Taking Inventory of a File Server with PowerShell — Capacity Analysis and Access Permission (ACL) Auditing

“The file server is down to less than 10% free space.” Work that begins with that warning is usually depressing. Nobody knows what is eating the capacity. Nobody can judge whether a ten-year-old folder that no one has touched is safe to delete. And nobody can answer on the spot who has access to what, or whether permissions for people who left the company are still in place. Going around opening Properties in File Explorer is a survey that never finishes on a multi-terabyte share.

Every time we get our hands dirty with this kind of request, the same thought recurs: tidying a file server is not a “deletion skill,” it is an “inventory skill.” Ask “can we delete this?” without numbers and a list, and departments will never say yes. Present a table saying “this folder alone is 800 GB, and 620 GB of it hasn’t been modified in over three years,” and the conversation moves forward immediately.

This article is aimed at IT staff and operations people at small and medium-sized businesses, and lays out the practical procedure for taking inventory of a file server’s capacity and access permissions (ACLs) with PowerShell, all the way to a CSV report. The policy throughout is consistent: read first, change last, with backups and -WhatIf.

1. The Bottom Line First

• Capacity analysis boils down to Get-ChildItem -Recurse + Measure-Object -Sum. Do not aggregate the whole tree at once; work per first-level folder to get a rough sense of where the bulk sits.¹²
• Do not swallow access denials — record them. In exchange for not stopping the scan with -ErrorAction SilentlyContinue, always capture the denied locations with -ErrorVariable. A place you could not count is not “zero,” it is “unknown.”³
• Base your “old file” judgement on LastWriteTime. In many environments NTFS last access time updates are disabled (or system-managed), so they cannot be trusted as evidence.⁴⁵
• Extract duplicate “candidates” with Get-FileHash (SHA256 by default). Narrowing by size before computing hashes is the standard way to save I/O.⁶
• The ACL inventory is Get-Acl’s Access property. Put IdentityReference (who), FileSystemRights (what), and IsInherited (inherited or direct) into a CSV, and use AreAccessRulesProtected to detect where inheritance has been broken.⁷⁸
• What this article inventories is NTFS permissions. Effective access over a share (SMB) is determined by the combination of the share permissions and the NTFS ACL. List the share side separately with Get-SmbShareAccess and read it alongside the NTFS ledger.⁹
• Specify the character encoding of your CSV reports explicitly. Windows PowerShell 5.1’s Export-Csv defaults to ASCII, which corrupts non-ASCII text, while PowerShell 7’s default is UTF-8 without BOM, which can interact badly with Excel’s default behaviour.¹⁰¹¹
• Only make changes (Set-Acl) once the inventory and departmental confirmation are done. Take a backup with icacls /save, confirm the targets with -WhatIf, and then apply.¹²¹³

2. Capacity Analysis — Turning “Where Is It Bloated?” Into Numbers

The first thing to do is get the total size of each folder directly under the share root. Enumerate files recursively with Get-ChildItem and total Length with Measure-Object.¹²

$root = 'D:\share'   # Assumes running on the file server. See Section 6 for cautions about running over UNC
$denied = @()

# Aggregate per first-level folder — getting a rough idea comes before totalling everything
# Apply the same options to the outer Get-ChildItem so failures enumerating the root land in $denied too
$report = foreach ($dir in Get-ChildItem -LiteralPath $root -Directory `
    -ErrorAction SilentlyContinue -ErrorVariable +denied) {
    # SilentlyContinue so access denials do not stop us, but denials still accumulate in $denied
    # Pipe the enumeration straight into Measure-Object (capturing it in a variable would keep every
    # FileInfo in memory, which becomes painful on folders with millions of files)
    $stats = Get-ChildItem -LiteralPath $dir.FullName -Recurse -File `
        -ErrorAction SilentlyContinue -ErrorVariable +denied |
        Measure-Object -Property Length -Sum
    [PSCustomObject]@{
        Folder    = $dir.Name
        SizeGB    = [math]::Round([double]$stats.Sum / 1GB, 2)
        FileCount = $stats.Count
    }
}
# Count files placed directly in the root as one row too (they are missed by the per-folder aggregation)
$rootStats = Get-ChildItem -LiteralPath $root -File `
    -ErrorAction SilentlyContinue -ErrorVariable +denied |
    Measure-Object -Property Length -Sum
if ($rootStats.Count -gt 0) {
    $report += [PSCustomObject]@{
        Folder    = '(directly in root)'
        SizeGB    = [math]::Round([double]$rootStats.Sum / 1GB, 2)
        FileCount = $rootStats.Count
    }
}

