PS: Set-ACL - Pulling hair out

[Rydema]

Morning All,

 

I have been setting up this little script that pulls user accounts in from a csv file and then creates the folders accordingly. That bit works.

 

However, Setting the ACL is another matter!? All I'm after doing is putting that user account on to Modify and remove a group called Students so that said user has access but no other students do.

 

Heres the code

 

#Locators

$Domain = "NAC.local"
$Server = "\\truenas\MusicFiles\Script"
$NAS = "\\truenas\MusicFiles\Script\Intake 20$Intake\$User"
$Users = Get-Content C:\Temp\Users.csv
#Script Start
cls
Set-Location $Server
#Intake Year Creation
Write-Output "Creating new users folders, Please provide intake year (Example: 21Jblogs is 21)"
$Intake = Read-Host -Prompt 'Intake year'
New-Item "Intake 20$Intake" -ItemType directory
cd "Intake 20$Intake"
#Student Home Drive for TrueNas
ForEach ($user in $Users)
{    $sam = $User    
If (Test-Path $NAS -PathType Container)    
{Write-host "$sam already exists"}    Else    {New-Item -path $NAS -ItemType directory -Force}
#Permissions Section    
Write-Output "Now setting permissions, please wait...."        
$acl = Get-Acl -Path $NAS        
#Access Rules Inherited from Parent Folders        
$acl.SetAccessRuleProtection($true, $false)        
$perm_user         = "$domain\$user",@('Modify'), "ContainerInherit,ObjectInherit","None","Allow"        
$userpermissions   = New-Object System.Security.AccessControl.FileSystemAccessRule($perm_user)        
$acl.AddAccessRule($userpermissions)        
Set-ACL "$NAS" $acl        }Write-Output "Folder Creation Completed."Pause

CSV File basically uses first column and each row for the username

 

Anyone possibly tell me what the heck is going on!

Edited May 18, 2021 by Rydema

[fordea]

Are you sure the folder creation part works? It looks like you define the $NAS variable outside of the loop but then never change it when $Intake is defined or when $User changes within loop iterations. As $NAS is defined before $Intake or $User are defined its value will just stay at "\\truenas\MusicFiles\Script\Intake 20" throughout the script. Edited May 18, 2021 by fordea

[HPlum78]

Not looked at the code but adding Domain Admins full control says that you have accounts in that group on a day to day basis @cdCache

 

As per the recommendation the Domain Admin group should have no users in it in day to day operation, if you need a group with access to all of your users data (and that's a big IF) then create a group for that purpose and keep it empty untill you need some access also monitor and alert on the group for accounts being added/ removed like you do for all the other highly priv groups in your domains.

Edited May 18, 2021 by HPlum78

[Chaniel]

This is how I do it in my script if it helps;

 

$ACL = Get-ACL "$homedir"
$ACL.Access | ForEach { [Void]$ACL.RemoveAccessRule($_) }
$ACL.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule("DOMAIN\Staff","ReadAndExecute", "ContainerInherit, ObjectInherit", "None", "Allow")))
$ACL.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule("DOMAIN\$samaccountname","Modify", "ContainerInherit, ObjectInherit", "None", "Allow")))
Set-ACL $homedir $ACL

 

$ACL.Access | ForEach { [Void]$ACL.RemoveAccessRule($_) }

Removes all permissions from the current ACL

 

It'll then add the three access rules (as required, staff - read and user - modify) and then set it on the folder.

Edited May 18, 2021 by Chaniel