PowerShell Set-Acl New-Object:找不到“FileSystemAccessRule”的重载和参数count:“4”

时间:2017-05-28 08:23:34

标签: powershell acl

我计算了脚本中创建目录名称的所有部分,根据预定义的目录结构创建目录,根据附加到硬编码名称的项目编号创建AD组,然后添加组到特定目录,并设置该组的ACL。

我似乎无法绕过错误:

New-Object : Cannot find an overload for "FileSystemAccessRule" and the argument count: "4".

这是脚本:

    $domain="DOMAIN"
    $tldn="net"

    $pathArr=@()
    $pathArr+=$path1=Read-Host -Prompt "Enter first path"
    $pathArr+=$path2=Read-Host -Prompt "Enter second path"
    [int]$projectNumber=try { Read-Host -Prompt "Enter project number" } catch { Write-Host "Not a numeric value. Please try again."; exit }
    [string]$mainFolder=[string]${projectNumber}+"_"+(Read-Host -Prompt "Please give the main folder name")
    $projectNumberString=[string]$projectNumber
    $projectName=Read-Host -Prompt "Please give the project name"
    $fullProjectName="${projectNumberString}_${projectName}"
    $pathArr+=$path3="$path1\$mainFolder"
    $pathArr+=$path4="$path2\$mainFolder"
    $pathArr+=$path5="$path3\$fullProjectName"
    $pathArr+=$path6="$path4\$fullProjectName"

    # Region: Create organizational units in Active Directory
    # Names
    $ouN1="XYZOU"
    $ouN2="ABCOU"

    # Paths
    $ouP0="DC=$domain,DC=$tldn"
    $ouP1="OU=$ouN1,$ouP0"
    $ouP2="OU=$ouN2,$ouP1"

    Write-Host "Checking for required origanization units..."
    try
    {
        New-ADOrganizationalUnit -Name $ouN1 -Path $ouP1
        New-ADOrganizationalUnit -Name $ouN2 -Path $ouP2

    }
    catch
    {
        Out-Null
    }

    Write-Host "Creating AD Group..."
    [string]$group="BEST_${projectNumberString}"
    $groupdomain="$domain\$group"

    $ADGroupParams= @{
        'Name' = "$group" 
        'SamAccountName' = "$group" 
        'GroupCategory' = "Security"
        'GroupScope' = "Global"
        'DisplayName' = "$group"
        'Path' = "OU=MyBusinessOU,DC=$domain,DC=$tldn"
        'Description' = "Test share"
    }
    $secgroup=New-ADGroup @ADGroupParams

    # Region: Set permissions
    Write-Host "Setting permissions..."

    # get permissions
    $acl = Get-Acl -Path $path6

    # add a new permission
    $InheritanceFlags=[System.Security.AccessControl.InheritanceFlags]”ContainerInherit, ObjectInherit”
    $FileSystemAccessRights=[System.Security.AccessControl.FileSystemRights]"Traverse","Executefile","ListDirectory","ReadData", "ReadAttributes", "ReadExtendedAttributes","CreateFiles","WriteData", 'ContainerInherit, ObjectInherit', "CreateDirectories","AppendData", "WriteAttributes", "WriteExtendedAttributes", "DeleteSubdirectoriesAndFiles", "ReadPermissions"
    $InheritanceFlags=[System.Security.AccessControl.InheritanceFlags]”ContainerInherit, ObjectInherit”
    $PropagationFlags=[System.Security.AccessControl.PropagationFlags]”None”
    $AccessControl=[System.Security.AccessControl.AccessControlType]”Allow”
    $permission = "$groupdomain", "$InheritanceFlags", "$PropagationFlags", "$AccessControl"
    $rule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList $permission
    $acl.SetAccessRule($rule)

    # set new permissions
    $acl | Set-Acl -Path $path6

同样,我正在尝试按照我在Windows环境中的Active Directory中手动执行的操作

  1. 创建广告组
  2. 将该群组添加到共享
  3. 设置群组权限
  4. 此脚本不会将用户添加到组
  5. 最后一步是设置权限;不幸的是,当我运行脚本时,更改语法或方法(以下几篇文章中的示例),现在花费数小时,我只是没有进展。唯一的进展是它无法超载的数量从18下降到4.

    提前感谢您的帮助!

