Filter Permission by IdentityReference

Question

I am fetching some folder permissions, however, I only want permissiosn that are not "NT AUTHORITY\SYSTEM" or "BUILTIN\Administrators"

My code is:

$acl = Get-Acl $path
$perm = $acl.Access | where{$_.IdentityReference -notmatch  "NT AUTHORITY\SYSTEM"}
Write-Output $perm

But its still showing "NT AUTHORITY\SYSTEM" permission, how do I filter out that records I don't want?

Answer 1

TL;DR: -notmatch is using regular expressions and your string contains \S which will match any non-whitespace character (which is not what you want).

use -notlike instead of -notmatch:

$acl = Get-Acl $path
$perm = $acl.Access | where{$_.IdentityReference -notlike "NT AUTHORITY\SYSTEM"}
Write-Output $perm

To filter for multiple entries, I would use -notin:

$acl = Get-Acl $path
$perm = $acl.Access | where{$_.IdentityReference -notin @("BUILTIN\Administrators", "NT AUTHORITY\SYSTEM")}
Write-Output $perm