Question

简而言之，我的脚本应该创建5个文件夹，1个根级别文件夹，3个2级文件夹和1个3级文件夹。

在第二级授予权限，即ReadWrite或ReadOnly。任何用户都不能在第二级中创建任何内容或删除第二级。

我似乎在Set-Acl和权限方面遇到了问题。我想知道是否有更好的方法可以编写此脚本，而我不需要提升特权。我们的DA可以很好地运行脚本，而我可以手动创建文件夹和安全组，但是它很繁琐且容易出错。对于我做错了什么或如何做得更好的任何见解，将不胜感激。

Import-Module ActiveDirectory
$path = "\\earth\data\group\"
$newFolderName = Read-Host -Prompt "Enter Name of New Folder"
$newFolderFull = $path + $newFolderName
Write-Output "New Folder will be: $newFolderFull"
$confirm = Read-Host "Confirm? Y/N"
if (!(($confirm) -ne "y")) {
    Write-Output "Create AD Groups"
    $groupNamePGroup = "P_$newFolderName"
    $groupNameAdminRW = "EG-$newFolderName-Admin-RW"
    $groupNameAdminRF = "EG-$newFolderName-Admin-RF"
    $groupNameEveryoneRW = "EG-$newFolderName-Everyone-RW"
    $groupNameEveryoneRF = "EG-$newFolderName-Everyone-RF"
    $groupNameScannedDocsRW = "EG-$newFolderName-ScannedDocs-RW"

    New-ADGroup $groupNamePGroup -samAccountName $groupNamePGroup -GroupScope DomainLocal -path "OU=SecurityGroups,OU=Metro,DC=metrogr,DC=org"
    New-ADGroup $groupNameAdminRW -samAccountName $groupNameAdminRW -GroupScope DomainLocal -path "OU=SecurityGroups,OU=Metro,DC=metrogr,DC=org"
    New-ADGroup $groupNameAdminRF -samAccountName $groupNameAdminRF -GroupScope DomainLocal -path "OU=SecurityGroups,OU=Metro,DC=metrogr,DC=org"
    New-ADGroup $groupNameEveryoneRW -samAccountName $groupNameEveryoneRW -GroupScope DomainLocal -path "OU=SecurityGroups,OU=Metro,DC=metrogr,DC=org"
    New-ADGroup $groupNameEveryoneRF -samAccountName $groupNameEveryoneRF -GroupScope DomainLocal -path "OU=SecurityGroups,OU=Metro,DC=metrogr,DC=org"
    New-ADGroup $groupNameScannedDocsRW -samAccountName $groupNameScannedDocsRW -GroupScope DomainLocal -path "OU=SecurityGroups,OU=Metro,DC=metrogr,DC=org"

    Write-Output "Add Folder.."
    New-Item $newFolderFull -ItemType Directory
    New-Item $newFolderFull\Admin -ItemType Directory
    New-Item $newFolderFull\Everyone -ItemType Directory
    New-Item $newFolderFull\ScannedDocs -ItemType Directory
    New-Item $newFolderFull\Everyone\ScannedDocs -ItemType Directory

    Write-Output "Remove Inheritance.."
    icacls $newFolderFull /inheritance:d
    icacls $newFolderFull\Admin /inheritance:d
    icacls $newFolderFull\Everyone /inheritance:d
    icacls $newFolderFull\Everyone\ScannedDocs /inheritance:d
    #icacls $newFolderFull\ScannedDocs /inheritance:d

    # Rights
    $readOnly = [Security.AccessControl.FileSystemRights]"ReadAndExecute"
    $readWrite = [Security.AccessControl.FileSystemRights]"Write, DeleteSubdirectoriesAndFiles,ReadAndExecute"

