Remove Extra Permissions

If there are additional permissions shown in the output that are not required, they can be removed using the commands below. We suggest that you remove any extra permissions after adding the permissions for the local or domain administrator group to the folder. Perform this for both the %DNAInstallRoot%\<silo> and the %DNADataRoot%\<silo> for both the ACM and CloudData silos. The following commands will use the $folderPath that has already been setup. Substitute the Principal name for <principal name>, and the rights to be removed for <access rights>.

Disable-NTFSAccessInheritance -path $folderPath

$principal = Get-NTFSAccess $folderPath | Where-Object {$_.Account -eq "<principal name>"} | Select-Object Account

$removalAccount = $principal.Account

Write-Host "Removing account - $($removalAccount)"

Remove-NTFSAccess -Path $folderPath -Account $removalAccount -AccessRights "<access rights>" -AccessType Allow -PropagationFlags None

(Get-ACL -Path $folderPath).Access | Format-Table IdentityReference,FileSystemRights,AccessControlType,IsInherited,InheritanceFlags -AutoSize