    修改

    我根据评论修改了脚本,指出我错过了$FileSystemAccessRights参数。

    $permission变量已更改为:

    $permission = "$groupdomain", "$FileSystemAccessRights", "$InheritanceFlags", "$PropagationFlags", "$AccessControl"

    我仍然得到这个输出:

    New-Object : Cannot convert argument "1", with value: "ExecuteFile Executefile ListDirectory ReadData ReadAttributes 
    ReadExtendedAttributes CreateFiles WriteData ContainerInherit, ObjectInherit CreateDirectories AppendData WriteAttributes 
    WriteExtendedAttributes DeleteSubdirectoriesAndFiles ReadPermissions", for "FileSystemAccessRule" to type 
    "System.Security.AccessControl.FileSystemRights": "Cannot convert value "ExecuteFile Executefile ListDirectory ReadData 
    ReadAttributes ReadExtendedAttributes CreateFiles WriteData ContainerInherit, ObjectInherit CreateDirectories AppendData 
    WriteAttributes WriteExtendedAttributes DeleteSubdirectoriesAndFiles ReadPermissions" to type 
    "System.Security.AccessControl.FileSystemRights". Error: "Unable to match the identifier name ExecuteFile Executefile ListDirectory 
    ReadData ReadAttributes ReadExtendedAttributes CreateFiles WriteData ContainerInherit, ObjectInherit CreateDirectories AppendData 
    WriteAttributes WriteExtendedAttributes DeleteSubdirectoriesAndFiles ReadPermissions to a valid enumerator name.  Specify one of the 
    following enumerator names and try again: ListDirectory, ReadData, WriteData, CreateFiles, CreateDirectories, AppendData, 
    ReadExtendedAttributes, WriteExtendedAttributes, Traverse, ExecuteFile, DeleteSubdirectoriesAndFiles, ReadAttributes, 
    WriteAttributes, Write, Delete, ReadPermissions, Read, ReadAndExecute, Modify, ChangePermissions, TakeOwnership, Synchronize, 
    FullControl""
    

    修改

    我尝试从变量中删除引号,因为除了$groupdomain之外,似乎每个变量都有引号,然后出现此错误:

    New-Object : Cannot convert argument "1", with value: "System.Object[]", for "FileSystemAccessRule" to type 
    "System.Security.AccessControl.FileSystemRights": "Cannot convert value 
    "ExecuteFile,Executefile,ListDirectory,ReadData,ReadAttributes,ReadExtendedAttributes,CreateFiles,WriteData,ContainerInherit, 
    ObjectInherit,CreateDirectories,AppendData,WriteAttributes,WriteExtendedAttributes,DeleteSubdirectoriesAndFiles,ReadPermissions" to 
    type "System.Security.AccessControl.FileSystemRights". Error: "Unable to match the identifier name 
    ExecuteFile,Executefile,ListDirectory,ReadData,ReadAttributes,ReadExtendedAttributes,CreateFiles,WriteData,ContainerInherit, 
    ObjectInherit,CreateDirectories,AppendData,WriteAttributes,WriteExtendedAttributes,DeleteSubdirectoriesAndFiles,ReadPermissions to a 
    valid enumerator name.  Specify one of the following enumerator names and try again: ListDirectory, ReadData, WriteData, 
    CreateFiles, CreateDirectories, AppendData, ReadExtendedAttributes, WriteExtendedAttributes, Traverse, ExecuteFile, 
    DeleteSubdirectoriesAndFiles, ReadAttributes, WriteAttributes, Write, Delete, ReadPermissions, Read, ReadAndExecute, Modify, 
    ChangePermissions, TakeOwnership, Synchronize, FullControl""
    

    修改

    尝试用引号围绕整个New-Object的Stephen建议,然后得到这个错误:

    Cannot convert argument "rule", with value: "New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList 
    WOLF\Elite_1035 Write, Read ContainerInherit, ObjectInherit None Allow", for "SetAccessRule" to type 
    "System.Security.AccessControl.FileSystemAccessRule": "Cannot convert the "New-Object -TypeName 
    System.Security.AccessControl.FileSystemAccessRule -ArgumentList WOLF\Elite_1035 Write, Read ContainerInherit, ObjectInherit None 
    Allow" value of type "System.String" to type "System.Security.AccessControl.FileSystemAccessRule"."
    

    修改

    错误消失了,但我仍然没有看到任何组添加到$path6的安全属性中。

    我能够在理论上添加所有权限:

    $FileSystemAccessRights=[System.Security.AccessControl.FileSystemRights]"Traverse,Executefile,ListDirectory,ReadData, ReadAttributes, ReadExtendedAttributes,CreateFiles,WriteData,CreateDirectories,AppendData,WriteAttributes,WriteExtendedAttributes,DeleteSubdirectoriesAndFiles, ReadPermissions"

2 个答案:

答案 0 :(得分:2)

  

New-Object:找不到“FileSystemAccessRule”的重载和参数count:“5”。

此错误的解决方案是扩展您的变量而不是字符串(字符串周围没有引号)。因此,字符串变量中的任何逗号都被解析为参数。

Powershell可以使用@子句将变量扩展为字符串。

解决方案:

$permission = @($groupdomain), @($InheritanceFlags), @($PropagationFlags), @($AccessControl)
$rule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList $permission

但是,你在你的例子中做了什么......

