How do I run a script on each output of Get-ChildObject - file

Question

Creating a script to change the ACL on entire directories recursively. The simple script changes the ACL accordingly on one file, however I do not know how to run the script on each file of Get-ChildItem
Get-ChildItem $directory –recurse | % { Write-host $_.FullName }
This outputs the appropriate list of directory/file names
$acl = Get-Acl $file
$permission = "domain/user","FullControl","Allow"
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission
$acl.SetAccessRule($accessRule)
$acl | Set-Acl $file
Is there a way to set each output of Get-ChildItem as $file? I was trying to read up on ForEach-Object but I haven't been able to get the syntax right.

Answer 1

You can embed the code you already have in a foreach loop. Just get an array of the files by assigning the output of the Get-ChildItem call to a variable first:
$files = Get-ChildItem $directory -recurse
foreach($file in $files) {
$acl = Get-Acl $file
$permission = "domain/user","FullControl","Allow"
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission
$acl.SetAccessRule($accessRule)
$acl | Set-Acl $file
}

Answer 2

You can try this one
Get-Childitem $directory | ForEach {
$file = $_
$acl = Get-Acl $file
$permission = "domain/user","FullControl","Allow"
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission
$acl.SetAccessRule($accessRule)
$acl | Set-Acl $file
}

Answer 3

I would simply use the current object variable ($_):
Get-ChildItem $directory –Recurse | % {
$acl = Get-Acl -LiteralPath $_
$permission = 'domain\user', 'FullControl', 'Allow'
$accessRule = New-Object Security.AccessControl.FileSystemAccessRule $permission
$acl.SetAccessRule($accessRule)
Set-Acl -AclObject $acl -LiteralPath $_
}
If you want to put the ACL modification into a script and separate it from the Get-ChildItem I'd suggest to make the script process pipelined input:
[CmdletBinding()]
Param(
[Parameter(
Mandatory=$true,
ValueFromPipeline=$true,
ValueFromPipelineByPropertyName=$true
)]
[IO.FileSystemInfo]$Path
)
Begin {
$permission = 'domain\user', 'FullControl', 'Allow'
$accessRule = New-Object Security.AccessControl.FileSystemAccessRule $permission
}
Process {
$acl = Get-Acl -LiteralPath $Path
$acl.SetAccessRule($accessRule)
Set-Acl -AclObject $acl -LiteralPath $Path
}
Note, however, that Get-Acl cannot modify ACLs where neither your account nor one of your groups is the owner. You can work around this issue by using icacls:
[CmdletBinding()]
Param(
[Parameter(
Mandatory=$true,
ValueFromPipeline=$true,
ValueFromPipelineByPropertyName=$true
)]
[IO.FileSystemInfo]$Path
)
Begin {
$trustee = 'domain\user'
$permission = 'F'
}
Process {
& icacls $Path.FullName "/grant:r" "${trustee}:(CI)(OI)${permission}" | Out-Null
}