title: Setting NTFS rights via P/S and getting Canonical Form error
body: <p>I have a PowerShell script to set up a user's folders with NTFS, Sharing and DFS.  All of it works, however I get this message when setting the NTFS rights.</p>
  <p>Exception calling &quot;SetAccessRule&quot; with &quot;1&quot; argument(s): &quot;This access control list is not in canonical form and therefore cannot be modified.&quot;
  At C:\Users\Public\Documents\Scripts\Add-UserFolders.ps1:53 char:1</p>
  <p>Code looks like this:</p>
  <pre><code># NTFS Rights
  $Acl = (Get-Item $UserFolder).GetAccessControl('Access')
  $Ar = New-Object System.Security.AccessControl.FileSystemAccessRule($Username, 'Modify', 'ContainerInherit,ObjectInherit', 'None', 'Allow')
  $Acl.SetAccessRule($Ar)
  Set-Acl -path $UserFolder -AclObject $Acl
  
  $Acl = (Get-Item $ScanFolder).GetAccessControl('Access')
  $Ar = New-Object System.Security.AccessControl.FileSystemAccessRule($Username, 'Modify', 'ContainerInherit,ObjectInherit', 'None', 'Allow')
  $Acl.SetAccessRule($Ar)
  Set-Acl -path $ScanFolder -AclObject $Acl
  </code></pre>
  <p>My issue is the the first code block throws the error but the second code block does not even though the format is the same.  Running icacls Path\to\folder -verify show no error and the ACL is not modified to add the user object.</p>