Question

我想：

创建新文件夹
设置文件夹的共享名称，以便用户可以看到它
创建AD组FS-TESTSHARE-R
创建AD组FS-TESTSHARE-RW
将两个组应用于新的共享文件夹
设置FS-TESTSHARE-R的完全读取权限
为FS-TESTSHARE-RW设置完全读取/权限
设置对域管理员的完全访问权限

这是我玩了一会儿之后现在所拥有的，但我想确保我没有错过任何东西。我已经决定了（暂时省略了参数设置，但我可以稍后再回过头来看。这看起来是否正确或是否有更好的方法来编写脚本？

我还遇到了一堆关于意外

的错误

New-ADGroup 
    -Name "FS-$NAME-RW" 
    -SamAccountName "FS-"+$NAME+"-RW" 
    -GroupCategory Security 
    -GroupScope Global 
    -DisplayName "$NAME Read-Write Access" 
    -Path "CN=$LOCATION,CN=SECURITY GROUPS,CN=FILE SHARE GROUPS,DC=ESG,DC=INTL" 
    -Description "Members of this group have read-write access to the test share"

New-ADGroup 
    -Name "FS-$NAME-R" 
    -SamAccountName "FS-"+$NAME+"-R" 
    -GroupCategory Security 
    -GroupScope Global 
    -DisplayName "$NAME Read Access" 
    -Path "CN=$LOCATION,CN=SECURITY GROUPS,CN=FILE SHARE GROUPS,DC=ESG,DC=INTL"
    -Description "Members of this group have read access to the test share"


# create new folder
New-Item -Path $Path -ItemType Directory

# get permissions
$acl = Get-Acl -Path $Path

#Get Security Groups
get-adobject -searchbase "CN=SECURITY GROUPS,CN=FILE SHARE GROUPS,DC=ESG,DC=INTL" -ldapfilter {(objectclass=group)}

# add a new permission
$acl.SetAccessRuleProtection($True, $False)

$rule = New-Object System.Security.AccessControl.FileSystemAccessRule("Administrators","FullControl", "ContainerInherit, ObjectInherit", "None", "Allow")
$acl.AddAccessRule($rule)

$rule = New-Object System.Security.AccessControl.FileSystemAccessRule("esg.intl\Domain Admins","FullControl", "ContainerInherit, ObjectInherit", "None", "Allow")
$acl.AddAccessRule($rule)

$rule = New-Object System.Security.AccessControl.FileSystemAccessRule("esg.intl\"FS-"+$NAME+"-R"","FullControl", "ContainerInherit, ObjectInherit", "None", "Allow")
$acl.AddAccessRule($rule)

$rule = New-Object System.Security.AccessControl.FileSystemAccessRule("esg.intl\"FS-"+$NAME+"-RW"","FullControl", "ContainerInherit, ObjectInherit", "None", "Allow")
$acl.AddAccessRule($rule)

# set new permissions
$acl | Set-Acl -Path $path

我也遇到了一些错误，我不确定我是否理解如何修复它们......

