User folder and permissions PowerShell Script

[ButlerKevinD]

Greetings all.

This is my first foray into writing PowerShell scripts. Currently, I am attempting to compile a script that will:

1. Search a specific OU containing user accounts in AD and dump the SAMAccountname field into a text file.

2. Read the contents of said text file and create folders based upon those names in a specific folder location.

3. And then assign Full Control permissions to the folder name based upon the SAMAccountname.

Thus far, I have the first third of my aforementioned actions working. The last portion that assigns the permissions to the folders based upon the SAMAccountname continues to fail miserably. (NOTE: I have taken some snippets from people attempting the same ordeal but they reported success in their endeavor, unlike myself)

As time permits, I would appreciate comments and/or solutions to my issue at hand. I am attaching my script code below. As much as I hate to admit it, its probably something simple, yet I am still missing the forest for the trees. Thanks in advance for any assistance.

Powershell

#

# Get the user account SAMAccount names from specific OU and dump into text file

#

Get-ADUser -filter * -SearchBase "ou=KDBDOM Users,dc=ad,dc=kdbdom,dc=us" | Select sAMAccountName > c:\Test\kdbdom.txt

#

# Pull user SAMAccount names from text file and create associated folder.

#

$users = Get-Content "C:\Test\kdbdom.txt"

#

# Create folders for each user in text file and assign permissions

#

ForEach($user in $users)

{

$newPath = Join-Path "c:\Test" -childpath $user

New-Item $newPath -type directory -Force

 

$acl = Get-Acl $newpath

$permission = "KDBDOM\$user","FullControl","Allow"

$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission

$acl.SetAccessRule($accessRule)

$acl | Set-Acl $newpath

}

[Jamo]

Note i haven't tested the script below!!!

 

 

In powershell though you can use variables to collect the output of commands, I think its so much clearer to read

 

$userroot = "C:\Test"

$users = Get-ADUser -filter * -SearchBase "ou=KDBDOM Users,dc=ad,dc=kdbdom,dc=us"

 

 

ForEach ($user in $users)

{

$path = Join-Path $userroot -childpath $user.sAMAccountName

New-Item $path -type directory -force

 

 

...

}

 

 

 

 

 

I've not done the acl part before using powershell though... but try this... again not tested

 

 

 

$rule=new-object System.Security.AccessControl.FileSystemAccessRule ("KDBDOM\$user","FullControl","Allow")

$acl = Get-Acl $path

 

 

$acl.SetAccessRule($acl)

Set-ACL -Path $path -AclObject $acl

 

 

 

 

[ButlerKevinD]

James,

 

I was able to solicit assistance from user "cduff" on the SpiceWorks forums. Here is the modified code that is operating without errors:

 

#

# Get the user account SAMAccount names from specific OU and dump into text file

#

# Get-ADUser -filter * -SearchBase "ou=KDBDOM Users,dc=ad,dc=kdbdom,dc=us" | Select sAMAccountName > c:\Test\kdbdom.txt

#

Get-ADUser -filter * -SearchBase "ou=KDBDOM Users,dc=ad,dc=kdbdom,dc=us" | Select-Object -ExpandProperty sAMAccountName > c:\Test\kdbdom.txt

#

# Pull user SAMAccount names from text file and create associated folder.

#

$users = Get-Content "C:\Test\kdbdom.txt"

#

# Create folders for each user in text file based upon sAMAccountName flag on User Object

#

ForEach($user in $users)

{

$newPath = Join-Path "c:\Test" -childpath $user

New-Item $newPath -type directory -Force

# Assign Full Control permissions to new folders created by sAMAccountName flag on User Object

$acl = (Get-Item $newpath).GetAccessControl('Access')

$permission = "KDBDOM\$user","FullControl",@("ContainerInherit","ObjectInherit"),"None","Allow"

$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission

$acl.SetAccessRule($accessRule)

$acl | Set-Acl $newpath

}

The fixes for my initial code were:

 

[h=5]cduff Jun 30, 2016 at 12:39 PM

[/h]This issue with the permissions is that you are using the three parameter version of FileSystemAccessRule, you want to use the five parameter version: https://msdn.microsoft.com/en-us/library/sfe70whw(v=vs.110).aspx

Powershell

$permission = "KDBDOM\$user","FullControl",@("ContainerInherit","ObjectInherit"),"None","Allow"

 

 

The three parameter version doesn't give you the typical default of Applies To: This folder, subfolders and files.

 

And

 

[h=5]cduff Jun 30, 2016 at 12:44 PM

[/h]As an alternate, you can grant the permissions with icacls from within powershell.

Also, there is no need to have an intermediary text file, you can populate the loop directly.

Powershell

$users = Get-ADUser -filter * -SearchBase "ou=KDBDOM Users,dc=ad,dc=kdbdom,dc=us" |

Select-Object -ExpandProperty sAMAccountName

ForEach($user in $users)

 

 

Also, the way you have the Select will put a header in the outputted text file that you are reading back in, so what you have should be creating a folder called SamAccountName, right. That can be avoided by using -ExpandProperty.

 

and lastly:

 

[h=5]cduff Jun 30, 2016 at 12:56 PM

[/h]Another thing I see that I've ran into is that there are some permissions stripped out in even an elevated powershell that are required to set an owner on local drives. (I think I've got that right)

So sometimes you have to get the ACL, sans owner:

Powershell

$acl = (Get-Item $newitem).GetAccessControl('Access')

 

 

 

[Arthur]

#

Get-ADUser -filter * -SearchBase "ou=KDBDOM Users,dc=ad,dc=kdbdom,dc=us" | Select-Object -ExpandProperty sAMAccountName > c:\Test\kdbdom.txt

#

# Pull user SAMAccount names from text file and create associated folder.

#

$users = Get-Content "C:\Test\kdbdom.txt"

For future reference what you have done above is incredibly bizarre. There isn't ANY need to export the sAMAccountName to a text file beforehand because the user data can be stored in a variable in memory (as @Jamo has shown in his script above).

[ButlerKevinD]

Arthur,

 

I am completely new at PowerShell scripting. This is my initial foray into the subject. I should hope as time progresses my understanding and skills will increase and reflect a more streamlined approach to the topic at hand.