  

$ permission =“$ groupdomain”,“$ InheritanceFlags”,“$ PropagationFlags”,“$ AccessControl”

...有点重新创建轮子,可能会导致遇到问题。此外,您传递的参数没有任何ADuser或SID,这也为您提供了这些错误。

可靠的解决方案

也适用于这个问题: PowerShell ACL Not Applying
首先 ,例如

$InheritanceFlags=[System.Security.AccessControl.InheritanceFlags]”ContainerInherit, ObjectInherit”
    $FileSystemAccessRights=[System.Security.AccessControl.FileSystemRights]"Traverse","Executefile","ListDirectory","ReadData", "ReadAttributes", "ReadExtendedAttributes","CreateFiles","WriteData", 'ContainerInherit, ObjectInherit', "CreateDirectories","AppendData", "WriteAttributes", "WriteExtendedAttributes", "DeleteSubdirectoriesAndFiles", "ReadPermissions"
    $InheritanceFlags=[System.Security.AccessControl.InheritanceFlags]”ContainerInherit, ObjectInherit”
    $PropagationFlags=[System.Security.AccessControl.PropagationFlags]”None”

很冗长,很难说你得到了什么(字符串,对象,枚举......) 由于这些属性的枚举在这些属性的EnumerationObjects中设置,您可以将字符串作为参数传递:

$InheritanceFlags = "ContainerInherit, ObjectInherit"
$FileSystemAccessRights = "Traverse,Executefile,ListDirectory,ReadData, ReadAttributes,ReadExtendedAttributes,CreateFiles,WriteData,CreateDirectories,AppendData,WriteAttributes,WriteExtendedAttributes,DeleteSubdirectoriesAndFiles,ReadPermissions"
.
etc...

我在您创建的$FileSystemAccessRights数组中遇到了错误的语句: 'ContainerInherit, ObjectInherit'不应该在那里。这不是有效的枚举字符串。
请参阅:FileSystemRights-Enumeration

这就是你遇到这个错误的原因: Unable to match the identifier name变量的$FileSystemAccessRights

第二 ,FileSystemAccessRule类需要传递 3或5 个参数。
请参阅:FileSystemAccessRule-Class

  • IdentityReference(来自AD的SID或完整samaccountname)
  • FileSystemRights(包含在字符串中的枚举并用逗号分隔)
  • [可选] InheritanceFlags
  • [可选] PropagationFlags
  • AccessControlType(String; if“Deny”或“Allow”)

确保你通过了 3或5 参数,不多也不少。

第三次 ,以可靠的方式设置ACL:

 # Region: Set permissions
 Write-Host "Setting permissions..."

    # get permissions
    $acl = Get-Acl -Path $path6

    # add a new permission
    $user = $secgroup
    $InheritanceFlags="ContainerInherit, ObjectInherit"
    $FileSystemAccessRights="Traverse,Executefile,ListDirectory,ReadData, ReadAttributes,ReadExtendedAttributes,CreateFiles,WriteData,CreateDirectories,AppendData,WriteAttributes,WriteExtendedAttributes,DeleteSubdirectoriesAndFiles,ReadPermissions"
    $InheritanceFlags="ContainerInherit, ObjectInherit"
    $PropagationFlags="None"
    $AccessControl="Allow"
    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule(@($user), @($FileSystemAccessRights), @($InheritanceFlags), @($PropagationFlags), @($AccessControl))
    $acl.SetAccessRule($rule)
    #set new permissions
    path6.SetAccessControl($acl)

请注意,我以其他方式使用函数,因为OP已发布,OP忘记将$secgroup变量传递给函数。 根据我的经验,这是在powershell中设置ACL的最可靠方法。

答案 1 :(得分:1)

您在参数

中忘记了$FileSystemAccessRights
$permission =  $groupdomain, $FileSystemAccessRights, $InheritanceFlags, $PropagationFlags, $AccessControl

编辑,删除双引号。

你还有两个问题:

首先创建一个$ principal对象

$principal = New-Object System.Security.Principal.NTAccount($groupdomain)

然后尝试减少$ FileSystemAccessRights因为它有问题,尝试一些简单的开始,如读/写访问。

$FileSystemAccessRights=[System.Security.AccessControl.FileSystemRights]"Read, Write"

更新变量$ permission的创建以包含主体:

$permission = $principal, $FileSystemAccessRights, $InheritanceFlags, $PropagationFlags, $AccessControl