Solved

Powershell script - set folder permissions

Posted on 2011-09-02
4
1,692 Views
Last Modified: 2012-05-12
I have a Windows 2008 file server. I have the following share
D:\Folder1 > this folder is shared to domain users with "list folder contents only"
Reason: Directory structure inside Folder1 is company standard.

Inside D:\Folder1

\UserFolder1
\UserFolder2
\UserFolder3
.
.
.
\UserFolder200

Permissions to be set on each subfolder: disallow inheritable permissions from parent. Then set the modidy permission for each folder.


So i found this powershell script to do this. However i cant seem to understand what could be inside c:\folders.txt. i am thinking it could be some kind of permission statement

Also can you explain the foreach loop?

I am learning powershell now and i have had to refresh my mind scripting which i havent done in a long time.

Script:
===============================

for ($i=1;$i-le200;$i++)
{
New-Item ('c:\Folder1\UserFolder' + $i) -type directory
}

$Users = Get-Content 'C:\Folders.txt'

# grabs the ACL from the model folder created to duplicate acl to folders 1-200
$acl = Get-Acl ('C:\Folder1\Model')

ForEach ($user in $users)
{
      $newPath = Join-Path "C:\Folder1\" -childpath $user
      $acl | Set-Acl $newPath
}
0
Comment
Question by:lurezero
4 Comments
 
LVL 8

Expert Comment

by:brittonv
ID: 36473527
for each item in folders.txt it will store it as $user and use it in each pass

so if folders.txt contained:
apples
oranges

the first time in the foreach loop
$users will be apples
second time $users will be oranges
...
0
 

Author Comment

by:lurezero
ID: 36473717
so i am guessing the folders.txt contains a list of users? or group?

what would be the syntax?
0
 
LVL 16

Expert Comment

by:Bryan Butler
ID: 36474176
Yes.  List of users login IDs.  Just one per line:

User1ID
User2ID
etc...
0
 
LVL 16

Accepted Solution

by:
Dale Harris earned 500 total points
ID: 36474267
The script you pulled up is to create a special list of folders based on users, so the place where it says "Home Directory" in AD, is where their home folder would be.

Example:

John.smith has a user account.

In the shared drive, it creates a folder for him called john.smith and applies permissions for him.

That's not what you're looking for.

You're going to want a "model" folder set up the way you want and pull the ACL from there and apply it to the subsequent folders.

Example:

I have a folder in my C:\ called Test.  Here's the gci -recurse of that folder:

PS C:\test> gci -recurse


    Directory: C:\test


Mode                LastWriteTime     Length Name
----                -------------     ------ ----
d----          9/2/2011   9:51 AM            ExampleFolder
d----          9/2/2011   9:50 AM            model


    Directory: C:\test\ExampleFolder


Mode                LastWriteTime     Length Name
----                -------------     ------ ----
d----          9/2/2011   9:51 AM            ExampleFolder1
d----          9/2/2011   9:51 AM            NewExample
d----          9/2/2011   9:51 AM            _2


    Directory: C:\test\ExampleFolder\_2


Mode                LastWriteTime     Length Name
----                -------------     ------ ----
d----          9/2/2011   9:51 AM            ExampleFolder1
d----          9/2/2011   9:51 AM            _2NewExample

You can see there are multiple folders within folders (no files).

We are going to do our first command against the "model" folder, or the folder that I've set to not receive inheritable permissions.  You can also set up permissions on that model folder for people like "domain admin" "users" "company 1 users" "company 2 users", etc so that it will make a mirror on all the folders in a given directory.  If you want to make sure you do only folders, we can do that too.

The other folders I've confirmed already have inheritable permissions set as true.

$ACL = get-acl "c:\test\model"

#Now we are going to set this ACL example we have on all the subsequent files and folders

gci -recurse c:\Test\ExampleFolder | %{set-acl -aclobject $ACL $_.fullname}
#If you want to apply only to folders, do this instead
gci -recurse c:\Test\ExampleFolder | ?{$_.psiscontainer} |%{set-acl -aclobject $ACL $_.fullname}

Now when I go to each folder, the permissions have changed only slightly.  Now they are not inheriting permissions and anything on the "model" folder has been overwritten to the permissions of the folder.

Warning: tested on a Windows 7 box, not on a Windows Server 2008 environment.  Please test this out first on a test environment, don't mess with production.

HTH,

Dale Harris
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

OfficeMate Freezes on login or does not load after login credentials are input.
This article will help you understand what HashTables are and how to use them in PowerShell.
This tutorial will give a short introduction and overview of Backup Exec 2012 and how to navigate and perform basic functions. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as conne…
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now