Cleanly setting ACLs So this is my full script that I've been working on. My plan is to Create New, Folder, Create AD Group FS-TESTSHARE-R, Create AD Group FS-TESTSHARE-RW, Apply Both groups to the new share folder, Set Full Read permissions to FS-TESTSHARE-R, Set Full Read/Rights permissions to FS-TESTSHARE-RW, and Set full access permissions to Domain Admins and local Administrators. 

I'm Pretty sure I have all of the syntax correct now (thanks to some awesome assistance I've received here), but I was hoping for some clarification on setting ACLs. 

At the bottom I've redone how I was attempting to get, create, and set the ACLs Thanks to @themadtechnician), but I was curious as to if I've got all syntax correct or if I should create the set for each of the $objUser instead of putting them all in parentheses (is this the cleanest way to do this)... 

$Parent = read-host -prompt "Enter full parent path that will contain the new folder (ie. \\eccofs01\Groups\ECCO IT\)"
$Name = read-host -prompt "Enter New Folder Name."
$Path = "$($parent)$($Name)"
$Location = read-host -prompt "Enter the AD Security Group Location (i.e. Global, Americas, Europe, Asia Pacific)"

Import-Module ActiveDirectory

#Create Security Groups
$GroupParams1= @{
    'Name' = "FS-$NAME-RW" 
    'SamAccountName' = "FS-$NAME-RW" 
    'GroupCategory' = "Security"
    'GroupScope' = "Global"
    'DisplayName' = "$NAME Read-Write Access"
    'Path' = "CN=$LOCATION,CN=SECURITY GROUPS,CN=FILE SHARE GROUPS,DC=ESG,DC=INTL"
    'Description' = "Members of this group have read-write access to $Path."
}

New-ADGroup @GroupParams1

$GroupParams2= @{
    'Name' = "FS-$NAME-R" 
    'SamAccountName' = "FS-$NAME-R" 
    'GroupCategory' = "Security"
    'GroupScope' = "Global"
    'DisplayName' = "$NAME Read-Write Access"
    'Path' = "CN=$LOCATION,CN=SECURITY GROUPS,CN=FILE SHARE GROUPS,DC=ESG,DC=INTL"
    'Description' = "Members of this group have read access to $Path"
}

New-ADGroup @GroupParams2

# Create New Folder
New-Item -Path $Path -ItemType Directory


#Set Full Control Permissions
$Rights = [System.Security.AccessControl.FileSystemRights]"FullControl" 

$InheritanceFlag = [System.Security.AccessControl.InheritanceFlags]"ObjectInherit,ContainerInherit"
$PropagationFlag = [System.Security.AccessControl.PropagationFlags]::None 

$objType =[System.Security.AccessControl.AccessControlType]::Allow 

$objUser = New-Object System.Security.Principal.NTAccount("Administrators","esg.intl\Domain Admins","esg.intl\FS-$NAME-RW") 

$objACE = New-Object System.Security.AccessControl.FileSystemAccessRule($objUser, $Rights, $InheritanceFlag, $PropagationFlag, $objType) 

$objACL = Get-ACL $Path

$objACL.AddAccessRule($objACE) 

Set-ACL $Path $objACL


#Set Read and Execute Permissions
$Rights = [System.Security.AccessControl.FileSystemRights]"ReadAndExecute" 

$InheritanceFlag = [System.Security.AccessControl.InheritanceFlags]"ObjectInherit,ContainerInherit"
$PropagationFlag = [System.Security.AccessControl.PropagationFlags]::None 

$objType =[System.Security.AccessControl.AccessControlType]::Allow 

$objUser = New-Object System.Security.Principal.NTAccount("esg.intl\FS-$NAME-R") 

$objACE = New-Object System.Security.AccessControl.FileSystemAccessRule($objUser, $Rights, $InheritanceFlag, $PropagationFlag, $objType) 

$objACL = Get-ACL $Path

$objACL.AddAccessRule($objACE) 

Set-ACL $Path $objACL
To streamline the permission handling you may want to wrap ACE creation in a function and set the ACL just once at after all ACEs were added:

function New-Ace {
  [CmdletBinding()]
  Param(
    [Parameter(Mandatory=$true, Position=0)]
    [Security.Principal.NTAccount]$Account,
    [Parameter(Mandatory=$false, Position=1)]
    [Security.AccessControl.FileSystemRights]$Permissions = 'ReadAndExecute',
    [Parameter(Mandatory=$false, Position=2)]
    [Security.AccessControl.InheritanceFlags]$InheritanceFlags = 'ContainerInherit,ObjectInherit',
    [Parameter(Mandatory=$false, Position=3)]
    [Security.AccessControl.PropagationFlags]$PropagationFlags = 'None',
    [Parameter(Mandatory=$false, Position=4)]
    [Security.AccessControl.AccessControlType]$Type = 'Allow'
  )

  New-Object Security.AccessControl.FileSystemAccessRule(
    $Account, $Permissions, $InheritanceFlags, $PropagationFlags, $Type
  )
}

$domain = 'DOMAIN'

$acl = Get-Acl $path

'Administrators', "$domain\Domain Admins" | ForEach-Object {
  $acl.AddAccessRule((New-Ace $_ 'FullControl'))
}
$acl.AddAccessRule((New-Ace "$domain\FS-$NAME-RW" 'Modify'))
$acl.AddAccessRule((New-Ace "$domain\FS-$NAME-R" 'ReadAndExecute'))

Set-Acl $path $acl


Other improvements might include determining the administrators and domain admins group names independent of the system's locale by their well-known SIDs, e.g.:

$administrators = ([wmi]"Win32_Sid.Sid='S-1-5-32-544'").AccountName

$domain_admins  = Get-WmiObject -Class Win32_Account |
                  Where-Object { $_.SID -like '*-512' } |
                  Select-Object -Expand Caption


Another thing you could do is map names to permissions like this:

$permissions = @{
  'Administrators'        = 'FullControl'
  "$domain\Domain Admins" = 'FullControl'
  "$domain\FS-$NAME-RW"   = 'Modify'
  "$domain\FS-$NAME-R"    = 'ReadAndExecute'
}


and use the hashtable as input for the ACE creation:

$permissions.Keys | ForEach-Object {
  $acl.AddAccessRule((New-Ace $_ $permissions[$_]))
}


Of course this implies that all ACEs have the same type and flags, otherwise you'd have to use a more elaborate data structure.