    # Inheritance
    $inheritanceFlag = [Security.AccessControl.InheritanceFlags]"ContainerInherit, ObjectInherit"
    # Propagation
    $propagationFlag = [Security.AccessControl.PropagationFlags]::None
    # User
    $PUserRF = New-Object System.Security.Principal.NTAccount($groupNamePGroup)
    $AdminUserRW = New-Object System.Security.Principal.NTAccount($groupnameAdminRW)
    $AdminUserRF = New-Object System.Security.Principal.NTAccount($groupnameAdminRF)
    $EveryoneUserRW = New-Object System.Security.Principal.NTAccount($groupnameEveryoneRW)
    $EveryoneUserRF = New-Object System.Security.Principal.NTAccount($groupnameEveryoneRF)
    $ScannedDocsUserRW = New-Object System.Security.Principal.NTAccount($groupnameScannedDocsRW)
    # Type
    $type = [Security.AccessControl.AccessControlType]::Allow

    #Add Group membership
    Add-ADGroupMember -Identity $groupNamePGroup -Members $groupNameAdminRW,$groupNameAdminRF,$groupNameEveryoneRW,$groupNameEveryoneRF,$groupNameScannedDocsRW
    Add-ADGroupMember -Identity $groupNameEveryoneRW -Members NDPSSCAN
    Add-ADGroupMember -Identity $groupNameScannedDocsRW -Members NDPSSCAN

    # ACL
    $accessControlEntryDefault = New-Object System.Security.AccessControl.FileSystemAccessRule @("Domain Users", $readOnly, $inheritanceFlag, $propagationFlag, $type)
    $accessControlRootEntryRF = New-Object System.Security.AccessControl.FileSystemAccessRule @($PUserRF, $readOnly, $inheritanceFlag, $propagationFlag, $type)
    $accessControlAdminEntryRW = New-Object System.Security.AccessControl.FileSystemAccessRule @($AdminUserRW, $readWrite, $inheritanceFlag, $propagationFlag, $type)
    $accessControlAdminEntryRF = New-Object System.Security.AccessControl.FileSystemAccessRule @($AdminUserRF, $readOnly, $inheritanceFlag, $propagationFlag, $type)
    $accessControlEveryoneEntryRW = New-Object System.Security.AccessControl.FileSystemAccessRule @($EveryoneUserRW, $readWrite, $inheritanceFlag, $propagationFlag, $type)
    $accessControlEveryoneEntryRF = New-Object System.Security.AccessControl.FileSystemAccessRule @($EveryoneUserRF, $readOnly, $inheritanceFlag, $propagationFlag, $type)
    $accessControlScannedDocsEntryRW = New-Object System.Security.AccessControl.FileSystemAccessRule @($ScannedDocsUserRW, $readWrite, $inheritanceFlag, $propagationFlag, $type)

    $objACL = Get-Acl $newFolderFull
    $objACL.RemoveAccessRuleAll($accessControlEntryDefault)
    $objACL.AddAccessRule($accessControlRootEntryRF)
    Set-Acl $newFolderFull $objACL

    $objACL = Get-Acl $newFolderFull\Admin
    $objACL.RemoveAccessRuleAll($accessControlEntryDefault)
    $objACL.AddAccessRule($accessControlAdminEntryRW)
    $objACL.AddAccessRule($accessControlAdminEntryRF)
    Set-Acl $newFolderFull\Admin $objACL

    $objACL = Get-Acl $newFolderFull\Everyone
    $objACL.RemoveAccessRuleAll($accessControlEntryDefault)
    $objACL.AddAccessRule($accessControlEveryoneEntryRW)
    $objACL.AddAccessRule($accessControlEveryoneEntryRF)
    Set-Acl $newFolderFull\Everyone $objACL

    $objACL = Get-Acl $newFolderFull\ScannedDocs
    $objACL.RemoveAccessRuleAll($accessControlEntryDefault)
    $objACL.AddAccessRule($accessControlScannedDocsEntryRW)
    Set-Acl $newFolderFull\ScannedDocs $objACL
}

Answer 1

SetAccessControl($objACL)为我工作。

Set-ACL无效，因为我的帐户没有提升的权限。

使用PowerShell在NTFS Fileshare上设置权限

1 个答案: