DXA web-install.ps1 - access control list not in canonical form

Question

I'm installing DXA 1.5, and running the web-install.ps1 script. When it comes to set the folder permissions, I get an exception like this:

C:\Users\dominicc\Downloads\SDL DXA .NET 1.5\web\web8\web-install.ps1 : Exception calling "SetAccessRule" with "1" argument(s): "This acc ess control list is not in canonical form and therefore cannot be modified." At C:\Users\dominicc\Downloads\SDL DXA .NET 1.5\web\web8\invoke-web-install.ps1:1 char:1 + .\web-install.ps1 -distDestination "C:\inetpub\wwwroot\DXAboxed" -sit ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [web-install.ps1], MethodInvocationException + FullyQualifiedErrorId : InvalidOperationException,web-install.ps1

This causes the script to abort. What causes this and how can I solve it?

Answer 1

This problem seems to be an issue with Windows security rather than with DXA specifically. You can work around it by modifying the script as follows:

#Set folder permissions
Write-Host "Setting folder permissions on '$distDestination' ..."
$Acl = Get-Acl $distDestination
Set-Acl $distDestination $Acl
$Acl = Get-Acl $distDestination
$permission = "NetworkService" ,"FullControl","ContainerInherit,ObjectInherit","None","Allow"
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission    
$Acl.SetAccessRule($accessRule)
Set-Acl $distDestination $Acl

The point is that if you use the set-acl cmdlet to write back the ACL exactly as it's just been read, it will fix the ordering of the ACEs. If you do this before calling $Acl.SetAccessRule($accessRule) this call will succeed instead of throwing an exception.