$report | Sort-Object SizeGB -Descending | Format-Table -AutoSize

# Always keep a record of "what could not be counted" — if this is not empty, the totals are incomplete
$denied | ForEach-Object { $_.TargetObject } | Sort-Object -Unique |
    Set-Content -Path .\denied-paths.txt

There are two things to note. First, -ErrorAction SilentlyContinue is not a switch that means “pretend the error never happened.” It only suppresses the display and continues; the error still occurs.³ That is why you catch it with -ErrorVariable. Prefixing the variable name with + appends rather than overwrites, so you can collect the denials from the whole loop into a single variable.³ Folders you were denied access to are missing from the totals, so the report shows them as smaller than reality. If denied-paths.txt is not empty, be sure to say so in the report. If you want to go a level deeper on error-handling design, “PowerShell Error Handling and Retry Design,” published alongside this article, is a useful reference.

Second, the problem of deep hierarchies. A share that has been in use for years will almost certainly contain paths longer than 260 characters (MAX_PATH), and some tools fail to enumerate at that point.¹⁴ When your scan results show an unnatural gap, suspect path length first. The full picture of this limit and how to deal with it is collected in “MAX_PATH and Windows Path/Filename Pitfalls.”

3. Old Files and Duplicate Candidates — Start From a List, Not From Deletion

3.1. Listing “Files Untouched for Three Years”

Once you know where things are bloated, the next step is gathering material for “deletion candidates.” The criterion to use is LastWriteTime (last modified time).

$cutoff = (Get-Date).AddYears(-3)

# A list of files not modified in three years or more. Nothing is deleted — this is material to show the department first
# Record locations that failed to enumerate with -ErrorVariable so they can be disclosed later
Get-ChildItem -LiteralPath $root -Recurse -File `
    -ErrorAction SilentlyContinue -ErrorVariable oldEnumErrors |
    Where-Object LastWriteTime -lt $cutoff |
    Select-Object FullName, LastWriteTime,
        @{ Name = 'SizeMB'; Expression = { [math]::Round($_.Length / 1MB, 2) } } |
    Sort-Object SizeMB -Descending |
    Export-Csv -Path .\old-files.csv -NoTypeInformation -Encoding utf8BOM   # Use UTF8 on 5.1 (both are BOM-prefixed)

# Always disclose the locations that could not be enumerated, to stop the list from looking complete
$oldEnumErrors | ForEach-Object { $_.TargetObject } |
    Set-Content -Path .\old-files-uninspected.txt

It is tempting to think “if I use the last access time (LastAccessTime), I can even tell which files have not been read” — but that is a trap. Because updating last access times affects performance on NTFS, whether updates are enabled or disabled is controlled through the fsutil behavior command and the registry (NtfsDisableLastAccessUpdate),⁴ and since Windows Vista the default has been disabled (in recent Windows 10 and later it is system-managed, and on servers it is disabled).⁵ In other words, files that are actually being opened but whose timestamps stay old are perfectly normal. Use LastWriteTime — “the date the content was last changed” — in your inventory documentation, and state what it means explicitly; that keeps the conversation with the department from going sideways.

3.2. Raising Duplicate File “Candidates”

Shared folders accumulate piles of “final version,” “final version_revised,” and “Copy of …”. Whether the contents are identical can be determined with Get-FileHash. The default algorithm is SHA256, and if the hash values match you can conclude the file contents are identical.⁶

# Hashing every file is I/O heavy. Narrow down to "files of the same size" first
# Record locations that failed to enumerate (access denials and so on) with -ErrorVariable for later disclosure
$candidates = Get-ChildItem -LiteralPath $root -Recurse -File `
    -ErrorAction SilentlyContinue -ErrorVariable enumErrors |
    Group-Object -Property Length |
    Where-Object { $_.Count -ge 2 -and [long]$_.Name -gt 0 } |   # Exclude zero-length files
    ForEach-Object { $_.Group }

# Hash only the narrowed candidates and output matching groups as duplicate "candidates"
$candidates |
    Get-FileHash -ErrorAction SilentlyContinue -ErrorVariable hashErrors |   # SHA256 by default
    Group-Object -Property Hash |
    Where-Object Count -ge 2 |
    ForEach-Object { $_.Group } |
    Select-Object Hash, Path |
    Export-Csv -Path .\duplicate-candidates.csv -NoTypeInformation -Encoding utf8BOM   # Use UTF8 on 5.1