At C:\Users\A-Shane.Johnson\Desktop\ShareFolderCreation.ps1:44 char:96
+ ... " -ldapfilter {(objectclass=group)}
+                    ~
Use `{ instead of { in variable names.
At C:\Users\A-Shane.Johnson\Desktop\ShareFolderCreation.ps1:55 char:82
+ ... ule("esg.intl\"FS-"+$NAME+"-R"","FullControl", "ContainerInherit, ObjectInherit" ...
+                    ~~~~~~~~~~~~~~~~
Unexpected token 'FS-"+$NAME+"-R""' in expression or statement.
At C:\Users\A-Shane.Johnson\Desktop\ShareFolderCreation.ps1:55 char:82
+ ... ule("esg.intl\"FS-"+$NAME+"-R"","FullControl", "ContainerInherit, ObjectInherit" ...
+                    ~
Missing closing ')' in expression.
At C:\Users\A-Shane.Johnson\Desktop\ShareFolderCreation.ps1:55 char:164
+ ... "None", "Allow")
+                    ~
Unexpected token ')' in expression or statement.
At C:\Users\A-Shane.Johnson\Desktop\ShareFolderCreation.ps1:58 char:82
+ ... ule("esg.intl\"FS-"+$NAME+"-RW"","FullControl", "ContainerInherit, ObjectInherit ...
+                    ~~~~~~~~~~~~~~~~~
Unexpected token 'FS-"+$NAME+"-RW""' in expression or statement.
At C:\Users\A-Shane.Johnson\Desktop\ShareFolderCreation.ps1:58 char:82
+ ... ule("esg.intl\"FS-"+$NAME+"-RW"","FullControl", "ContainerInherit, ObjectInherit ...
+                    ~
Missing closing ')' in expression.
At C:\Users\A-Shane.Johnson\Desktop\ShareFolderCreation.ps1:58 char:165
+ ... "None", "Allow")
+                    ~
Unexpected token ')' in expression or statement.
    + CategoryInfo          : ParserError: (:) [], ParseException
    + FullyQualifiedErrorId : OpenBraceNeedsToBeBackTickedInVariableName

Answer 1

好的，我看到了几件事。首先，字符串插值......你在哪里：

"FS-"+$NAME+"-RW"

您可以简单地将其缩短为：

"FS-$NAME-RW"

当在双引号内找到变量时，它会尝试自动将变量扩展为字符串。我不打算遵守规定或规则，因为我认为这只会使这个过于复杂化。可以这么说，仅当这个更改应用于可以在您的脚本中的所有实例时，可能会删除大部分错误。 ......并且可能会创建新的，因为几个命令将被正确解释。

接下来，命令语法。你的前两个命令，除非你已经逃脱了新的行并且没有反映在你的问题中，否则可能不会像你期望的那样执行。如果你想像你一样空出你的参数，我会建议将它们设置为哈希表，然后在执行命令时扩展哈希表。你可以这样做：

$GroupParams= @{
    'Name' = "FS-$NAME-RW" 
    'SamAccountName' = "FS-$NAME-RW" 
    'GroupCategory' = "Security"
    'GroupScope' = "Global"
    'DisplayName' = "$NAME Read-Write Access"
    'Path' = "CN=$LOCATION,CN=SECURITY GROUPS,CN=FILE SHARE GROUPS,DC=ESG,DC=INTL"
    'Description' = "Members of this group have read-write access to the test share"
}

New-ADGroup @GroupParams

您的LDAPFilter行错误，那条线看起来多余，所以我会说出来并继续前进。

请注意，您正在为Read组授予FullAccess权限，您可能希望将其更改为ReadAndExecute。

最后，如果您的ACL出现问题，那么在处理文件共享上的ACL时，我会给出相同的建议。明确定义您的设置，然后将它们作为访问规则应用。我使用以下作为模板：

$Rights = [System.Security.AccessControl.FileSystemRights]"FullControl" 

$InheritanceFlag = [System.Security.AccessControl.InheritanceFlags]"ObjectInherit,ContainerInherit"
$PropagationFlag = [System.Security.AccessControl.PropagationFlags]::None 

$objType =[System.Security.AccessControl.AccessControlType]::Allow 

$objUser = New-Object System.Security.Principal.NTAccount("IIS_IUSRS") 

$objACE = New-Object System.Security.AccessControl.FileSystemAccessRule($objUser, $Rights, $InheritanceFlag, $PropagationFlag, $objType) 

$objACL = Get-ACL "C:\Temp" 

$objACL.AddAccessRule($objACE) 

Set-ACL "C:\Temp" $objACL

另一方面，您从未真正处理过宣布共享名称的所有网络共享内容。您可能需要运行get-help New-SMBShare -Full以获取有关设置网络共享的更多信息。

单个PowerShell脚本，用于创建文件夹，AD组以及将新组应用于文件夹

1 个答案: