The script can be used in business rules, scheduled tasks and custom commands to disallow users to change permissions on their home folders.
PowerShell
# Get home directory folder
try
{
$homeFolder = $Context.TargetObject.Get("homeDirectory")
}
catch
{
$Context.LogMessage("The user does not have a home directory.", "Warning") # TODO: modify me
return
}
# Get the user's SID
$userSidBinary = $Context.TargetObject.Get("objectSid")
$userSid = New-Object System.Security.Principal.SecurityIdentifier($userSidBinary, 0)
# Deny the permission to change security for the home folder
$homeFolderACL = Get-Acl $homeFolder
$acl = New-Object System.Security.AccessControl.FileSystemAccessRule($userSid,"ChangePermissions","ContainerInherit,ObjectInherit","None","Deny")
$homeFolderACL.AddAccessRule($acl)
Set-Acl -path $homeFolder $homeFolderACL