Performance Management (Shared Folders vs. Purchased Software).

[Koldov]

Today the SLT have informed me that to save costs, the expensive 'Performance Management' Software they purchased last year has been deemed clunky, generally difficult to navigate and has remained largely unused...

 

They have decided to do it in-house and require me to create folders on the server for each member of staff, then access to the individual staff member and the person who is doing the assessment (4 department heads and admin only able to view their respective staff's folders etc.), with the Headmaster having visibility of all staff folders.

 

I can see this being a permissions nightmare (is security groups the way to go?) and a shared drive mapping/access issue!

 

Obviously I will plough through it during the Summer holidays, but if anyone has a quicker/better way to do all this please let me know!

Edited July 3, 2019 by Koldov

[FishCustard]

I'd use some PowerShell scripting to do this. Get SLT to give you a list of staff and their appraiser. Put that info into AD (use the "manager" attribute perhaps?), then script the permissions based on that.

[strawberry]

Wisesoft NTFSfix is the answer to this. Create folders per LM, then create folders per person. Then set nfts perms on the LM level for LM and %username%

[3s-gtech]

Yup - if you set the names of the folders to their AD account names then NTFSFix will eat this job. It’s how I set our new intake home folder permissions.

[noelmm]

I've used PowerShell for something similar for our DT department in the past. The way the DT dept. wanted it was each student had a folder with full permission, certain staff members had full permission and anyone else had no permission so were unable to access it, it worked well and took about an hour to do and I'm not great with PowerShell. I also disabled inheritance from parent folders in the script. Edited July 3, 2019 by noelmm

[keyboards]

I'd steer away from shared folders as much as possible, we've had nothing but problems with it, that maybe due though to some of the length of these folders ie z/z/z/z/z/z/z/z/zz/z/z/z/z/z/z/z/z/z/z/z/z/z/z/z/ or something ridiculous

 

Also we started off with x member of staff and slt being able to see folders then that soon unfolded and we ended up with permissions everywhere and all over the place

[dhicks]

They have decided to do it in-house and require me to create folders on the server for each member of staff, then access to the individual staff member and the person who is doing the assessment (4 department heads and admin only able to view their respective staff's folders etc.), with the Headmaster having visibility of all staff folders.

 

Where is that information stored - does your MIS hold information as to who is whos department head, or is that something you'll need to enter yourself? I'd aim to have a script extract the relvant data from your MIS (list of staff, along with data as to who their department head / assesor is), then have the script create appropriate folders. I'd do this on Google Drive via GAM, but that depends on what your particular school uses.

[Koldov]

Ok, so I'm stuck on the first hurdle...

 

As my scripting skill is non-existent, I have forgone trying to tap into AD or our MIS and I Googled a basic, quick and easy folder creation script...

 

I had a .csv with all the names of the staff (each on a seperate line) under a column header called 'Name' and I created the folder "Performance Management Staff Folders"...

 

So I ran this:

 

# location where the subfolders will be created
Set-Location "E:\Staff$\Performance Management Staff Folders"

# csv file with folder names
$Folders = Import-Csv c:\staff.csv 

ForEach ($Folder in $Folders) { 
New-Item $Folder.name -itemtype directory 
}

 

It didn't work on the server...

 

Now, this could be a permissions issue for the destination folder (what does it need SYSTEM?) as it worked on my own work PC... Or it could be a Powershell version issue.... Or...?

 

In Powershell it just hangs....

 

In Powershell_ISE it gives me this:

 

[HPlum78]

import-csv 'Z:\My Documents\Powershell\Misc Scripting Bits\names.csv' -OutVariable Fldr

set-location 'Z:\My Documents\Powershell\Misc Scripting Bits\Folder creation Demo\'

$Fldr.names | %{
   new-item -name $_ -ItemType Directory

}

 

CSV looks like:-

 

Names

Harry Plum

Isla Plum

Michelle Plum

Edith Plum

Joel Plum

 

Just looking at the error message the following is your initial code working:-

 

ForEach ($folder in $Folders) { 

New-Item -name $folder.Names -itemtype directory 
}

 

seems at first glance to be something to do with what is on/ expected on the pipe.

 

If this is indeed the solution you go with I would add it to your identity management solution joiners process so that when your HR department create the record for a new member of staff then the folder creation is taken care of. This could also help you set the correct permission on the folders, as you could pull out the direct reports to from your HR system and use this information to manage those. While you are at it you could also pull out the department/ organisational unit from the HR system and put the next level of permissions on the folders as well.

Edited July 4, 2019 by HPlum78

[noelmm]

This is the script I used to create folders and set permissions, not sure if it's what you want though.

