PowerShell script takes days to finish - powershell

Question

The following script runs great except for the fact that it takes days to finish. Does anyone have any tweaks or tips to cut down the execution time?
The shared directory, Images\Equipment, contains over 5500 folders is grows daily.
# If the Admin folder for Equipment Images does not exist, make a new one and set the correct permissions.
$Location = "E:\Images\Equipment\*\"
$file = "E:\Images\Equipment\*\Admin"
foreach ($_ in (Get-ChildItem E:\Images\Equipment\*\)){if(($_.PSIsContainer -AND $_.name -eq "Admin")-eq $false)
{
New-Item -Path $location -Name "Admin" -ItemType directory
$errorActionPreference = "continue"}}
$folder = "E:\Images\Equipment\*\Admin"
Get-ChildItem E:\Images\Equipment\ -Directory -Filter "admin" -Recurse | ForEach-Object {
$acl = Get-Acl $_.FullName
if ($acl.AreAccessRulesProtected) { $acl.Access | % {$acl.purgeaccessrules($_.IdentityReference)} }
else {
$isProtected = $true
$preserveInheritance = $false
$acl.SetAccessRuleProtection($isProtected, $preserveInheritance)
}
$account="recoequip\folder sales group"
$rights=[System.Security.AccessControl.FileSystemRights]::FullControl
$inheritance=[System.Security.AccessControl.InheritanceFlags]"ContainerInherit,ObjectInherit"
$propagation=[System.Security.AccessControl.PropagationFlags]::None
$allowdeny=[System.Security.AccessControl.AccessControlType]::Allow
$dirACE=New-Object System.Security.AccessControl.FileSystemAccessRule ($account,$rights,$inheritance,$propagation,$allowdeny)
$ACL.AddAccessRule($dirACE)
Set-Acl -aclobject $ACL -Path $folder
Write-Host $folder Permissions added}
Thank you for any assistance.
Sara

Answer 1

Ok, to try and speed up your script I would create the ACE once at the beginning as suggested by mjolinor in his comment above. I would not bother looking for folders that are missing an Admin subfolder, and just create the Admin sub-folder in each folder regardless, and use the -force argument. That won't delete and re-create, but what it will do is return a folder object for each folder even if it already existed. Collect all those folders in a variable. Then iterate through those folders and apply the correct permissions for them.
# If the Admin folder for Equipment Images does not exist, make a new one and set the correct permissions.
#Define ACE to apply
$account="recoequip\folder sales group"
$rights=[System.Security.AccessControl.FileSystemRights]::FullControl
$inheritance=[System.Security.AccessControl.InheritanceFlags]"ContainerInherit,ObjectInherit"
$propagation=[System.Security.AccessControl.PropagationFlags]::None
$allowdeny=[System.Security.AccessControl.AccessControlType]::Allow
$dirACE=New-Object System.Security.AccessControl.FileSystemAccessRule ($account,$rights,$inheritance,$propagation,$allowdeny)
#Make sure all Equipment Images folders have an 'Admin' subfolder, and store the folder objects for later
$Folders = Get-ChildItem E:\Images\Equipment\* -Directory | %{New-Item -Path ($_.FullName + "\Admin") -ItemType directory -ErrorAction Continue -Force}
ForEach($Folder in $Folders){
$acl = Get-Acl $Folder.FullName
if ($acl.AreAccessRulesProtected) { $acl.Access | % {$acl.purgeaccessrules($_.IdentityReference)} }
else {
$isProtected = $true
$preserveInheritance = $false
$acl.SetAccessRuleProtection($isProtected, $preserveInheritance)
}
$ACL.AddAccessRule($dirACE)
Set-Acl -aclobject $ACL -Path $folder
Write-Host $folder Permissions added
}
This does assume that you are using PSv3 or better and have access to the -Directory switch for the Get-ChildItem cmdlet. If you do not have v3 installed I would suggest upgrading your version of PowerShell. I realize that's not always an option so alternatively you can change line 12 to this:
$Folders = Get-ChildItem E:\Images\Equipment\* -Attributes Directory | %{New-Item -Path ($_.FullName + "\Admin") -ItemType directory -ErrorAction Continue -Force}
or
$Folders = Get-ChildItem E:\Images\Equipment\* | ?{$_.PSIsContainer} | %{New-Item -Path ($_.FullName + "\Admin") -ItemType directory -ErrorAction Continue -Force}
If you have to use one of these I would suggest the first one since that filters for only directories at the FileSystem Provider level, instead of returning all folders and files, and then making PowerShell filter out the files.

Answer 2

This was to long to add in a comment.
This is the error it gives repeatedly in between assigning permissions to certain Admin folders.
Get-Acl : Cannot validate argument on parameter 'Path'. The argument is null or empty. Provide an argument that is not null or
empty, and then try the command again.
At line:15 char:20
+ $acl = Get-Acl $_.FullName
+ ~~~~~~~~~~~
+ CategoryInfo : InvalidData: (:) [Get-Acl], ParameterBindingValidationException
+ FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.PowerShell.Commands.GetAclCommand
You cannot call a method on a null-valued expression.
At line:21 char:9
+ $acl.SetAccessRuleProtection($isProtected, $preserveInheritance)
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull
You cannot call a method on a null-valued expression.
At line:24 char:5
+ $ACL.AddAccessRule($dirACE)
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull
Set-Acl : Cannot bind argument to parameter 'AclObject' because it is null.
At line:26 char:24
+ Set-Acl -aclobject $ACL -Path $folder
+ ~~~~
+ CategoryInfo : InvalidData: (:) [Set-Acl], ParameterBindingValidationException
+ FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Microsoft.PowerShell.Commands.SetAclCommand