Get-Acl
Inspect permissions (ACLs) on objects.
Windowspassive
Get-Acl returns the security descriptor of a file, folder or registry key — used to find weak/misconfigured permissions for privesc.
Syntax
Get-Acl {path}
Example
(Get-Acl C:\Service\app.exe).Access
Lists the ACL entries of a service binary to spot writable-by-everyone privesc paths.
Options & flags
What each switch does. Toggle them in the builder below to assemble a command.
Command builder
Tick options (and fill any values) to build a ready-to-copy command.
get-acl
Usage examples
(Get-Acl C:\svc\app.exe).Access
List who can modify a service binary (privesc).
Advantages
- Surfaces privesc misconfigurations
- Works on FS and registry
- Scriptable auditing
Disadvantages
- ACL output is dense
- Windows-only
- Interpretation needs experience
Tags
#windows#permissions#privesc
Official docs: Get-Acl ↗
Related commands
Frequently asked questions
What is Get-Acl used for?
Get-Acl returns the security descriptor of a file, folder or registry key — used to find weak/misconfigured permissions for privesc.
What is an example Get-Acl command?
A common example is: (Get-Acl C:\Service\app.exe).Access — Lists the ACL entries of a service binary to spot writable-by-everyone privesc paths.
Is Get-Acl part of a standard install?
Get-Acl runs on Windows. It is typically available by default.
What category of security tool is Get-Acl?
Get-Acl is a PowerShell tool with a passive-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.