# Always keep a list of folders that could not be enumerated, and files whose hash could not be
# computed because they were locked, unreadable, and so on, as "could not be inspected"
# (dropping them silently makes them indistinguishable from "no duplicates")
@($enumErrors) + @($hashErrors) | ForEach-Object { $_.TargetObject } |
    Set-Content -Path .\hash-uninspected.txt

They are deliberately called “candidates” because deciding which one to keep is a business question, not a technical one. Even with identical content, “department A’s master” and “department B’s reference copy” can mean different things. Do not delete mechanically — this script’s remit extends only as far as taking the list and discussing it with the people involved. The nature of the hashing tool itself (what it guarantees and what it does not) is covered in “A Practical Procedure for Identifying the Scheme Behind a Hash String.”

4. Auditing Access Permissions (ACLs) — Putting “Who Can Do What” Into a Table

The other inventory target, alongside capacity, is permissions. Get-Acl retrieves the security descriptor of a file or folder, and from the Access property you can read the list of access control entries (ACEs) in the DACL.⁷

# Inventory the ACLs of folders two levels deep from the share root
# The "trunk" of a permission design is concentrated in the shallow levels, so check there first
$aclErrors = @()   # -ErrorVariable with + appends, so reinitialize each run to avoid carrying over the previous run
$targets = @(Get-Item -LiteralPath $root `
                 -ErrorAction SilentlyContinue -ErrorVariable +aclErrors) +
           @(Get-ChildItem -LiteralPath $root -Directory -Recurse -Depth 1 `
                 -ErrorAction SilentlyContinue -ErrorVariable +aclErrors)

$aclReport = foreach ($t in $targets) {
    # Record retrieval failures (unreadable, deleted during the scan, and so on) so they can be disclosed later
    $acl = Get-Acl -LiteralPath $t.FullName -ErrorAction SilentlyContinue -ErrorVariable +aclErrors
    if (-not $acl) { continue }
    if (@($acl.Access).Count -eq 0) {
        # Keep a row for folders with an empty DACL (zero explicit entries) too, so broken-inheritance information does not vanish from the ledger
        [PSCustomObject]@{
            Path = $t.FullName; Identity = '(no entries)'; Rights = $null; Type = $null
            IsInherited = $null; Inheritance = $null
            InheritanceBroken = $acl.AreAccessRulesProtected
        }
        continue
    }
    foreach ($ace in $acl.Access) {
        [PSCustomObject]@{
            Path        = $t.FullName
            Identity    = $ace.IdentityReference    # Who (user/group)
            Rights      = $ace.FileSystemRights     # What they can do
            Type        = $ace.AccessControlType    # Allow / Deny
            IsInherited = $ace.IsInherited          # Inherited from the parent, or granted directly
            # Distinguish "this folder only" from "also applies to files/folders beneath it" for the same rights
            Inheritance = "$($ace.InheritanceFlags)/$($ace.PropagationFlags)"
            InheritanceBroken = $acl.AreAccessRulesProtected  # Is inheritance broken on this folder
        }
    }
}
$aclReport | Export-Csv -Path .\acl-report.csv -NoTypeInformation -Encoding utf8BOM   # Use UTF8 on 5.1

# Always disclose targets whose ACL could not be retrieved as holes in the ledger (same discipline as the other surveys)
$aclErrors | ForEach-Object { $_.TargetObject } |
    Set-Content -Path .\acl-uninspected.txt

Once you open this CSV, filter it from the following angles to hunt for anomalies.

Entries where IsInherited is False are “permissions someone added by hand on that folder,” and folders where AreAccessRulesProtected is True are “islands that changes to the parent’s permissions never reach.”⁷⁸ Most permission trouble concentrates in these two, so start your ledger there. One limitation should be stated explicitly: this example is a shallow scan with -Depth 1, so folders that break inheritance deeper than that are not covered, and no error is raised either. If you want a full survey of broken inheritance, either remove the -Depth restriction and run the same script (it will take time) or re-run it with a suspect departmental folder as the root. Note also that Get-Acl can display the security descriptor in the SDDL string format,⁷ but for inventory purposes the table from the Access property is enough. There is no hurry to get into reading SDDL until you meet a phenomenon this table cannot explain.

