Home drive permissions

[Tinribs]

Hey all

WE've had some new software installed to sync accounts from SIMS to AD. As part of the installation the people also made sure all the student accounts are in the correct intake years (OUs). This meant that some home drives had to be copied to new locations so GPO could map them correctly.

Unfortunately this didn't go too well. It looks very much like most of the moved home drive folders were copied without adding/retaining the permissions for the individual students so that they don't actually map.

I've run accessenum on one of the folders and I can see that there are many folders missing these permissions.

I am looking for (and failing to find) a script or any programmatic way to ensure the permissions are correct for each folder. If there's a free app that can do it I'll go there.

I've been looking at using Get-ADuser to do this but I have no idea how to even start this.

Help??

[Boredguy]

A few years back, we posted our powershell script for creating users, which also contained settings for resetting user permissions on their home drive folders

(http://www.edugeek.net/forums/behind-red-door/217258-automating-student-account-creation-script.html)

 

You can use a command like $users = Get-ADUser -Filter * -SearchBase "OU=Finance,OU=UserAccounts,DC=FABRIKAM,DC=COM" to get a list of users in an array that you can then loop through, and update the permissions based on the value of the home directory

[Tinribs]

Thanks for this - maybe I should have mentioned that I am not very experienced in any form of coding and particularly when dealing with extracting data into variables.

For example - our student home drives are all on the same server in a share called studenthomes$ inside this share are folders labelled for each intake year (ie Intake2014 for all students who are of the age when they would have started in 2014). Inside each of these is a folder named as the students' logon ID that is their home drive.

I need to scan each intake folder, get the username from the home drive folder name then assign the relevant permissions to that folder using the username I've got earlier.

I know I probably need a course in basic PS stuff but I am not nor ever will be able to think like a coder. I don't mind dabbling when inspired....

Seeing as it appears that every single student who was moved to a different OU is affected then I probably don't have the time to play around with this and get it working myself

Much appreciate the reply and I can see the section of the script that does what I need. I just can't get my head around the string bit....

[Boredguy]

Assuming your Active Director domain is "Domain.Internal", the search string would be DC=Domain,DC=internal.

From there the rest is broken down buy the OU location your users are currently in.. so if it's in Users\Students\Intake2014 it would look like below

 

$users = Get-ADUser -Filter * -SearchBase "OU=Intake2014,OU=Students,OU=Users,DC=Domain,DC=internal" 

 

Powershell ForEach loops are quite easy

 

Foreach ($student in $users} {
#Do some stuff and the variable $student will have just that line, so $student.HomeDirectory will give you the value of that user
}

[DaveTheTech]

AD should given full access to users home drives. Is their homedirectory set to the correct value? If not It might be best to set that at the same time.

I would use the set-acl permisisons from above. Passing either the home directories from AD or from the list of all folders.

Matching the folder name on the sam account name.

$StudentShare = "\\fileserver\studentshare$"
$StudentOU = "OU=Students....dc= dc=" $students = get-aduser -SearchBase $StudentOU -Filter{enabled -eq $true}
$folders = Get-ChildItem $StudentShare -Recurse -Depth 2 # << Check that this returns folders similar to intake1\student1 and intake2\student2
foreach ($student in $students){
$UserPath = $folders.Where({$_.Name -match $student.SamAccountName})
...ACL} 

[jthompson]

Another option is to use Wisesoft NTFSFix - https://wisedataman.com/ntfsfix

 

It's pretty old but will let you do what you want.

 

Note that .NET 2.0 is required to run NTFSFix (enable .NET 3.5 in Windows to get support for 2.0).

 

To get a working utility from the download, you'll need to do the following:

 

Use a zip utility to extract an MSI file from the download.

Don't run that MSI. It requires .NET 1.1 so won't now work. Instead, extract the program's executable from the MSI using...

 

msiexec /a c:\setup.msi /qb TARGETDIR=c:\ntfsfix

 

NTFSFix.exe is then essentially a portable app. Run it as admin on the server hosting your users' home folders.

 

Assuming the folders are named to match their respective users, you can use a wildcard of DOMAIN\%foldername% in the utility when setting up the required new security entries.

[Tinribs]

That is awesome!

Saved me heaps of time and frustration working around the mental block I have for any kind of scripting.

So cool and thanks for the hints about the installation. Invaluable.

Many thanks