Setting up NTFS permissions on a Root folder using PowerShell - powershell

Question

I'm creating a script so lesser capable techs can quickly and easily setup server side folders. I've been able to create the folder, related AD security groups and started assigning permissions, but I got stuck when I had 1 security groups listed twice.
Basically I have a FolderA_Ro and FolderA_RW groups with FolderA_RW being listed twice.
FolderA_RW - SPECIAL - Traversal, List folder, Read attributes, Read extended attributes, Create files, Create folders, Read permissions - This folder only
FolderA_RW - Modify - Subfolders and files only
This prevents users from renaming the folder and anything else they might do that can't be predicted. Yes, I've had a lot of issues with these kinds of things happening.
I can add the first one without issue, but I can't seem to get it to add the second. Any ideas? Here's my code...
$RFolder = read-host "folder name"
$path = "C:$($RFolder)"
<# Remove all NTFS permissions #>
$acl = Get-Acl $path
$acl.Access | %{$acl.RemoveAccessRule($_)}
Set-Acl $path $acl
<# Remove inheritence #>
$acl = Get-ACL -Path $path
$acl.SetAccessRuleProtection($True, $True)
Set-Acl -Path $path -AclObject $acl
<# Assign NTFS permissions #>
$acl = Get-Acl $path
$AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("PMGTINC\Domain Users","Delete, ChangePermissions, TakeOwnership", "None", "None", "Deny")
$acl.SetAccessRule($AccessRule)
$acl | Set-Acl $path
$AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("PMGTINC\SEC_$($RFolder)_Ro","ReadAndExecute", "ContainerInherit,ObjectInherit", "None", "Allow")
$acl.SetAccessRule($AccessRule)
$acl | Set-Acl $path
$AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("PMGTINC\SEC_$($RFolder)_RW","CreateFiles,AppendData,ReadAndExecute", "None", "None", "Allow")
$acl.SetAccessRule($AccessRule)
$acl | Set-Acl $path
$AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("PMGTINC\SEC_$($RFolder)_RW","Modify", "ContainerInherit,ObjectInherit", "None", "Allow")
$acl.SetAccessRule($AccessRule)
$acl | Set-Acl $path

Answer 1

You could modify your script to something like this:
$RFolder = read-host "folder name"
#Define some variables
$path = "C:\$($RFolder)"
$domain="PMGTINC"
$RoGroup="$domain\SEC_$($RFolder)_Ro"
$RWGroup="$domain\SEC_$($RFolder)_RW"
<# Remove all NTFS permissions #>
$acl = Get-Acl $path
$acl.Access | %{$acl.RemoveAccessRule($_)}
Set-Acl $path $acl
<# Remove inheritence #>
$acl = Get-ACL -Path $path
$acl.SetAccessRuleProtection($True, $True)
Set-Acl -Path $path -AclObject $acl
<# Assign NTFS permissions #>
$acl = Get-Acl $path
$AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("$domain\Domain Users","Delete, ChangePermissions, TakeOwnership", "None", "None", "Deny")
#Append the AccessRule to the ACL
$acl.AddAccessRule( $AccessRule )
#Push settings
Set-Acl -AclObject $acl $path
$AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("$RoGroup","ReadAndExecute", "ContainerInherit,ObjectInherit", "None", "Allow")
#Append the AccessRule to the ACL
$acl.AddAccessRule( $AccessRule )
#Push settings
Set-Acl -AclObject $acl $path
$AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("$RWGroup","CreateFiles,AppendData,ReadAndExecute", "None", "None", "Allow")
#Append the AccessRule to the ACL
$acl.AddAccessRule( $AccessRule )
#Push settings
Set-Acl -AclObject $acl $path
$AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("$RWGroup","Modify", "ContainerInherit,ObjectInherit", "None", "Allow")
#Append the AccessRule to the ACL
$acl.AddAccessRule( $AccessRule )
#Push settings
Set-Acl -AclObject $acl $path