Adding ACL rule to folder overwrites all rules - powershell

Question

The problem I need to solve is I need to make a folder on a network share for a newly created user. This is done by System Center Orchestrator, after the user is created I need to copy a dummy folder with certain rights, add the newly created user in the ACL's and delete the workflow account from those ACL's. (the user that creates the folder gets added automaticly.)
The folder gets created succesfully and gets the same permissions as the dummy folder, now I need to add 1 ACL rule to those permissions.
Here is some sample code I'm using:
$colRights = [System.Security.AccessControl.FileSystemRights]"Read, Write"
$InheritanceFlag = [System.Security.AccessControl.InheritanceFlags]::None
$PropagationFlag = [System.Security.AccessControl.PropagationFlags]::None
$objType =[System.Security.AccessControl.AccessControlType]::Allow
$objUser = New-Object System.Security.Principal.NTAccount("domain\createdUser1")
$objACE = New-Object System.Security.AccessControl.FileSystemAccessRule (
$objUser, $colRights, $InheritanceFlag, $PropagationFlag, $objType
)
$originalACL = Get-ACL "\\shares\createdUser1"
#$orignalACL.SetAccessRuleProtection($True,$False)#doesn't help either
$originalACL.AddAccessRule($objACE)
Set-ACL "\\shares\createdUser1" $objACL
The only problem I'm having is that it doesn't add the ACL rule but it overwrites all rules that this folder currently has. How can I add 1 rule to to an existing ACL without overwriting the original rules?
source sample code: https://technet.microsoft.com/en-us/library/ff730951.aspx
EDIT1:
Using the module provided on https://blogs.technet.microsoft.com/heyscriptingguy/2014/11/22/weekend-scripter-use-powershell-to-get-add-and-remove-ntfs-permissions/ does the same thing. Am I doing something wrong?
$colRights = "Read, Write"
$objUser = New-Object System.Security.Principal.NTAccount("domain\createdUser1")
Add-NTFSAccess -Path $folderPath -Account $objUser -AccessRights $colRights

Answer 1

There's nothing in your code that would remove ACLs except for the (now commented) line
#$orignalACL.SetAccessRuleProtection($True,$False)
That line will remove inherited ACLs, so of course it won't help.
From the documentation:
Syntax
public void SetAccessRuleProtection(
bool isProtected,
bool preserveInheritance
)
Parameters
isProtected
true to protect the access rules associated with this ObjectSecurity object from inheritance; false to allow inheritance.
preserveInheritance
true to preserve inherited access rules; false to remove inherited access rules. This parameter is ignored if isProtected is false.
I suspect you ran that line once before, thus removing inherited ACLs. To correct that mistake you need to re-enable inheritance first, either manually or by calling SetAccessRuleProtection() with the first parameter set to $false:
$orignalACL.SetAccessRuleProtection($false, $true)

Answer 2

This piece of code worked for me:
$colRights = "Read, Write"
$objUser = New-Object System.Security.Principal.NTAccount("domain\createdUser1")
add-NTFSAccess -Path $folderPath -Account $objUser -AccessRights $colRights
We ran it from an other user account and suddenly the code worked. This was found by testing the script on local folders. Here it didn't delete any other ACL's. This will probably be something with share permissions or security permissions. (locally I'm full admin but on the shares I'm not.)

Answer 3

The problem is here:
Set-ACL "\\shares\createdUser1" $objACL
Change to this:
Set-ACL "\\shares\createdUser1" $originalACL
You had modified the $originalACL when you ran $originalACL.AddAccessRule($objACE)