Pulling ACL for Permission Auditing

[tommygee]

I am trying to simplify pulling directory ACLs. We have thousands of them and so I'd like to adjust this script I have so that it asks me what directory I'd like to check the ACLs for. Where it stands now the script must be edited manually when you run it on each machine. You have to change the directory name. So I'd like to turn the directory name in a variable and put the variable in the folder path. I appreciate the help as it will save so much time for me. It exports it to a .csv file where I can then import it into Excel and sort the tables accordingly.

 

Here is what I have:

 

powershell C:\GetDirectoryACls\GetDirectoryACLs.ps1

Get-childitem D:\Inetpub -recurse | where{$_.psiscontainer} |

Get-Acl | % {

$path = $_.Path

$_.Access | % {

New-Object PSObject -Property @{

Folder = $path.Replace("Microsoft.PowerShell.Core\FileSystem::","")

Access = $_.FileSystemRights

Control = $_.AccessControlType

User = $_.IdentityReference

Inheritance = $_.IsInherited

}

}

} | ? {-not $_.Inheritance} | export-csv C:\GetDirectoryACLs\Get_Directory_ACLs_Output.csv -force

[halbaradkenafin]

Setting a parameter like this should do it. That way you can either call the script and add the -path to the end of it or call it and it will ask for the path.

 

[color=#333333]param($FolderPath = $(Read-Host "Enter path"))[/color]
[color=#333333]Get-childitem $FolderPath -recurse | where{$_.psiscontainer} |[/color]
[color=#333333]Get-Acl | % {[/color]
[color=#333333]$path = $_.Path[/color]
[color=#333333]$_.Access | % {[/color]
[color=#333333]New-Object PSObject -Property @{[/color]
[color=#333333]Folder = $path.Replace("Microsoft.PowerShell.Core\FileSyste m::","")[/color]
[color=#333333]Access = $_.FileSystemRights[/color]
[color=#333333]Control = $_.AccessControlType[/color]
[color=#333333]User = $_.IdentityReference[/color]
[color=#333333]Inheritance = $_.IsInherited[/color]
[color=#333333]}[/color]
[color=#333333]}[/color]
[color=#333333]} | ? {-not $_.Inheritance} | export-csv C:\GetDirectoryACLs\Get_Directory_ACLs_Output.csv -force

[/color]

[Arthur]

I would go one stage further than @halbaradkenafin and turn the script into a proper PowerShell function.

 

function Get-DirectoryACLs
{
<#
.SYNOPSIS
   Get ACLs of the specified folder

.PARAMETER Path
   The path to the folder that you want to get the ACLs of

.EXAMPLE
   Get-DirectoryACLs -Path "C:\Users" | Export-CSV C:\Output.csv -Force
#>

[CmdletBinding()]
param(
   [Parameter(Mandatory=$true,
              HelpMessage="Enter a folder path")]
   [ValidateNotNullOrEmpty()]
   [string]$Path
)
   Get-ChildItem $Path -Directory -Recurse | Get-Acl | ForEach {
       $Path = $_.Path
       $_.Access | ForEach {
           New-Object PSObject -Property @{
               Folder      = $Path.Replace("Microsoft.PowerShell.Core\FileSystem::","")
               Access      = $_.FileSystemRights
               Control     = $_.AccessControlType
               User        = $_.IdentityReference
               Inheritance = $_.IsInherited
           }
       }
   } | Where {-not $_.Inheritance}
}

 

You could then add the function to your PowerShell profile (directly or by "dot sourcing" the .ps1 script) and whenever you open PowerShell you will be able to use the function to either display the ACLs on screen or (optionally) export them to a CSV file without having to edit the script. e.g.

 

Get-DirectoryACLs -Path C:\Users

 

Get-DirectoryACLs -Path C:\Users | Export-CSV C:\Output.csv -Force

Edited August 14, 2015 by Arthur

[tommygee]

I made this so that it could be imported into an Excel CSV file. During the import the first row can be removed. Once its imported and inside the spreadsheet one may sort the table accordingly and shift from view to view showing the groups and users who have access as well as the level of access. I got it accomplished with this:

 

 

 

$directory = Read-Host 'Which directory would you like me to retrieve the ACL from?'

 

Write-Host " "

Write-Host "The ACL of your directory will be saved in Get_Directory_ACL_Output.csv on Local Disk (C:\)."

Write-Host " "

Write-Host "Press any key to continue ..."

 

$x = $host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")

 

Get-childitem $directory -recurse | where{$_.psiscontainer} |

 

Get-Acl | % {

$path = $_.Path

$_.Access | % {

New-Object PSObject -Property @{

Folder = $path.Replace("Microsoft.PowerShell.Core\FileSystem::","")

Access = $_.FileSystemRights

Control = $_.AccessControlType

User = $_.IdentityReference

Inheritance = $_.IsInherited

 

}

}

} | ? {-not $_.Inheritance} | export-csv C:\Get_Directory_ACL_Output.csv -force

 

 

It pulls generic permissions in a number format. These permissions are below:

 

-1610612736 GENERIC_EXECUTE

–536805376 Modify_Synchronize

268435456 Modify_Synchrronize

Edited August 25, 2015 by tommygee