recurse if you don't want nested subfolders included)
$subfolders = Get-ChildItem -Path $parentFolder -Directory -Recurse

foreach ($folder in $subfolders) {
    # Grab the current access control list (ACL) of the folder
    $folderAcl = Get-Acl -Path $folder.FullName

    foreach ($user in $targetUsers) {
        # Create a new access rule for the user
        $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule(
            $user,
            $permissionLevel,
            "ContainerInherit,ObjectInherit",
            "None",
            "Allow"
        )

        # Add the rule to the folder's ACL
        $folderAcl.AddAccessRule($accessRule)
    }

    # Apply the updated ACL back to the folder
    Set-Acl -Path $folder.FullName -AclObject $folderAcl

    Write-Host "Permissions applied to: $($folder.FullName)"
}

Write-Host "All permission assignments are complete!"

Key Details to Customize #

• $parentFolder: Swap this with the full path to your main folder containing all subfolders.
• $targetUsers: Update this list with your actual user accounts—double-check spelling to avoid errors.
• $permissionLevel: "Modify" grants full Read/Write access (including creating, editing, and deleting files/folders). If you need a more restricted Read/Write (no delete access), replace this with "ReadAndExecute, Write".
• -Recurse: Remove this flag if you only want to apply permissions to immediate subfolders (not nested ones).

Critical Notes #

1. Test First: Run the script on a small subset of folders before deploying to all, to ensure it behaves as expected.
2. Preserve Existing Permissions: This script adds new permissions without overwriting existing ones. If you need to replace permissions instead, use SetAccessRule instead of AddAccessRule.
3. Alternative: icacls (Batch Script): If you prefer command-line tools, you can use this batch script:

   @echo off
   set "parentFolder=C:\Your\Main\Folder"
   set "users=Corp\JaneDoe Corp\JohnSmith LocalAdmin GuestUser"
   
   for /d %%f in ("%parentFolder%\*") do (
       for %%u in (%users%) do (
           icacls "%%f" /grant "%%u:(OI)(CI)M" /T
       )
       echo Applied permissions to: %%f
   )
   echo Permission setup finished!
   

   The (OI)(CI)M flag translates to Object Inherit, Container Inherit, and Modify access.

If you hit any snags or need to adjust the script for edge cases (like excluding specific subfolders), feel free to ask for tweaks!

内容的提问来源于stack exchange，提问作者hotdog_spaceship