SERVER-029 · Script
Repair Profile Folder Permissions
Checks and repairs ownership and permissions on per-user profile folders (FSLogix profile containers or roaming profiles).
What it does
Looks at each folder directly under -Path and works out which user it belongs to: a SID in the folder name (FSLogix style, for example jsmith_S-1-5-21-... or S-1-5-21-..._jsmith) otherwise the folder name itself, minus any .V2 to .V6 profile version ending (roaming style) For each folder it reports whether that user is the owner and has Modify rights that flow down to everything inside. Wrong ownership or missing rights are a common cause of temporary profiles and profile containers that fail to attach.
Report mode (default) changes nothing. Fix mode sets the user as owner of the folder (and of everything inside with -Recurse) and grants the user Modify on the folder and its contents, using the built-in icacls tool. Existing permissions for other accounts are left in place.
Requirements
Windows PowerShell 5.1. Run as an administrator of the file server (Fix needs the right to take and assign ownership).
How to run it
- Run as: a service account with the directory rights the script lists, or SYSTEM on a domain controller or the server being checked
- Run from: a domain-joined management server or admin workstation with the RSAT tools, as a scheduled task or from your management tool
- Script type: PowerShell 5.1, 64-bit
- User interaction: none; the script never prompts
- Timeout: 30 minutes for large directories or many servers
Settings
| Name | What it does | Options | Default |
|---|---|---|---|
| Mode | Report (default) or Fix. | Report, Fix | Report |
| Path | Folder that holds the profile folders, for example \\fs01\Profiles$ or D:\FSLogix. | ||
| Domain | NetBIOS domain name used to look up folder names that do not contain a SID, for example SCHOOL. Default: the domain of the computer running the script. | ||
| Recurse | In Fix mode, also set the owner on every file and folder inside each profile folder. | False | |
| Limit | Only check the first this many folders, for testing. 0 (default) checks all. | 0 |
Exit codes
- 0 = All folders correct, or all repairs done
- 1 = Problems found in Report mode, or some repairs failed
- 2 = Script error (see log)
Testing steps
- Run it first with the mode set to Report on one test OU, test account or test server. Nothing is changed in that mode.
- Read the log and confirm the planned changes are what you expect.
- Run your chosen settings on the same test target and confirm the result.
- Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
- Roll out to a small group next, then everyone.
Rollback steps
Report mode changes nothing. Fix only sets the owner and adds Modify for the folder's own user; other permissions are left alone. To undo, remove that entry or change the owner back in the folder's Security settings.
Version and change log
| Version | Date | Changes |
|---|---|---|
| 1.0.0 | November 2026 | First release. |