 

$Folders = Import-Csv "csv file name and location e.g. \\computername\folder\"  
#Change this file path to location of CSV to be used


ForEach ($Folder in $Folders)

{
   
   # These are the variables used when assigning permissions.  The usernames are read from the CSV.
   $Username = $Folder.Username
   $Staff1 = $Folder.Staff1
   $Staff2 = $Folder.Staff2
   $Staff3 = $Folder.Staff3
   $Staff4 = $Folder.Staff4
   $Staff5 = $Folder.Staff5
   $Staff6 = $Folder.Staff6
   $Staff7 = $Folder.Staff7


   $Drive = "\\computername\parentfolder"
   # This is the path of the folders to be created


        
   New-Item -Name $Username -ItemType directory -Path $Drive 
   # Change this path to file path to be used e.g. "\\servername\sharename\$Username" -ItemType Directory


   $acl = Get-Acl -Path "$Drive\$username"
   $acl.SetAccessRuleProtection($true,$false)  #This line prevents inheritance from parent folder
   

   # If object inheritance is turned off on the share this will give an error as it cannot deny the inheritance permission as it is already stopped.  
   # This has no negative effect on the folder creation for the user.

   $permission0 = $Username, 'FullControl', 'ContainerInherit, ObjectInherit', 'None', 'Allow'
   $permission1 = $Staff1, 'FullControl', 'ContainerInherit, ObjectInherit', 'None', 'Allow'
   $permission2 = $Staff2, 'FullControl', 'ContainerInherit, ObjectInherit', 'None', 'Allow'
   $permission3 = $Staff3, 'FullControl', 'ContainerInherit, ObjectInherit', 'None', 'Allow'
   $permission4 = $Staff4, 'FullControl', 'ContainerInherit, ObjectInherit', 'None', 'Allow'
   $permission5 = $Staff5, 'FullControl', 'ContainerInherit, ObjectInherit', 'None', 'Allow'
   $permission6 = $Staff6, 'FullControl', 'ContainerInherit, ObjectInherit', 'None', 'Allow'
   $permission7 = $Staff7, 'FullControl', 'ContainerInherit, ObjectInherit', 'None', 'Allow'
   # This denotes what level of access each user is given.  A seperate permission for each use is defined



   $rule0 = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList $permission0
   $rule1 = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList $permission1
   $rule2 = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList $permission2
   $rule3 = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList $permission3
   $rule4 = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList $permission4
   $rule5 = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList $permission5
   $rule6 = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList $permission6
   $rule7 = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList $permission7
   # The permissions are now used to create rules that will be applied to the object using the below commands.


   $acl.ADDAccessRule($rule0) 
   $acl.ADDAccessRule($rule1)
   $acl.ADDAccessRule($rule2)
   $acl.ADDAccessRule($rule3)
   $acl.ADDAccessRule($rule4)
   $acl.ADDAccessRule($rule5)
   $acl.ADDAccessRule($rule6)
   $acl.ADDAccessRule($rule7)
   # These rules are added to the directory created however they are not yet set

   $acl | Set-Acl -Path "$Drive\$Username"  
   # Now that the rules are defined and added they are applied usning this line



}

 

The csv looks something like thislike this

 

Username Staff1 Staff2 Staff3 Staff4 Staff5 Staff6 Staff7

folder owner Line manager Business manager SLT1 SLT2 SLT3 HR1 HR2

Edited July 5, 2019 by noelmm

[HPlum78]

The above from @noelmm would work but you really need to connect this up to your joiners/ movers / leavers process as this will determine who has what access to the folders during the life cycle of an identity (account) in your organisations. what i am saying is don't be manually managing CSV files for access to this. The real issue is that this should be in the application that HR use and that solution should be storing and managing access to this information as one mistake in the permissions and you could find that you are invited to a conversation!

[Koldov]

Thanks all!

 

As we are a small school we have no HR department or HR software (this is dealt with by the Borough).

 

I managed to create folders based on the csv file...

 

# location where the subfolders will be created
$folder = "E:\Staff$\Performance Management Staff Folders\"

# csv file with folder names
# csv layout as follows
# 
# name
# STAFF 1
# STAFF 2
# STAFF 3

$name = Import-Csv C:\staff.csv

Foreach ($line in $name){

New-Item -path $folder -Name $line.Name -Type Directory
}

 

But in the end it was much quicker to deal with permissions manually...

 

I'm not really happy running code that I don't fully understand or using third party apps if I can help it (looked at NTFSfix, but it needed .NET 1.1)....

 

I never really got onboard with Powershell, as powerful as it might be there just doesn't seem to be anywhere that has the basic instructions (and I mean REALLY basic) and there always seems to be a few different ways to do what should be a simple manual task...

 

I did Google search how to even do a simple folder creation and found 3 or 4 ways to do it and for a complete n00b it really just confuses the issue...

Edited July 5, 2019 by Koldov

[HPlum78]

Don't give up on PS just yet, it can be daunting but it's Power is in its versitility. Don Jones books on PowerShell in a month of lunches will go a long way to ease you in to PS.