title: Powershell AddAccessRule without clearing existing
body: <p>I'm just starting to learn PowerShell and I've been playing with adding security groups to folders using the .FileSystemAccessRule, .AddAccessRule(rule), and finally Set-ACL  .</p>
  
  <p>I can iterate through the acl objects and find that they indeed match the existing (security) items I see through the Folder->Properties->Security Tab.</p>
  
  <p>As part of my script, I'm ensuring that the security group is removed if it was already assigned (this is to ensure that proper security and inheritance is maintained).  That is all working properly.</p>
  
  <p>This is where I'm getting stuck - assigning two groups to the folder (an "owner' and a "read-only" group). My goal was to leave ALL existing rights assignments in place and just add these three new groups and their associated rights.  What is occurring is that all the existing groups are no longer there after the final "Set-Acl  " executes.  Because nobody is assigned to the owner groups yet, no further tasks can be performed (as I've lost access because the group I belong to is no longer listed as having access).</p>
  
  <p><em>------------------------------- code I have ---------------------------------</em></p>
  
  <pre><code>  #add the 2 groups to the folder 
  
    $acl = Get-Acl $folderPath
    $acl.SetAccessRuleProtection($True, $False)
  
    #add security group for Owners of this folder and all children
    $ruleOwner = New-Object System.Security.AccessControl.FileSystemAccessRule("$domain\$grpOwner","Modify", "ContainerInherit, ObjectInherit", "None", "Allow")
    $acl.AddAccessRule($ruleOwner)
  
    #add security group for Read-Only of this folder and all children
    $ruleReadOnly = New-Object System.Security.AccessControl.FileSystemAccessRule("$domain\$grpReadOnly","ReadAndExecute", "ContainerInherit, ObjectInherit", "None", "Allow")
    $acl.AddAccessRule($ruleReadOnly)
  
    Set-Acl $folderPath $acl
  </code></pre>
  
  <p>Is this supposed to remove the existing acl settings and update the folder with a new version (that hasn't had the existing groups/users added)?  The way I've read how .AddAccessRule works is that it is indeed additive and should leave the other, existing, groups alone.  I do verify that the $acl had all the groups present (using a different window during break mode before the Set-Acl cmdlet is executed).</p>
  
  <p>Thank you for any ideas, it's appreciated.</p>