One practical caution. Always specify the character encoding of your CSVs. Windows PowerShell 5.1’s Export-Csv outputs ASCII by default, which corrupts non-ASCII text.¹⁰ The default for PowerShell 7.x is utf8NoBOM (UTF-8 without BOM),¹¹ which is displayed as mojibake in some environments when opened directly in Excel. For a file you are handing to a department, the safe bet is to settle on UTF-8 with BOM, using -Encoding UTF8BOM (or -Encoding UTF8 on 5.1).

5. How to Make Changes — Choosing Between icacls and Set-Acl, Backups, and -WhatIf

Only once the inventory and departmental confirmation are finished do you enter the change phase. There are two families of tools here.

Whichever you use, the order is fixed. Backup → -WhatIf (or target confirmation) → apply → verify afterwards.

# 1. Save the ACLs to a file before making changes (/t for everything beneath, /c to continue on errors)
icacls "D:\share\sales" /save "C:\aclbackup\sales-acl.txt" /t /c
# Do not proceed to changes without a backup. Check icacls's success or failure with the exit code
if ($LASTEXITCODE -ne 0) {
    throw "ACL backup failed (icacls ExitCode=$LASTEXITCODE). Aborting the change operation"
}

# 2. When changing with Set-Acl: three steps — retrieve, edit the rules, apply
$path = 'D:\share\sales\estimate'
$acl  = Get-Acl -LiteralPath $path

# A rule granting Modify rights to the sales group (inherited by subfolders and files)
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
    'CONTOSO\SalesTeam', 'Modify', 'ContainerInherit,ObjectInherit', 'None', 'Allow')
# Use AddAccessRule to grant additional rights. SetAccessRule replaces existing Allow rules for the same
# user/group, which can silently wipe out finer-grained permissions that were already configured for that group
$acl.AddAccessRule($rule)

# 3. Confirm "where this will be applied" with -WhatIf first, then proceed to the real run
Set-Acl -LiteralPath $path -AclObject $acl -WhatIf
# If everything looks fine: Set-Acl -LiteralPath $path -AclObject $acl

Because Set-Acl works by “applying the security descriptor obtained from Get-Acl as a model,”¹² getting the target wrong between retrieval and application results in wholesale replacement of an ACL you never intended to touch. Unglamorous habits — holding the retrieval path and the application path in the same variable, as above, and inserting a -WhatIf before applying — are what prevent accidents. Breaking inheritance (SetAccessRuleProtection) is possible within the same framework,¹² but as we saw in Section 4, broken inheritance becomes a future management cost, so limit new instances to places where it is genuinely necessary.

When you grow this sequence of work into a scheduled script, the design patterns (SupportsShouldProcess, keeping an audit trail, registering with Task Scheduler) covered in “Applied PowerShell Scripting — Safely Automating Log Investigation, Archiving, and Reporting” can be applied as-is.

6. Where to Run It — Scanning Over UNC and the Executing Account

Finally, the topic of “where and as whom you run it,” which affects results more than you might expect.

• As a rule, run large scans on the server itself. A recursive enumeration over a UNC path (\\fs01\share) turns per-file metadata retrieval into a network round trip, so on the scale of hundreds of thousands of files the elapsed time changes by an order of magnitude. If you want to work from an admin workstation, the practical arrangement is to run the script on the server via PowerShell Remoting and collect only the resulting CSV. For how to do that, see “An Introduction to PowerShell Remoting (WinRM),” published alongside this article.
• The results are a snapshot of the executing account’s permissions. Places you cannot access are missing from both the enumeration and Get-Acl. Run the survey with an administrator account, and include any locations still denied (denied-paths.txt from Section 2) in the report as “places that could not be surveyed.”
• When running over UNC, watch out for credential and session traps too. Drive letters are per-logon-session, you cannot connect to the same server with multiple sets of credentials (error 1219), and other pitfalls specific to share access are collected in “Pitfalls of Network Drives and UNC Paths.”

