Powershell script to iterate through directory and add permission to specific folders

[Bedders]

Hi all,

 

Very new to Powershell (today, in fact!) and having some trouble with a script I'm working on.

 

Now, I do know that I could have had this done manually in a much shorter time - but where's the fun in that?

 

The Problem

I have a directory, inside which is a load of other folders. The staff member needs to have Read&Execute access to the root directory (to view the folders that they can access), and specific folders, but no access to the others. The root directory is a shared folder.

 

What I have so far:

 

### The root directory containing all of the folders
$directory = Get-ChildItem "D:\"

###  @edugeek: Not sure if this needs to be their logon name? #################
$username = "USERNAME"

### The permissions to apply to this user
$permissionsToApply = "ReadAndExecute"

### The list of folders that the user needs specific access to, comma separated
$foldersToBeGivenPermissions = "TestFolder"

### DO NOT MODIFY BELOW THIS LINE
$accessRule = New-Object system.security.accesscontrol.filesystemaccessrule($username, $permissionsToApply, "None", "None", "Allow")
foreach ($folder in $directory) {
   $foldername = $folder.name
     switch ($foldersToBeGivenPermissions) {
        $foldername {$accessRule}
     }
 }

 

However nothing seems to change when I run this. Obviously I'm running it on my machine locally first to test it.

 

My question is: Does the $username need to be something different, or will it take the user's Active Directory login name? Do I need to put the domain in there also?

Am I missing something else crucial?

 

Many thanks to any and all kind folks out there who can help me out

Edited March 7, 2017 by Bedders

[admars]

I think $username needs to be AD SAMAccountName

(I'm new to powershell as well so this is interesting )

Edited March 7, 2017 by admars

[Bedders]

I think $username needs to be AD SAMAccountName

(I'm new to powershell as well so this is interesting )

 

I read that edit after I've done some research into SAMAccountName.

 

I've tried "Firstname Surname", "Logonname", "[email protected]", "domain\Logonname" all with no permissions being applied. I'm beginning to think it's the $permissionsToApply section that isn't correct.

[pleach85]

I would do it like this...

 

### A list of child items in the directory
$directory = Get-ChildItem "D:\"

### @edugeek: Not sure if this needs to be their logon name? #################
$username = "domain\username"

### The permissions to apply to this user
$permissionsToApply = "ReadAndExecute"

### an array of the folders that need these permissions
$foldersToBeGivenPermissions = @("TestFolder")


#Make the access Rule
$accessRule = New-Object system.security.accesscontrol.filesystemaccessrule($username, $permissionsToApply, "None", "None", "Allow")

foreach ($folder in $directory) {

#check if the foldername is in the array $foldersToBeGivenPermissions
   if($foldersToBeGivenPermissions.Contains($folder.name))
   {
       #If it is set the permissions on the parent folder and then the actual folder
       SetPermissions $folder.Parent.FullName $accessRule
       SetPermissions $folder.FullName $accessRule
   }

}


#Reuseable function that takes a folder/file path and a new access rule and adds the rule to the folder
function SetPermissions ($path,$ACLRule)
{
       #get current permissions
       $folderACL = Get-Acl($path)

       #add new permission to this list
       $folderACL.AddAccessRule($ACLRule)

       #set the permissions on the folder
       Set-Acl $path $folderACL
}

 

I've commented it so hopefully you should be able to follow it through and see what it's doing.

[Bedders]

I would do it like this...

 

 

I've commented it so hopefully you should be able to follow it through and see what it's doing.

 

Wow pleach, many thanks - worked almost perfectly! I had to change the line if($foldersToBeGivenPermissions.Contains($folder.name)) to if($foldersToBeGivenPermissions - contains $folder.name) for it to work - "The error was Method invocation failed because [system.Object[]] doesn't contain a method named 'Contains'." was the error that I was getting, apparently something about only having one object in an array and powershell takes it out of being an array?

You're amazing! And thanks to admars too for the assistance!

[pleach85]

No problem glad it helped.

 

I think that error is possibly down to the version of powershell you're running it works in version 5 but I'm not sure when they brought in .contains as an array method.

[Bedders]

No problem glad it helped.

 

I think that error is possibly down to the version of powershell you're running it works in version 5 but I'm not sure when they brought in .contains as an array method.

 

I have no idea what version I'm running! I've also had to move the SetPermissions function above the IF statement, as it couldn't see it. This only occurred after I added a prompt to press any key to continue at the end. Anyways, thanks again!