ACL/ACE functions

Function Get-Folders
{
    [CmdletBinding()]
    param
    (
        [Parameter(Mandatory=$true, Position = 0, ValueFromPipelineByPropertyName=$true)]
        [Alias("FullName")]
        [string] $SearchPath
    )
    Begin
    {
        $badFolders = New-Object -TypeName 'System.Collections.Generic.List[string]'
        $goodFolders = New-Object -TypeName 'System.Collections.Generic.List[string]'
    }
    Process
    {
        $Error.Clear()
        $dir = "C:\Program Files"
        [string[]] $folders = @(Get-ChildItem -Path $dir -Directory -Recurse).FullName
        if ($Error.Count -gt 0)
        {
            foreach ($e in $Error)
            {
                [void] $badFolders.Add(($e.TargetObject -as [string]))
            }
        }
        $goodFolders.AddRange($folders)
    }
    End
    {
        [pscustomobject]@{
            Good = $goodFolders
            Bad = $badFolders
        }
    }
}

Function Clone-Rule
{
    [CmdletBinding()]
    param
    (
        [Parameter(Mandatory=$true, Position = 0)]
        [System.Security.AccessControl.FileSystemAccessRule] $Rule,

        [Parameter(Mandatory=$true, Position = 1)]
        [ValidateScript({
            $_ -is [System.Security.Principal.IdentityReference] -or $_ -is [string]
        })]
        [object] $NewIdentity
    )

    if ($NewIdentity -is [string] -and $NewIdentity.StartsWith('S-1-5'))
    {
        $NewIdentity = [System.Security.Principal.SecurityIdentifier]::new($NewIdentity)
    }
    elseif (-not ($NewIdentity -is [System.Security.Principal.IdentityReference]))
    {
        $NewIdentity = [System.Security.Principal.NTAccount]::new($NewIdentity)
    }

    if ($NewIdentity -is [System.Security.Principal.SecurityIdentifier])
    {
        try
        {
            $maybeNT = $NewIdentity.Translate([System.Security.Principal.NTAccount])
            $NewIdentity = $maybeNT
        }
        catch
        {
            Write-Verbose "Couldn't convert the SID to a NT Account... Leaving as is."
        }
    }

    New-Object System.Security.AccessControl.FileSystemAccessRule(
        $NewIdentity, $Rule.FileSystemRights, $Rule.InheritanceFlags,
        $Rule.PropagationFlags, $Rule.AccessControlType
    )
}

Function Get-AceCollection
{
    [CmdletBinding()]
    param
    (
        [Parameter(Mandatory=$true)]
        [System.Collections.Generic.IEnumerable[string]] $FolderResults
    )
    foreach ($fol in $FolderResults)
    {
        $acl = [System.IO.File]::GetAccessControl($fol, [System.Security.AccessControl.AccessControlSections]"Owner,Access")
        foreach ($ace in $acl.GetAccessRules($true, $false, [System.Security.Principal.NTAccount]))
        {
            if ($ace.IdentityReference -is [System.Security.Principal.NTAccount])
            {
                try {
                    $trySid = $ace.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier])
                    $ntAcc = $ace.IdentityReference.Value
                }
                catch {
                    $trySid = $null
                    Write-Host "Unable to translate $($ace.IdentityReference.Value)"
                }
            }
            else
            {
                $trySid = $ace.IdentityReference.Value
                $ntAcc = $null
            }
            [pscustomobject]@{
                IsOwnerAce = $false
                Path = $fol
                NTAccount = $ntAcc
                SID = $trySid
                Ace = $ace
            }
        }
        $owner = $acl.GetOwner([System.Security.Principal.NTAccount])
        try
        {
            $tryOwnerSid = $owner.Translate([System.Security.Principal.SecurityIdentifier])
        }
        catch
        {
            Write-Host "Unable to translate Owner to a SID."
        }
        $ownerNtAcc = $owner.Value
        [pscustomobject]@{
            IsOwnerAce = $true
            Path = $fol
            NTAccount = $ownerNtAcc
            SID = $tryOwnerSid
            Ace = $null
        }
    }
}

Function Add-NewAce
{
    [CmdletBinding(SupportsShouldProcess=$true)]
    param
    (
        [Parameter(Mandatory=$true, Position = 0)]
        [System.Collections.Generic.IEnumerable[string]] $Locations,

        [Parameter(Mandatory=$true, Position = 1)]
        [hashtable] $SidLookupTable     # Key = Old-Domain SID; Value = New-Domain SID
    )
    foreach ($loc in $Locations)
    {
        $aclModified = $false
        $acl = [System.IO.File]::GetAccessControl($loc, [System.Security.AccessControl.AccessControlSections]"Owner,Access")
        $owner = $acl.GetOwner([System.Security.Principal.SecurityIdentifier])
        if ($SidLookupTable.ContainsKey($owner.Value))
        {
            $acl.SetOwner([System.Security.Principal.SecurityIdentifier]::new($SidLookupTable[$owner.Value]))
            $aclModified = $true
        }
        foreach ($ace in $acl.GetAccessRules($true, $false, [System.Security.Principal.SecurityIdentifier]))
        {
            if ($SidLookupTable.ContainsKey($ace.IdentityReference.Value))
            {
                $newRule = Clone-Rule -Rule $ace -NewIdentity $SidLookupTable[$ace.IdentityReference.Value]
                $acl.AddAccessRule($newRule)
                $aclModified = $true
            }
        }
        if ($aclModified)
        {
            Write-Debug $($acl.Access | Out-String)
            if ($PSCmdlet.ShouldProcess(("File Security - {0}" -f $loc), "Set-Acl"))
            {
                Set-Acl -Path $loc -AclObject $acl
            }
        }
    }
}