[PowerShell] Permissions per folder

[LinkZ]

I'm trying to setup some folders for our students to use, i've made the beginning of the script just fine which takes a list of users from an AD group then creates a folder for them based on their username:

 

$Users = Get-ADGroupMember -Identity "MultimediaWork"

cd \\server\MultimediaWork$
mkdir $Users.name

 

From there I want to apply permissions to each folder so that the user that corresponds to that folder has full access to it (So for a user called bsmith15 I want him to have full access to the folder \\server\MultimediaWork$\bsmith15) I can do this on an individual basis using the Add-NTFSAccess command from the module https://gallery.technet.microsoft.com/scriptcenter/1abd77a5-9c0b-4a2b-acef-90dbb2b84e85 by running:

 

Add-NTFSAccess -Path '\\server\MultimediaWork$\bsmith15' -Account domain\bsmith15 -AccessRights FullControl

 

Or I can apply permissions for one user to all the folders by running:

 

Get-ChildItem | Add-NTFSAccess -Account domain\bsmith15 -AccessRights FullControl

 

I can't however figure out how to apply the permissions to each folder based on the username of the account that should be associated with it.

[halbaradkenafin]

I've got a similar script which takes all the userfolders in a share and then applies the named users permissions to that folder and forces inheritance. I adapted it from a few other scripts I found after we had some issues following a migration. It loops over all the folders (actually all the items but the -Directory or something flag for Get-ChildItem will mean it ignores all the normal files in that area) in a directory.

 

# Get all the child folders in the share
$Folders = Get-childItem ""


# Set Inheritance flags etc
$InheritanceFlag = [system.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor [system.Security.AccessControl.InheritanceFlags]::ObjectInherit
$PropagationFlag = [system.Security.AccessControl.PropagationFlags]::None
$objType = [system.Security.AccessControl.AccessControlType]::Allow 


# Loop over each folder in directory
foreach ($TempFolder in $Folders)
{
# Get full path and username
echo "Loop Iteration"
$Folder = $TempFolder.FullName
$UserFolder = $TempFolder


# create ACL for named user and apply correct flags
$acl = Get-Acl $Folder
echo $UserFolder
$permission = "\$UserFolder","FullControl", $InheritanceFlag, $PropagationFlag, $objType
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission

# Apply ACL to folder
$acl.SetAccessRule($accessRule)
Set-Acl $Folder $acl
}

 

You can probably use the Add-NTFSAccess cmdlet you've used already and just swap things around a little, I used this method as I didn't find that module so I might rework the code and give it a try using that module.

[LinkZ]

That's great, thank you very much. Here's the script i've made based on yours:

 

<# This relies on an extra module referenced in
http://blogs.technet.com/b/heyscriptingguy/archive/2014/11/22/weekend-scripter-use-powershell-to-get-add-and-remove-ntfs-permissions.aspx
https://gallery.technet.microsoft.com/scriptcenter/1abd77a5-9c0b-4a2b-acef-90dbb2b84e85
#>

#Get a list of users
$Users = Get-ADGroupMember -Identity ""

#Create a folder for each user using their username as the folder name
cd 
mkdir $Users.name

#Grab a list of folders created then for each folder set the permissions
$UserFolders = Get-ChildItem 
foreach ($Item in $UserFolders)
{
   $FolderPath = "\$Item"
   $Permission = "\$Item"
   Add-NTFSAccess -Path $FolderPath -Account $Permission -AccessRights FullControl
}

[Garacesh]

If you don't want to use custom modules I've (completely coincidentally) crafted something similar recently..

 

$ACL = (Get-ACL -Path [b]Path_To_Folder[/b])
$FullControlAccessRule = (New-Object System.Security.AccessControl.FileSystemAccessRule([system.Security.Principal.NTAccount]"[b]Domain\Username[/b]","FullControl", "ContainerInherit, ObjectInherit", "None", "Allow"))
$ACL.AddAccessRule($FullControlAccessRule)
Set-ACL -Path [b]Path_To_Folder[/b] $ACL

 

This does not work for changing ownership. You can use $ACL.SetOwner([system.Security.Principal.NTAccount]"Domain\Username") to change the owner but it won't let you push the ACL rule back to the file if you do that (Returns Set-ACL : The security identifier is not allowed to be the owner of this object. but maybe you can find a way around that)

 

There are lots of different access rules you can apply, this example here I've used for student home folders. Can find you more info if you need it.