Set Owner with PowerShell: “The security identifier is not allowed to be the owner of this object”
I’ve written several PowerShell scripts to help customers adjust permissions to their directory structures when migrating from other file servers(Linux/Samba, Novell OES/Netware, etc). Part of these scripts includes assigning ownership for the user. While this tends to take a long time quotas and file reporting are worthless if the administrator that copied everything is assigned as the owner.
Recently I tried to adapt one of these scripts for a customer, but when I ran it it failed with the error: “The security identifier is not allowed to be the owner of this object”
A quick internet search found lots of people saying basically this can’t be done with PowerShell. What!!! I know for a fact these scripts had worked before. What’s the deal? After a lot of testing and beating my head against the wall I figure out I was trying to do something different. Previously I had run my scripts against the UNC path (eg. \\servername\share\directory), but this time I was trying to run it on a local directory using the drive path (E:\Share\Directory).
Could it be that simple? Yes. I ran the command again using the UNC path and the script worked as it did before.
Here is an example script to set the owner of a directory or file to test the above:
function pathPrompt {
$tempPath = $null
$tempPath = Read-Host ‘Please enter the path of thedirectory (e.g. “\\file\vol1\users\example”‘
return $tempPath
}$username=”exampleuser”
$domain=”domain”
$ID = new-object System.Security.Principal.NTAccount($domain, $username)$path = pathPrompt
write-host $path
$acl = get-acl $path
$acl.SetOwner($ID)
set-acl -path $path -aclObject $acl
Save the above to a file with a .PS1 extension, change the $username and $domain variables, and run it (make sure you set-executionpolicy to unrestricted and PowerShell as administrator). It will prompt for a path. It will then write the path to powershell and then set the owner if it can.
Below is an example of running it against a local path and a UNC path.
Thanks for posting this… it worked for me, and saved me trying to figure out how to get the other solutions working by adjusting the security token to enable the restore privilege. Good job!