7. Standard Practice in the Field (Decision Table)

8. Summary

• Tidying a file server starts with an inventory, not deletion. Produce four CSV artefacts — a first-level capacity ranking, a list of old files, duplicate candidates, and an ACL ledger — and use them as material for the conversation with departments.
• In exchange for not stopping the scan with SilentlyContinue, always record the denied locations with ErrorVariable. A place you could not count is not “zero,” it is “unknown.”
• Base the “old” judgement on LastWriteTime. NTFS last access times have updates disabled in many environments and cannot be trusted.
• For duplicates, narrow by size and then use Get-FileHash (SHA256 by default). A match is a “candidate”; deciding what to keep is done with the business side.
• Export Get-Acl’s Access property to CSV and focus on direct individual grants, entries showing only a SID, and broken inheritance (AreAccessRulesProtected). There is no need to go deep into SDDL.
• Make changes in this order: back up with icacls /save → -WhatIf or target confirmation → apply → verify afterwards. Run large scans on the server (or via Remoting), with administrator rights.

Related Articles

• Pitfalls of Network Drives and UNC Paths — Working With File Servers (Shared Folders) From a Business Application
• MAX_PATH and Windows Path/Filename Pitfalls — the 260-Character Limit, Reserved Names, Trailing Dots, and Case Sensitivity
• An Introduction to PowerShell Remoting (WinRM) — Managing Multiple Windows Machines at Once
• PowerShell Error Handling and Retry Design
• Applied PowerShell Scripting — Safely Automating Log Investigation, Archiving, and Reporting
• A Practical Procedure for Identifying the Scheme Behind a Hash String

Related Consulting Areas

KomuraSoft LLC helps build scripts for taking inventory of file server capacity and permissions, carries out the investigation that accompanies a review of permission design, and automates periodic reporting (right through to Task Scheduler operation). We also welcome enquiries at the stage of “we just want to put numbers on the current situation first.”

• Technical Consulting & Design Review
• Windows Modernization & Maintenance
• Bug Investigation & Root Cause Analysis
• Contact

References

Related Articles

Recent articles sharing the same tags. Deepen your understanding with closely related topics.

Related Topics

These topic pages place the article in a broader service and decision context.

Where This Topic Connects

This article connects naturally to the following service pages.

Frequently Asked Questions

Common questions about the topic of this article.

How do I find the total size of each folder with PowerShell?

Enumerate files with Get-ChildItem using -Recurse, then total them with Measure-Object using -Property Length -Sum. Rather than aggregating everything in one go, the practical approach is to first aggregate per first-level folder directly under the share root, to get a rough sense of where the bulk sits. When you do, use -ErrorAction SilentlyContinue together with -ErrorVariable and always record the locations you could not count because of access denials. If you silently swallow the errors, the places left out of the total will look like they are zero bytes.

Is it acceptable to use LastAccessTime for deciding which files are old?

It is not recommended. On NTFS, last access time updates are disabled by default (or system-managed) in many environments for performance reasons, so a file can be read without its timestamp ever being updated. Use LastWriteTime as the basis for your inventory and present it to departments as the time elapsed since the content was last changed. Do not make archiving decisions mechanically; have the stakeholders review the list before you proceed.

What can I learn from Get-Acl? Do I need to read SDDL?

Get-Acl retrieves the security descriptor of a file or folder, and from the Access property you can read who (IdentityReference), what they can do (FileSystemRights), whether it is an allow or a deny (AccessControlType), and whether it is inherited or granted directly (IsInherited). Looking at AreAccessRulesProtected also tells you whether inheritance has been broken on that folder. There is also a string form called SDDL, but for inventory purposes exporting the Access property to CSV is easier to share with stakeholders, and there is no need to go deep into SDDL.

Should I change ACLs with PowerShell's Set-Acl or with icacls?

As a rule of thumb, use Get-Acl for investigation and reporting because it gives you objects, and make icacls your first choice for actually making changes. icacls can save ACLs to a file with /save and restore them as-is with /restore, which makes pre-change backups and rollback easy. If you use Set-Acl, it becomes a three-step process — retrieve with Get-Acl, edit the rules, then apply — and you confirm the targets with -WhatIf before running it. In either case, the principle is to complete the inventory and get confirmation from the relevant departments before moving on to changes.

Is it fine to run the file server survey over a UNC path?

For small volumes there is no problem, but a full scan on the scale of hundreds of thousands of files is dramatically slower over the network. Where possible, run it directly on the file server (or via PowerShell Remoting) and bring back only the resulting CSV. Also, scan results depend on the permissions of the account running them. Folders you cannot access are missing from the enumeration, so run as an administrator account and then record any locations still denied, including them in the report as places that could not be surveyed.

Author Profile

Profile page for the article author.

Go Komura

Representative of KomuraSoft LLC

Focused on Windows software development, technical consulting, and investigations into failures that are difficult to reproduce.