Question

我尝试通过powershell为domainlocal组设置NTFS权限。因此，我遵循了本教程： https://technet.microsoft.com/en-us/library/ff730951.aspx

我调整了该代码以创建下面的代码段：

function set_NTFS_permissions ($group,$folder){
    $rule = "" # Just to make sure its empty
    $user_read = "gfo\"+$group+"_read"
    #$read_permissions = @("ReadAndExecute","Synchronize")
    $read_permissions = "ReadAndExecute,Synchronize"
    $user_write = "gfo\"+$group+"_edit"
    $write_permissions = "DeleteSubdirectoriesAndFiles,Write,ReadAndExecute,Synchronize"
    $acl = get-acl $folder # Calls for current permissions
    $acl.SetAccessRuleProtection($True,$True) # Protects inherit permissions (superior | inferior)
    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($user_read,$read_permissions,'ContainerInherit,ObjectInherit','None','Allow')
    $acl.AddAccessRule($rule)
    Set-Acl $folder $acl
    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($user_write,$write_permissions,'ContainerInherit,ObjectInherit','None','Allow')
    $acl.AddAccessRule($rule)
    Set-Acl $folder $acl
}

$folder = '\\domain.local\path\path\path'
$group = 'DL_fs_path'
set_NTFS_permissions $group $folder
Get-Acl $folder  | Format-List

这个工作得很好。

我的问题开始了，当我在另一个功能中使用该功能时。在那里，我创建了几个文件夹和组（工作），然后我想允许组到文件夹。为此，我使用一些变量调用上面的funktion（正确传输...在将它们传递给函数之前写入托管它们，然后再在函数的开头传递它们。）

Ausnahme beim Aufrufen von "AddAccessRule" mit 1 Argument(en):  "Some or all identity references could not be translated."
In C:\Scripts\filestruct.ps1:20 Zeichen:5
+     $acl.AddAccessRule($rule)
+     ~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : IdentityNotMappedException

有没有人知道，为什么它在传递静态时有效，但不能用于变量？

通过powershell获得NTFS权限

0 个答案: