Massenbearbeitung ACL Windows SMB Shares

# restart elevated if needed
if(!(new-object System.Security.Principal.WindowsPrincipal([System.Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole(544)){start powershell -Verb runas -ArgumentList '-File',$MyInvocation.MyCommand.Definition;exit}  

# assign Backup/Restore/TakeOwnership Token to current process
Add-Type '[DllImport("ntdll.dll")] public static extern int RtlAdjustPrivilege(int Privilege, bool Enable, bool CurrentThread, ref bool EnabledOut);' -name token -namespace privilege  
9,17,18 | %{[void][privilege.token]::RtlAdjustPrivilege($_,1,0,[ref]0)}

# startfolder
$startfolder = 'D:'  
# account
$account = 'DOMAIN\GruppeABC'  
# ace
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule $account,"FullControl","ContainerInherit,ObjectInherit","None","Allow"  

# apply rule to startfolder
$acl = Get-ACL $startfolder
$acl.AddAccessRule($rule)
Set-ACL -LiteralPath $startfolder -AclObject $acl

# apply rule to each "protected" child folder 
Foreach($folder in Get-ChildItem -LiteralPath $startfolder -Directory -Recurse -Force){
    $acl = Get-ACL -LiteralPath $folder.Fullname
    if ($acl.AreAccessRulesProtected){
        $acl.AddAccessRule($rule)
        Set-ACL -LiteralPath $folder.Fullname -AclObject $acl
    }
}