ProfileACLManagement.ps1

<#
.Synopsis
   Checks a given Profile Path for correct user ACL and ownership.
.DESCRIPTION
   Checks a given Profile Path for correct user ACL and ownership and returns a boolean return value.
.EXAMPLE
   PS> Check-ProfileACL -ProfilePath E:\Profiles\Alice.V6 -User contoso\alice

   Evaluates ownership of "E:\Profiles\Alice.V6" (should be "BUILTIN\Administrators") and full control permissions for contoso\alice.
.EXAMPLE
   PS> Check-ProfileACL -ProfilePath E:\Profiles\Alice.V6 -User contoso\alice -OSLanguage DE

   Evaluates ownership of "E:\Profiles\Alice.V6" (should be "VORDEFINIERT\Administratoren") and full control permissions for contoso\alice.
#>
function Check-ProfileACL
{
    [CmdletBinding()]
	param (
        [Parameter(Mandatory=$true)]
		[System.IO.DirectoryInfo]$ProfileItem,

        [Parameter(Mandatory=$true)]
		[String]$User,

        [Parameter(Mandatory=$false)]
        [ValidateSet("EN","DE")]
        [String]$OSLanguage = "EN"
	)
	
    begin {
        switch ($OSLanguage) {
            "EN" {
                $adminGroupName = "BUILTIN\Administrators"
            }
            "DE" {
                $adminGroupName = "VORDEFINIERT\Administratoren"
            }
        }
    }

    process {
	    $aclObj = Get-Acl $ProfileItem
	    $userAccessRule = $aclObj.Access | Where-Object {$_.FileSystemRights -eq "FullControl" -and $_.IdentityReference -eq $User}
	
	    if ( $aclObj.Owner -eq $adminGroupName -and $userAccessRule )
	    {
		    return $true
	    }
	    else
	    {
		    return $false
	    }
    }
}

<#
.Synopsis
    Sets correct permissions and ownership for a given Profile Path and user.
.DESCRIPTION
    Sets correct permissions and ownership for a given Profile Path and user.
.EXAMPLE
    PS> Set-ProfileACL -ProfilePath E:\Profiles\Alice.V6 -User contoso\alice

    Sets owner "BUILTIN\Administrators" and full control permissions for "contoso\alice" on E:\Profiles\Alice.V6.
.EXAMPLE
    PS> Set-ProfileACL -ProfilePath E:\Profiles\Alice.V6 -User contoso\alice -OSLanguage DE

    Sets owner "VORDEFINIERT\Administratoren" and full control permissions for "contoso\alice" on E:\Profiles\Alice.V6.
#>
function Set-ProfileACL
{
    [CmdletBinding()]
	param (
        [Parameter(Mandatory=$true)]
		[System.IO.DirectoryInfo]$ProfileItem,

        [Parameter(Mandatory=$true)]
		[String]$User,

        [Parameter(Mandatory=$false)]
        [ValidateSet("EN","DE")]
        [String]$OSLanguage = "EN"
	)
	
    begin {
        switch ($OSLanguage) {
            "EN" {
                $adminGroupName = "Administrators"
            }
            "DE" {
                $adminGroupName = "Administratoren"
            }
        }
    }
	
    process {
	    $aclObj = Get-Acl $ProfileItem
	
	    [System.Security.Principal.NTAccount]$newOwner = $adminGroupName
	
	    $userpermissions = New-Object System.Security.AccessControl.FileSystemAccessRule($User,“FullControl”, “ContainerInherit, ObjectInherit”, “None”, “Allow”)
	    $aclObj.AddAccessRule($userpermissions) | Out-Null
	
	    $aclObj.SetOwner($newOwner)
	
	    Set-Acl $ProfileItem $aclObj
    }
}