Add-ReadAce.ps1

## Takes and ACL and SID, returns an ACL with the correct entry for read-only permissions added.
function Add-ReadAce {
    [OutputType([System.Security.AccessControl.FileSystemSecurity])]
    param(
        [Parameter(Mandatory=$true, ValueFromPipeline=$false)]
        [System.Security.Principal.IdentityReference]$SID,
        [Parameter(Mandatory=$true, ValueFromPipeline=$true, Position=0)]
        [System.Security.AccessControl.FileSystemSecurity]$ACL
        )

    # Rule applies to parent container, does not propagate
    $aclRights = [System.Security.AccessControl.FileSystemRights]"Traverse, ExecuteFile, ListDirectory, ReadData, ReadAttributes, ReadExtendedAttributes, ReadPermissions"
    $objectInherit = [System.Security.AccessControl.InheritanceFlags]"ContainerInherit, ObjectInherit"
    $PropagationFlag = [System.Security.AccessControl.PropagationFlags]::None
    $objType =[System.Security.AccessControl.AccessControlType]::Allow

    $readACE = New-Object System.Security.AccessControl.FileSystemAccessRule `
        ($SID, $aclRights, $objectInherit, $PropagationFlag, $objType)

    $ACL.AddAccessRule($readACE)

    return $ACL
}