Solved

Powershell script - set folder permissions

Posted on 2011-09-02
4
1,765 Views
Last Modified: 2012-05-12
I have a Windows 2008 file server. I have the following share
D:\Folder1 > this folder is shared to domain users with "list folder contents only"
Reason: Directory structure inside Folder1 is company standard.

Inside D:\Folder1

\UserFolder1
\UserFolder2
\UserFolder3
.
.
.
\UserFolder200

Permissions to be set on each subfolder: disallow inheritable permissions from parent. Then set the modidy permission for each folder.


So i found this powershell script to do this. However i cant seem to understand what could be inside c:\folders.txt. i am thinking it could be some kind of permission statement

Also can you explain the foreach loop?

I am learning powershell now and i have had to refresh my mind scripting which i havent done in a long time.

Script:
===============================

for ($i=1;$i-le200;$i++)
{
New-Item ('c:\Folder1\UserFolder' + $i) -type directory
}

$Users = Get-Content 'C:\Folders.txt'

# grabs the ACL from the model folder created to duplicate acl to folders 1-200
$acl = Get-Acl ('C:\Folder1\Model')

ForEach ($user in $users)
{
      $newPath = Join-Path "C:\Folder1\" -childpath $user
      $acl | Set-Acl $newPath
}
0
Comment
Question by:lurezero
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
4 Comments
 
LVL 8

Expert Comment

by:brittonv
ID: 36473527
for each item in folders.txt it will store it as $user and use it in each pass

so if folders.txt contained:
apples
oranges

the first time in the foreach loop
$users will be apples
second time $users will be oranges
...
0
 

Author Comment

by:lurezero
ID: 36473717
so i am guessing the folders.txt contains a list of users? or group?

what would be the syntax?
0
 
LVL 16

Expert Comment

by:Bryan Butler
ID: 36474176
Yes.  List of users login IDs.  Just one per line:

User1ID
User2ID
etc...
0
 
LVL 16

Accepted Solution

by:
Dale Harris earned 500 total points
ID: 36474267
The script you pulled up is to create a special list of folders based on users, so the place where it says "Home Directory" in AD, is where their home folder would be.

Example:

John.smith has a user account.

In the shared drive, it creates a folder for him called john.smith and applies permissions for him.

That's not what you're looking for.

You're going to want a "model" folder set up the way you want and pull the ACL from there and apply it to the subsequent folders.

Example:

I have a folder in my C:\ called Test.  Here's the gci -recurse of that folder:

PS C:\test> gci -recurse


    Directory: C:\test


Mode                LastWriteTime     Length Name
----                -------------     ------ ----
d----          9/2/2011   9:51 AM            ExampleFolder
d----          9/2/2011   9:50 AM            model


    Directory: C:\test\ExampleFolder


Mode                LastWriteTime     Length Name
----                -------------     ------ ----
d----          9/2/2011   9:51 AM            ExampleFolder1
d----          9/2/2011   9:51 AM            NewExample
d----          9/2/2011   9:51 AM            _2


    Directory: C:\test\ExampleFolder\_2


Mode                LastWriteTime     Length Name
----                -------------     ------ ----
d----          9/2/2011   9:51 AM            ExampleFolder1
d----          9/2/2011   9:51 AM            _2NewExample

You can see there are multiple folders within folders (no files).

We are going to do our first command against the "model" folder, or the folder that I've set to not receive inheritable permissions.  You can also set up permissions on that model folder for people like "domain admin" "users" "company 1 users" "company 2 users", etc so that it will make a mirror on all the folders in a given directory.  If you want to make sure you do only folders, we can do that too.

The other folders I've confirmed already have inheritable permissions set as true.

$ACL = get-acl "c:\test\model"

#Now we are going to set this ACL example we have on all the subsequent files and folders

gci -recurse c:\Test\ExampleFolder | %{set-acl -aclobject $ACL $_.fullname}
#If you want to apply only to folders, do this instead
gci -recurse c:\Test\ExampleFolder | ?{$_.psiscontainer} |%{set-acl -aclobject $ACL $_.fullname}

Now when I go to each folder, the permissions have changed only slightly.  Now they are not inheriting permissions and anything on the "model" folder has been overwritten to the permissions of the folder.

Warning: tested on a Windows 7 box, not on a Windows Server 2008 environment.  Please test this out first on a test environment, don't mess with production.

HTH,

Dale Harris
0

Featured Post

PeopleSoft Has Never Been Easier

PeopleSoft Adoption Made Smooth & Simple!

On-The-Job Training Is made Intuitive & Easy With WalkMe's On-Screen Guidance Tool.  Claim Your Free WalkMe Account Now

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A recent project that involved parsing Tableau Desktop and Server log files to extract reusable user queries for use in other systems. I chose to use PowerShell to gather the data, and SharePoint to present it...
Previously, on our Nano Server Deployment series, we've created a new nano server image and deployed it on a physical server in part 2. Now we will go through configuration.
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question